44057 - Crash|corruption opening large bookmarks.html in autoscroll menu (MAC)

Status: RESOLVED WORKSFORME

(Core :: XUL, defect, P3)

Description

[John Morrison]

Overview Description:

  When I open a large bookmarks.html in the Bookmarks menu, on Macintosh,
  I get either (a) a crash or application freeze, or (b) a corrupt 
  representation of the contents of 'bookmarks.html'

  I'm not sure if this is because of the autoscroll, or whether it is now
  triggering something new in the mac menu code, or whether the problem is 
  in the RDF model (pinkerton, cc: evaughan, waterson)

Steps to Reproduce:

1) replace your bookmarks.html with the attached version. (This has 500 
   fictitious bookmarks and ~10 subfolders appended to the Netscape 
   commercial build defaults. 

2) start mozilla 

3) click-and-*hold* the bookmarks menu item. (It seems that if you don't 
   hold, you will usually crash). You will need to wait ~20 seconds 
   before the menu opens (if it doesn't crash in the meantime). 

Actual Results:
  (a) crashes (or the app freezes up)
  (b) the menu opens, but it is about 700px wide; when you scroll down
      to the end of the menu, random "gunk" appears (the in-memory model
      appears to have been trashed). 

Expected Results:
  

Reproducibility: you get either (a) or (b) on the mac. [Well actually, on
                 one occasion, it opened successfully with a proper 
                 representation of the file's contents, but I haven't been
                 able to do this a second time].

Build Date & Platform Bug Found:
  2000062711 mac comm. build (and in earlier builds on the weekend)

Additional Builds and Platforms Tested On:
  WORKS CORRECTLY (modulo bug 44055) on win95 and linux (rh6.1)

Additional Information:

On one of the crashes I got this stack, but in general I don't get
a usable stack trace from macsbugs when the crash occurs:

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  1F543D64  
  0EEEEB00    PPC  1F52E8A8  main+00130
  0EEEEAA0    PPC  1F52DDA4  main1(int, char**, nsISupports*)+00944
  0EEEE7E0    PPC  1F13FCF0  nsAppShellService::Run()+00018
  0EEEE7A0    PPC  1EE1A188  nsAppShell::Run()+00038
  0EEEE750    PPC  1EE1A884  nsMacMessagePump::DoMessagePump()+0003C
  0EEEE700    PPC  1EE1AD74  nsMacMessagePump::DispatchEvent(int, 
EventRecord*)+0005C
  0EEEE6B0    PPC  1EE1B078  nsMacMessagePump::DoMouseDown(EventRecord&)+000B0
  0EEEE5B0    PPC  FFD10B00  MenuSelect+0001C
  0EEEE4D0    68K  005FC9E0  
  0EEEE477    PPC  004730AC  EmToNatEndMoveParams+00014
  0EEEE400    PPC  2013CD10  GetSubmenuParentChoosable+00160
  0EEEE3B0    PPC  2013D4E8  GetSubmenuParentChoosable+00938
  0EEEE310    PPC  2013D1BC  GetSubmenuParentChoosable+0060C
  0EEEE270    PPC  2013D844  GetSubmenuParentChoosable+00C94
  0EEEE230    PPC  2013D9DC  GetSubmenuParentChoosable+00E2C
  0EEEE1F0    PPC  20136564  CallMenuBar+000D8
  0EEEE1A0    PPC  20141A90  StandardMBDF+001CC
  0EEEE0D0    PPC  20144570  StandardMBDF+02CAC
  0EEEE080    PPC  FFD108D0  CalcMenuSize+00018
  0EEEDF63    PPC  004730AC  EmToNatEndMoveParams+00014
  0EEEDF00    PPC  1EE2AB8C  nsDynamicMDEFMain+00230
  0EEEDE10    PPC  1EE2ADE4  nsDynamicSizeTheMenu(MenuInfo**)+0000C
  0EEEDDD0    PPC  1EE2B008  nsDoMagic(MenuInfo**)+00108
  0EEEDD70    PPC  1EE2B1F0  nsBuildMenu(MenuInfo**, int)+001A0
  0EEEDBC0    PPC  1EE0574C  nsMenu::MenuSelected(const nsMenuEvent&)+0011C
  0EEEDAC0    PPC  1EE05CB0  nsMenu::MenuConstruct(const nsMenuEvent&, 
nsIWidget*, void*, void*)+00308
  0EEED610    PPC  1EE0794C  nsMenu::LoadSubMenu(nsIMenu*, nsIDOMElement*, 
nsIDOMNode*)+002AC
  0EEED230    PPC  1EE03F60  nsMenu::AddItem(nsISupports*)+000C4
  0EEED1B0    PPC  1EE04528  nsMenu::AddMenu(nsIMenu*)+000FC
  0EEED0A0    PPC  FFD109E0  InsertMenuItem+00020
  0EEED060    PPC  2013B92C  ChangeMenuItemSystemPropertyAttributes+0095C
  0EEED020    PPC  2013C4E4  InsertMenuItemText+00AB4
  0EEECE70    PPC  FFD1E30C  Munger+00030
  0EEECE30    PPC  202A936C  __Munger+00014
  0EEECDF0    PPC  202A901C  __GetString+000F4
  0EEECD90    PPC  202A8F84  __GetString+0005C
  0EEECD50    PPC  FFD0EDF8  SetHandleSize+00028
  0EEECD10    PPC  008C1A04  
  0EEECCC0    PPC  200089B0  __SetHandleSize+00014
  0EEECC80    PPC  2000AAAC  BowelsOfTheMemoryMgr+01830
 Closing log

Comment 1

[John Morrison]

Attachment: test bookmarks.html = nscp default + 500 bookmarks + ~10 subfolders

Comment 2

[Mike Pinkerton (not reading bugmail)]

mac native menu fun. looks like we're blowing out the menu manager. chris?

Comment 3

[John Morrison]

I should have mentioned that the same bookmarks.html can be viewed successfully
in the bookmark manager, or in the bookmarks sidebar panel; this is only a 
problem in the Mac native menu.

Comment 4

[saari (gone)]

This is slow on my machine, but it does work... How much memory do you have, both 
real and VM?

Comment 5

[John Morrison]

I have 256MB built-in, 257 virtual; the minimum and preferred sizes for 
the application are 16MB and 16MB. 

Comment 6

[John Morrison]

I tried this on a mac 8.5.1 with 96MB built-in/97MB virtual and it worked
with today's mac build. Don't know what to say: the os9.0 machine is fairly
vanilla installation, and certainly has lots of processor/memory power, yet
it clearly has a problem in displaying this bookmarks file in the menu.

Comment 7

[leger]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 8

[saari (gone)]

Well, my OS9 powerbook with less RAM and VM doesn't show this.

I guess I need to debug it on your machine. 

Comment 9

[John Morrison]

Woo-hoo (oh, wait. No have build on mac).

Comment 10

[John Morrison]

Okay, in recent builds (including today's) on Mac, the 500 bookmarks test file
no longer blows up the menu. However, increasing this to 1000 bookmarks will
either 
  (1) crash, in menu-related code, or 
  (2) simple bookmarks at the end of the list are displayed as if they are 
      folders.

Perhaps this bug should not be nsbeta2+ --- this is a few std. dev. above
what a normal user would have in their bookmarks.html (but still within the
supported range nonetheless).

Comment 11

[saari (gone)]

The experience for anyone with this many bookmarks will be too painful for them 

to use it anyway... no one is going to wait the 20 seconds to pop down the 

bookmarks menu.



So, if this stays beta2+, we should probably file another beta2+ bug on the 

performance.

Comment 12

[leger]

Moving from [nsbeta2+] to [nsbeta2-] per todays PDT XP Toolkit Beta2 Review mtg.

Comment 13

[saari (gone)]

Agreed, especially since I cannot reproduce it even when I double the length of 
the example to 1000 menu items

Comment 14

[saari (gone)]

I have still never seen this bug using an absurdly large bookmark list.

Comment 15

[Matthew T (active 1999-2002)]

Reproduced with build 2001120708, Mac OS 9.1.

On the first opening, the `Bookmarks' menu opens to cover the entire screen, and
the main menu items consist of gibberish characters in an outline font style.
(Submenus, curiously, work fine.)

On the second opening, or when you try to do anything useful after the first
opening (like submitting this comment, for example), Mozilla hangs or crashes.

Comment 16

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 17

[Chris Casciano]

OS X 2003042208 - Clean Profile

Dropped in this bookmark file and had no problems (other then minor delays)
viewing bookmarks via bookmarks menu, via sidebar, or personal toolbar. Of note
I don't have the "fill the screen" proplem reported in OS9

Has this bug gone the way of the dodo & OS 9/CFM builds? WFM anyone?

Comment 18

[Chris Casciano]

noone seems to have objected... -> WFM