380317 - crash on shutdown in nsPlacesImportExportService::WriteContainerContents(), mLivemarkService is null

Status: VERIFIED FIXED

(Firefox :: Bookmarks & History, defect, P1)

Description

[(not reading, please use [e-mail] instead)]

crash on shutdown in nsPlacesImportExportService::WriteContainerContents(), mLivemarkService is null

from the console:

************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILAB
LE) [nsIAnnotationService.getItemAnnotationString]"  nsresult: "0x80040111 (NS_E
RROR_NOT_AVAILABLE)"  location: "JS frame :: file:///c:/builds/trunk-no-places/m
ozilla/ff-debug/dist/bin/components/nsLivemarkService.js :: LivemarkService :: l
ine 798"  data: no]
************************************************************
WARNING: could not get livemark service: 'NS_SUCCEEDED(rv)', file c:/builds/trun
k-no-places/mozilla/browser/components/places/src/nsPlacesImportExportService.cp
p, line 294
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRa
wPtr != 0', file c:\builds\trunk-no-places\mozilla\ff-debug\dist\include\xpcom\n
sCOMPtr.h, line 847

my stack:

>	brwsrcmp.dll!nsPlacesImportExportService::WriteContainerContents(__int64 aFolder=2, const nsACString & aIndent={...}, nsIOutputStream * aOutput=0x054b8f3c)  Line 1780 + 0x2d bytes	C++
 	brwsrcmp.dll!nsPlacesImportExportService::ExportHTMLToFile(nsILocalFile * aBookmarksFile=0x099503a8)  Line 1963 + 0x28 bytes	C++
 	brwsrcmp.dll!nsPlacesImportExportService::BackupBookmarksFile()  Line 1996 + 0x17 bytes	C++
 	xpcom_core.dll!NS_InvokeByIndex_P(nsISupports * that=0x00000006, unsigned int methodIndex=0, unsigned int paramCount=1240396, nsXPTCVariant * params=0x00d202f0)  Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=6)  Line 2245 + 0x1e bytes	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2245 + 0x1e bytes	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x03d94d30, JSObject * obj=0x05e694e0, unsigned int argc=0, long * argv=0x09338a7c, long * vp=0x0012eff4)  Line 1467 + 0xe bytes	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x03d94d30, unsigned int argc=0, unsigned int flags=0)  Line 1332 + 0x20 bytes	C
 	js3250.dll!js_Interpret(JSContext * cx=0x03d94d30, unsigned char * pc=0x03c51392, long * result=0x0012f6ac)  Line 4025 + 0xf bytes	C
 	js3250.dll!js_Invoke(JSContext * cx=0x03d94d30, unsigned int argc=3, unsigned int flags=2)  Line 1351 + 0x13 bytes	C
 	xpc3250.dll!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS * wrapper=0x03d1f130, unsigned short methodIndex=3, const XPTMethodDescriptor * info=0x00cbffa8, nsXPTCMiniVariant * nativeParams=0x0012fa14)  Line 1419 + 0x14 bytes	C++
 	xpc3250.dll!nsXPCWrappedJS::CallMethod(unsigned short methodIndex=3, const XPTMethodDescriptor * info=0x00cbffa8, nsXPTCMiniVariant * params=0x0012fa14)  Line 566	C++
 	xpcom_core.dll!PrepareAndDispatch(nsXPTCStubBase * self=0x03d1f190, unsigned int methodIndex=3, unsigned int * args=0x0012fad4, unsigned int * stackBytesToPop=0x0012fac4)  Line 114 + 0x21 bytes	C++
 	xpcom_core.dll!SharedStub()  Line 142	C++
 	xpcom_core.dll!nsObserverList::NotifyObservers(nsISupports * aSubject=0x03d1f190, const char * aTopic=0x04afc3f8, const unsigned short * someData=0x100357b0)  Line 129	C++
 	xpcom_core.dll!nsObserverList::NotifyObservers(nsISupports * aSubject=0x04afc3f8, const char * aTopic=0x100357b0, const unsigned short * someData=0x10035f20)  Line 129	C++
 	xpcom_core.dll!nsObserverService::NotifyObservers(nsISupports * aSubject=0x04afc3f8, const char * aTopic=0x100357b0, const unsigned short * someData=0x10035f20)  Line 184	C++
 	xul.dll!nsXREDirProvider::DoShutdown()  Line 755	C++
 	xul.dll!ScopedXPCOMStartup::~ScopedXPCOMStartup()  Line 793	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x00b997f8, const nsXREAppData * aAppData=0x004036b4)  Line 2853	C++
 	firefox.exe!main(int argc=1, char * * argv=0x00b997f8)  Line 61 + 0x13 bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes	C
 	firefox.exe!mainCRTStartup()  Line 403	C
 	kernel32.dll!7c816fd7() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]

Comment 1

[(not reading, please use [e-mail] instead)]

taking, as I can reproduce this.

Comment 2

[Asaf Romano (gone)]

hrm, could you check if changing the query in http://lxr.mozilla.org/seamonkey/source/toolkit/components/places/src/nsAnnotationService.cpp#1045 to INNER JOIN helps?

Comment 3

[(not reading, please use [e-mail] instead)]

for the crash, I think I know the trick to reproducing it.  try a profile without any live bookmarks.

but I still think we may want to move the work in nsBrowserGlue.js (to shutdown places) from the "profile-change-teardown" event to the "profile-before-change" event, following the descriptions in http://lxr.mozilla.org/seamonkey/source/profile/public/nsIProfileChangeStatus.idl#71

Comment 4

[Asaf Romano (gone)]

So, the nsBrowserGlue change sounds good to me, please file a separate bug.

Here's what happens here:
 1. Default profile is created with a livemark, creating the initial feedURI annotation in the moz_anno_attributes table
 2. after the livemark is removed, the moz_anno_attributes item is left (we don't yet have mechanism for expiring items in that table).
 3. Since we use LEFT JOIN in GetItemsWithAnnotation, a bogus item is returned with an invalid id which represents the moz_anno_attributes entry.

The fix is to use INNER JOIN rather than LEFT JOIN. 

Comment 5

[Asaf Romano (gone)]

Attachment: patch

Comment 6

[(not reading, please use [e-mail] instead)]

Comment on attachment 264412 [details] [diff] [review]
patch

r=sspitzer

Comment 7

[(not reading, please use [e-mail] instead)]

> So, the nsBrowserGlue change sounds good to me, please file a separate bug.

see bug #380340

Comment 8

[Asaf Romano (gone)]

mozilla/browser/components/places/src/nsPlacesImportExportService.cpp 1.4
mozilla/browser/components/places/src/nsPlacesImportExportService.h 1.2
mozilla/toolkit/components/places/src/nsAnnotationService.cpp 1.22
mozilla/toolkit/components/places/tests/unit/test_annotations.js 1.4

Comment 9

[Tracy Walker [:tracy]]

verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b2pre) Gecko/2007112604 Minefield/3.0b2pre

Comment 10

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv