Closed Bug 1507316 Opened 6 years ago Closed 4 years ago

DatabaseConnection::UpdateRefcountFunction::ProcessValue: crash when using google docs

Categories

(Core :: Storage: IndexedDB, defect, P3)

Product:
Core
Component:
Storage: IndexedDB
Version:
63 Branch
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox-esr60 --- affected
firefox63 --- affected
firefox64 --- affected
firefox65 --- affected

People

(Reporter: chia6000, Unassigned)

References

Details

(Keywords: crash)

Crash Data

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:63.0) Gecko/20100101 Firefox/63.0

Steps to reproduce:

Tried to go to my google drive 


Actual results:

Kept crashing 


Expected results:

I wanted to access my google drive account
Please post a crash ID from about:support: https://support.mozilla.org/en-US/kb/mozillacrashreporter
Flags: needinfo?(chia6000)
Thank you for responding! Is this what you need?
(In reply to erin from comment #3)
> Thank you for responding! Is this what you need?

Yes, thanks.
Severity: normal → critical
Crash Signature: [@ mozilla::dom::indexedDB::(anonymous namespace)::DatabaseConnection::UpdateRefcountFunction::ProcessValue(mozIStorageValueArray*, int, mozilla::dom::indexedDB::(anonymous namespace)::DatabaseConnection::UpdateRefcountFunction::UpdateType) ]
Component: Untriaged → DOM: IndexedDB
Keywords: crash
Product: Firefox → Core
This crash signature seems quite rare. Maybe it's some weird migration issue?
Priority: -- → P3
Yes, I think you're right.

So, it looks like FileManager::GetFileInfo()[1] is returning null and the caller[2] has an assert that it doesn't return null, but no actual error-handling.  There is a special-case if IndexedDatabaseManager is destroyed already, but since that uses ClearOnShutdown's default phase of ShutdownPhase::ShutdownFinal and the main-thread stacks aren't consistent with that scenario, apparent database corruption does sound most likely.

I say apparent because we're deleting a btree which suggests we're in a "DROP TABLE" situation which means we're probably in an upgrade.  However, there also appear to be a number of add/put and delete cases that run into the same problem, as per the following search, so it's not clear that attempting to specialize for a schema upgrade is the right thing to do here...
https://crash-stats.mozilla.com/search/?signature=~UpdateRefcountFunction%3A%3AProcessValue&date=%3E%3D2018-11-05T16%3A10%3A34.000Z&date=%3C2018-11-19T16%3A10%3A34.000Z&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Probably the right thing to do is to ensure that when we run into this scenario that we ensure we throw errors that propagate all the way back up to the top of the database operation, aborting/popping everything off the stack, and have us mark the database as corrupt.  And then nuke the origin as a result.

1: https://searchfox.org/mozilla-central/rev/b03a62c3c82316e733a3b09622c1cb7e59f64cc3/dom/indexedDB/ActorsParent.cpp#16970
2: https://searchfox.org/mozilla-central/rev/b03a62c3c82316e733a3b09622c1cb7e59f64cc3/dom/indexedDB/ActorsParent.cpp#9704
Status: UNCONFIRMED → NEW
status-firefox63: --- → affected
status-firefox65: --- → affected
status-firefox-esr60: --- → affected
Ever confirmed: true
status-firefox64: --- → affected
Summary: I keep trying to use google drive and firefox keeps crashing over and over → DatabaseConnection::UpdateRefcountFunction::ProcessValue: crash when using google docs

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.