256622 - FF10PR1 crash when adding/refreshing live bookmark [@ nsBookmarksService::OnAssert] [@ nsBookmarksService::OnUnassert]

Status: VERIFIED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[sairuh (rarely reading bugmail)]

found using 2004082308-0.9+ on linux fedora core 2.

this is currently difficult to reproduce: I've only seen it once, but Marcia has
seen it.

1. go to http://del.icio.us and add the RSS feed as a livemark in your personal
(bookmarks) toolbar.

2. in the PT bring up the context menu and select "Refresh Live Bookmark"

results: crash.

if I get a more reliable test case, will add steps here. in the meantime, here's
the stack info:

http://talkback-reports.mozilla.org/talkback/quicksearch.jsp?search=2&type=iid&id=633318

Stack Signature: nsBookmarksService::OnAssert() 81ce7a5e
	/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp,
line 162
Stack Trace 	
nsBookmarksService::OnAssert() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp,
line 162]
InMemoryDataSource::Assert() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/rdf/base/src/nsInMemoryDataSource.cpp,
line 1408]
nsBookmarksService::CreateBookmark() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp,
line 2711]
nsFeedLoadListener::HandleRDFItem() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp,
line 479]
nsFeedLoadListener::TryParseAsRDF() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp,
line 112]
nsFeedLoadListener::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp,
line 248]
nsHTTPCompressConv::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/streamconv/converters/nsHTTPCompressConv.cpp,
line 125]
nsStreamListenerTee::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsStreamListenerTee.cpp,
line 66]
nsHttpChannel::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 606]
nsInputStreamPump::OnStateStop() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 606]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 339]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 395]
event_processor_callback() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x4921f (0x0021b21f)
libglib-2.0.so.0 + 0x23e4a (0x001f5e4a)
libglib-2.0.so.0 + 0x24f28 (0x001f6f28)
libglib-2.0.so.0 + 0x25260 (0x001f7260)
libglib-2.0.so.0 + 0x258a3 (0x001f78a3)
libgtk-x11-2.0.so.0 + 0x10c403 (0x0051c403)
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 144]
nsAppShellService::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
xre_main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 692]
main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 59]
libc.so.6 + 0x14ad4 (0x00c04ad4)

Comment 1

[sairuh (rarely reading bugmail)]

notes:

* unable to repro using Mac ffox 2004082308-0.9+
* del.icio.us is currently not refreshing (not our fault), but that happened to
be the feed I was testing when I encountered this.

Comment 2

[Asa Dotzler [:asa]]

Marcia was also able to reproduce this, probably on the live bookmarks first
(automatic) refresh right after it was added -- same stack trace. That was also
on Linux. I haven't reproduced on Windows yet.

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

(In reply to comment #0)
> found using 2004082308-0.9+ on linux fedora core 2.
> 
> this is currently difficult to reproduce: I've only seen it once, but Marcia has
> seen it.

Still trying to reproduce it with both that nightly build and my local debug
build; no luck.  Unfortunately the talkback trace is nonsensical -- the top
frame doesn't refer to a valid line of code.  I'll keep an eye on this.

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Not critical, at least until we can reliably reproduce it and/or it starts
happening to more folks.

Comment 5

[sairuh (rarely reading bugmail)]

I got this to crash as soon as tried adding a livemark in a relatively new
profile (hadn't done any RSS tasks yet with the profile):

1. go to http://del.icio.us
2. click the RSS status bar icon and selected RSS from the dropmenu

results: crash, similar trace.

http://talkback-reports.mozilla.org/talkback/quicksearch.jsp?search=2&type=iid&id=670915

Comment 6

[Asa Dotzler [:asa]]

OK, Tracy and I can get this on linux with some regularity. I suspect that this
will become a topcrasher if it's more than just the del.icio.us feed. We
certainly need to get it figured out for 1.0. 

Comment 7

[Asa Dotzler [:asa]]

This is Linux and Mac.  We've got nearly 40 talkback incidents on this and it
looks like it's more widespread than the del.icio.us feed. 

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=begins&searchfor=nsBookmarksService%3A%3AOnAssert%28%29&vendor=All&product=All&platform=All

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: bm-observable-copy-observers.patch

Something somewhere is removing itself from the bookmarks observer list while
in the observer callback.  This is a no-no, but is done /everywhere/.  So, we
have to protect it. sigh.

Comment 9

[Asa Dotzler [:asa]]

Comment on attachment 158826 [details] [diff] [review]
bm-observable-copy-observers.patch

removing approval flag until this has review.

Comment 10

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 158826 [details] [diff] [review]
bm-observable-copy-observers.patch

don't call non-member variables names starting with 'm' and r=[e-mail]

Comment 11

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: bm-observable-copy-observers-2.patch

patch as checked in

Comment 12

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

fixed on aviary.

Comment 13

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: bm-observable-copy-observers-2.patch

-this- is the real one real one that was checked in

Comment 14

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: bm-observable-copy-observers-3.patch

(pay no attention to the fact that I neglected to attach the patch that
actually compiled, which was sitting on another computer)

Comment 15

[Mike Shaver (:shaver emeritus)]

Comment on attachment 159556 [details] [diff] [review]
bm-observable-copy-observers-3.patch

r=shaver.  It'll sure be better than the last one!

Comment 16

[Axel Hecht]

Attachment: fix windows bustage

the old don't declare ints in the loop twice foo.

Comment 17

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

(In reply to comment #16)
> Created an attachment (id=159577)
> fix windows bustage
> 
> the old don't declare ints in the loop twice foo.

Hey, it works fine in VC7.1! :)  Blah.  I checked in a fix. =/

Comment 18

[Jay Patel [:jay]]

This crash was actually across all platforms and is currently being reported as
a topcrasher for Firefox 1.0 PR1.  Adding topcrash related info for tracking and
some Talkback data for future reference:

Rank    StackSignature    Count  

16   nsBookmarksService::OnAssert   115 

 
 	Source File :
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp
line : 5463
 
====================================================================================================
     Count   Offset    Real Signature
[ 28   nsBookmarksService::OnAssert 839b9e31 - nsBookmarksService::OnAssert ]
 
     Crash date range: 14-SEP-04 to 16-SEP-04
     Min/Max Seconds since last crash: 10 - 84871
     Min/Max Runtime: 43 - 84871
 
     Count   Platform List 
     18   Windows XP [Windows NT 5.1 build 2600] 
     7   Windows 2K [Windows NT 5.0 build 2195] 
     1   Windows XP [Windows NT 5.2 build 3790] 
     1   Windows ME [Windows 98 4.90 build 73010104] 
     1   Windows 98 [Windows 98 4.10 build 67766446] 
 
     Count   Build Id List 
     28   2004091322
 
     No of Unique Users        27
 
 Stack trace(Frame) 

	 nsBookmarksService::OnAssert
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp
 line 5463] 
	 InMemoryDataSource::Assert
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/rdf/base/src/nsInMemoryDataSource.cpp
 line 1416] 
	 nsBookmarksService::CreateBookmark
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp
 line 2700] 
	 nsFeedLoadListener::TryParseAsSimpleRSS
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp
 line 652] 
	 nsFeedLoadListener::OnStopRequest
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp
 line 253] 
	 nsStreamListenerTee::OnStopRequest
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsStreamListenerTee.cpp
 line 65] 
	 nsInputStreamPump::OnStateStop
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp
 line 499]  
 
     (840616)	URL: neowin.net
     (840616)	Comments: adding a rss feed bookmark for neowin.net
     (835453)	URL: www.tscweb.co.uk/test.php
     (835453)	Comments: Testing Atom RSS feed installation
     (826367)	URL: http://lamba-the-ultimate.org/
     (826367)	Comments: Adding a live bookmark into a nested folder.
     (825009)	URL: www.nvnews.com
     (825009)	Comments: just YES to add RSS 
     (821937)	URL: http://www.irdial.com/blogger.html
     (821617)	URL: http://theregister.co.uk
     (821617)	Comments: I was trying to add the RSS feed for theregister.co.uk
to my bookmarks.
     (820730)	URL: news.bbc.co.uk
     (820730)	Comments: adding rss-feed as live link
     (820483)	URL: http://www.cro.ie
     (815084)	Comments: subscribing to rss feed
     (814726)	URL: grouphug.us
     (814712)	URL: grouphug.us
     (814712)	Comments: Adding RSS to bookmarks
     (812879)	Comments: i have a laptop target AMD 64 3000+.  I opend it and
receive this message
     (807650)	URL: http://news.bbc.co.uk
     (807650)	Comments: Clicked "RSS" icon in bottom-right of browser  set the
title for the live bookmark  clicked OK and Firefox 0.10PR crashed
     (807522)	URL: http://news.bbc.co.uk/2/hi/technology/default.stm
     (807522)	Comments: I had just added a "...Live bookmark for this page's feed".
     (807423)	URL: www.golem.de
     (807423)	Comments: 1. Added first RSS Feed as Live Bookmark via RSS icon in
Bookmark Toolbar folder  2. Added second RSS Feed as Live Bookmark via RSS icon
in Bookmarks folder (not Toolbar  using the same Name as before)
 
====================================================================================================
     Count   Offset    Real Signature
[ 15   nsBookmarksService::OnAssert 7be66153 - nsBookmarksService::OnAssert ]
 
     Crash date range: 14-SEP-04 to 16-SEP-04
     Min/Max Seconds since last crash: 20 - 85191
     Min/Max Runtime: 598 - 108294
 
     Count   Platform List 
     7   Windows XP [Windows NT 5.1 build 2600] 
     6   Windows 2K [Windows NT 5.0 build 2195] 
     2   Windows 98 [Windows 98 4.10 build 67766446] 
 
     Count   Build Id List 
     15   2004091322
 
     No of Unique Users        14
 
 Stack trace(Frame) 

	 nsBookmarksService::OnAssert
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp
 line 5463] 
	 InMemoryDataSource::Assert
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/rdf/base/src/nsInMemoryDataSource.cpp
 line 1416] 
	 nsBookmarksService::CreateBookmark
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksService.cpp
 line 2710] 
	 nsFeedLoadListener::HandleRDFItem
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp
 line 479] 
	 nsFeedLoadListener::TryParseAsRDF
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp
 line 403] 
	 nsFeedLoadListener::OnStopRequest
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp
 line 248] 
	 nsStreamListenerTee::OnStopRequest
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsStreamListenerTee.cpp
 line 65] 
	 nsInputStreamPump::OnStateStop
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp
 line 499]  
 
     (841663)	URL: instapundit.com
     (841646)	URL: instapundit.com
     (841646)	Comments: adding live bookmark
     (835264)	Comments: I was trying to run rss feed from the promote firefox site
     (822556)	URL: www.mozzila.com
     (822556)	Comments: Subscribing to the Mozilla RSS feed thing.
     (822166)	URL: http://www.del.icio.us
     (822166)	Comments: Tried to subscribe to RSS Feed on del.icio.us home page
     (821968)	Comments: Pushed RSS button.
     (817413)	URL: http://www.pandagon.net/
     (817413)	Comments: Adding Live Bookmark
     (811844)	URL: http://www.jacobsen.no/anders/blog/
     (811844)	Comments: Adding "Live bookmark" for RDF feed on this site.
     (808896)	Comments: Trying to use the RSS bookmark feature for the first time


If anyone that was able to reproduce this before could verify the fix using the
latest Aviary branch builds, that would be great!

Comment 19

[Adam]

With live bookmarks, I still get about a 50/50 chance of the browser crashing on
start.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040922 Firefox/0.10
(TierMann)

Without any live bookmarks, the browser starts 100% of the time.

Comment 20

[Asa Dotzler [:asa]]

Adam, do you have talkback report IDs for those crashes? 

Comment 21

[Jay Patel [:jay]]

*** Bug 264107 has been marked as a duplicate of this bug. ***

Comment 22

[Jay Patel [:jay]]

Looks like this got checked in shortly after Firefox 1.0 PR1 went out, so we
continue to see crashes in both 0.10.0 and 0.10.1 PR1 releases, but it seems to
be fixed on the aviary branch.  Talkback data doesn't show any crashes in builds
after 20041001xx...so marking verified.

Comment 23

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs, filter on "beltznerLovesGoats" to get rid of this mass change