Closed Bug 258767 Opened 17 years ago Closed 17 years ago

Shift-Delete crashes when removing URL from Location Bar history - FFBranch [@ morkRowMap::Hash ]

Categories

(Firefox :: Address Bar, defect)

x86
All
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: wolruf, Assigned: bugs)

References

()

Details

(4 keywords, Whiteboard: TB1014753W)

Crash Data

Attachments

(1 file)

build ID: 20040907 on Linux & Win2k, found 3 others Talkback ID with such crash
and comments which indicate it could be a regression (since 09/05 ?):
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=morkRowMap%3A%3AHash&vendor=All&product=FirefoxTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime=

Steps to reproduce:
1. Focus on Location bar,
2. When drop down menu appears with the URLs history, try to remove one of them
by focusing on it and hitting Shift-Delete,
3. FF crashes.

morkRowMap::Hash 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkRowMap.cpp,
line 133]
morkAtomBodyMap::GetAtom 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkAtomMap.cpp,
line 247]
morkTable::CutRow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp,
line 1455]
morkTable::CutRow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp,
line 699]
nsFormFillController::KeyPress 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp,
line 584]
DispatchToInterface 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 128]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1597]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 1985]
nsHTMLInputElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 1347]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5949]
PresShell::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5801]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2252]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2026]
HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 127]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1093]
nsWindow::DispatchKeyEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3031]
nsWindow::OnKeyDown 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3157]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3995]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1374]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x24407 (0xbff94407)
0x00cd8772
I would try a newer build.  I saw this when I was running the 0907 build, but I
updated to 0908 and it stopped.
20040910 build crash on Win2k.
Summary: Shift-Delete crashes when removing URL from Location Bar history → Shift-Delete crashes when removing URL from Location Bar history [@ morkRowMap::Hash ]
Reproduced with Firefox 20040913/Linux-gtk2.

Talkback ID: TB802194G
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040916 Firefox/0.10

happened here when i tried to remove historyitems from the google-searchbox.

Below are some talkbackid's, but it seems they are not in the database?

TB855833E - 09/17/04 06:54 PM
TB855771H - 09/17/04 06:50 PM
TB855758Z - 09/17/04 06:49 PM

Related to history delete bug #259685?  I don't know if the underlying mechanism
is the same, but I remember being pleasantly surprised when I could shift-del in
the location bar history just like I could in form control history, so these two
bugs caught my eye.
*** Bug 259685 has been marked as a duplicate of this bug. ***
Blocking flag from Asa in bug 259685.
Flags: blocking-aviary1.0+
reproduced with:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040923
Firefox/0.10
Assignee: bugs → vladimir
Sorry ben, no can do on this =/
Assignee: vladimir → bugs
WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040928
Firefox/0.10
Crash.  Talkback submitted.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040928
Firefox/0.10
Whiteboard: TB1014753W
The summary say that the crash happens in the location bar but according to bug
259685 which was duped to this one, the shift+delete crash happens in all text
boxes. I also see this in the search bar and about every textbox.
So I think the summary of this bug should be changed.
Instead of "location bar", it should say textbox.
FWIW This bug does not manifest itself for me, location bar or forms on web pages.

Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20040913 Firefox/0.10

Looking at the comments it appears to be affecting post PR1 builds. This bug
caught my eye since I had just hunted down how to delete form auto completes two
days ago.
(In reply to comment #13)
> FWIW This bug does not manifest itself for me, location bar or forms on web pages.

AFAIK it appeared on the 15th after PR1 ( it works in PR1 ), and it happens in
the firefox built-in google searchbar in in web forms.
Also, Shift-delete does not delete formhistory anymore ( see comments in Bug
259685 )
Shift+delete in formhistory crashes for me (and has been doing so for the past
several builds...pretty much since after PR1).  Mozilla/5.0 (Windows; U; Windows
NT 5.1; en-US; rv:1.7.3) Gecko/20040927 Firefox/0.10

I don't think there's any debate as to whether or not this is actually a bug, it
is crashing the browser on any type of formhistory.
*** Bug 262115 has been marked as a duplicate of this bug. ***
This is a topcrasher on the Firefox Aviary branch:

Rank    StackSignature    Count  

1   morkRowMap::Hash   33 

 
 	Source File :
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp
line : 134
 
====================================================================================================
     Count   Offset    Real Signature
[ 17   morkRowMap::Hash 07009552 - morkRowMap::Hash ]
[ 2   morkRowMap::Hash cdee7f0c - morkRowMap::Hash ]
 
     Crash date range: 19-SEP-04 to 23-SEP-04
     Min/Max Seconds since last crash: 5 - 68625
     Min/Max Runtime: 18 - 82884
 
     Count   Platform List 
     10   Windows XP [Windows NT 5.1 build 2600] 
     7   Windows 2K [Windows NT 5.0 build 2195] 
     2   Windows 98 [Windows 98 4.10 build 67766446] 
 
     Count   Build Id List 
     8   2004091907
     7   2004092207
     2   2004092111
     1   2004092007
     1   2004091808
 
     No of Unique Users        13
 
 Stack trace(Frame) 

	 morkRowMap::Hash
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp
 line 134] 
	 morkRowMap::GetRow
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp
 line 189] 
	 morkTable::CutRow
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp
 line 1456] 
	 morkTable::CutRow
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp
 line 700] 
	 XPTC_InvokeByIndex
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
 line 102] 
	 XPCWrappedNative::CallMethod
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp
 line 2028] 
	 XPC_WN_CallMethod
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp
 line 1287] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c 
line 941] 
	 js_Interpret
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c 
line 2973] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c 
line 958] 
	 js_InternalInvoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c 
line 1035] 
	 JS_CallFunctionValue
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c  line
3698] 
	 nsJSContext::CallEventHandler
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp
 line 1297] 
	 nsJSEventListener::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp
 line 184] 
	 nsXBLPrototypeHandler::ExecuteHandler
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp
 line 463] 
	 nsXBLKeyEventHandler::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp
 line 146] 
	 nsEventListenerManager::HandleEventSubType
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp
 line 1436] 
	 nsEventListenerManager::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp
 line 1516] 
	 nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp
 line 2841] 
	 nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp
 line 2821] 
	 nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp
 line 2821] 
	 nsGenericElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp
 line 1912] 
	 nsHTMLInputElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp
 line 1399] 
	 PresShell::HandleEventInternal
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp
 line 6051] 
	 PresShell::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp
 line 5913] 
	 nsViewManager::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp
 line 2244] 
	 nsViewManager::DispatchEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp
 line 2030] 
	 HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp 
line 79] 
	 nsWindow::DispatchEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp
 line 1067] 
	 nsWindow::DispatchKeyEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp
 line 2978] 
	 nsWindow::OnKeyDown
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp
 line 3068]  
 
     (956900)	Comments: Attempted to remove entry from search bar autocomplete
using Shift+Delete.
     (951256)	Comments: I was trying to remove a bad address from the auto-fill
list with SHIFT-DEL and the browser crashed. I'm using the nightly build from
9/22/04  and I think this is already a reported bug.
     (943098)	Comments: Trying to delete URL search entries using Shift-Del & it
crashed!
     (935813)	Comments: I used shift-Delete to remove an entry from the URL bar
history.
     (917410)	Comments: used shift-delete to delete a URL from the drop-down
history.
     (899863)	Comments: deleting an item from the search list with shift+del
     (891018)	URL: http://www.wikipedia.org
     (890440)	URL: http://www.wikipedia.org
     (886562)	Comments: deleting autocomplete from search widget
 
====================================================================================================
     Count   Offset    Real Signature
[ 14   morkRowMap::Hash 62a03f05 - morkRowMap::Hash ]
 
     Crash date range: 20-SEP-04 to 24-SEP-04
     Min/Max Seconds since last crash: 19 - 155645
     Min/Max Runtime: 153 - 155689
 
     Count   Platform List 
     9   Windows XP [Windows NT 5.1 build 2600] 
     5   Windows 2K [Windows NT 5.0 build 2195] 
 
     Count   Build Id List 
     8   2004091907
     3   2004092207
     1   2004092308
     1   2004092111
     1   2004092007
 
     No of Unique Users        11
 
 Stack trace(Frame) 

	 morkRowMap::Hash
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp
 line 134] 
	 morkRowMap::GetRow
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp
 line 189] 
	 morkTable::CutRow
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp
 line 1456] 
	 morkTable::CutRow
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp
 line 700] 
	 nsFormFillController::KeyPress
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp
 line 584] 
	 DispatchToInterface
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp
 line 127] 
	 nsEventListenerManager::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp
 line 1524] 
	 nsGenericElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp
 line 1960] 
	 nsHTMLInputElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp
 line 1399] 
	 PresShell::HandleEventInternal
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp
 line 6051] 
	 PresShell::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp
 line 5913] 
	 nsViewManager::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp
 line 2244] 
	 nsViewManager::DispatchEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp
 line 2030] 
	 HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp 
line 79] 
	 nsWindow::DispatchEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp
 line 1067] 
	 nsWindow::DispatchKeyEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp
 line 2978] 
	 nsWindow::OnKeyDown
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp
 line 3068]  
 
     (966427)	Comments: attempting to delete an item from a form autocomplete
     (966406)	Comments: attempting to delete from form autocomplete popup
     (960150)	Comments: Shift+Delete-ing a saved form entry; this is reproducable
     (939370)	Comments: I tried to delete an autocomplete entry
Keywords: topcrash
Summary: Shift-Delete crashes when removing URL from Location Bar history [@ morkRowMap::Hash ] → Shift-Delete crashes when removing URL from Location Bar history - FFBranch [@ morkRowMap::Hash ]
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041001
Firefox/0.10:
Not crashing when deleting from the "Location Bar", but steel crashing when
trying to delete textbox autocomplite entrie...
(In reply to comment #18)
> Not crashing when deleting from the "Location Bar", but steel crashing when
> trying to delete textbox autocomplite entrie...

that's true. I did mention this in Comment #14 ( requesting summary change )

Traced the source code and found a bug in
nsAutoCompleteMdbResult::RemoveValueAt(). The row pointer is being used after
it has been removed from the collection. This patch reorders the calls so that
the pointer is deleted later. 

I've tested the patch on my pc and no longer get these crashes.
Attachment #160838 - Flags: review?
Comment on attachment 160838 [details] [diff] [review]
row being removed too early - should be after CutRow() call

Forwarding review? to someone who's reviewed changes here before (and has made
patches here, too)...

If you just set the review flag to review? without setting a requestee, your
patch will wait and wait and wait and wait and rot for all eternity.  You'll
want to set a requestee in the future.	;-)
Attachment #160838 - Flags: review? → review?(bryner)
Comment on attachment 160838 [details] [diff] [review]
row being removed too early - should be after CutRow() call

good catch.
Attachment #160838 - Flags: review?(bryner) → review+
Attachment #160838 - Flags: approval-aviary?
checked in on trunk (waiting on branch approval)
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Comment on attachment 160838 [details] [diff] [review]
row being removed too early - should be after CutRow() call

a=asa for aviary checkin.
Attachment #160838 - Flags: approval-aviary? → approval-aviary+
Woohoo!  Verified using a 20041004 branch build.
Status: RESOLVED → VERIFIED
Crash Signature: [@ morkRowMap::Hash ]
You need to log in before you can comment on or make changes to this bug.