Closed
Bug 258767
Opened 20 years ago
Closed 20 years ago
Shift-Delete crashes when removing URL from Location Bar history - FFBranch [@ morkRowMap::Hash ]
Categories
(Firefox :: Address Bar, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: wolruf, Assigned: bugs)
References
()
Details
(4 keywords, Whiteboard: TB1014753W)
Crash Data
Attachments
(1 file)
918 bytes,
patch
|
bryner
:
review+
asa
:
approval-aviary+
|
Details | Diff | Splinter Review |
build ID: 20040907 on Linux & Win2k, found 3 others Talkback ID with such crash and comments which indicate it could be a regression (since 09/05 ?): http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=morkRowMap%3A%3AHash&vendor=All&product=FirefoxTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime= Steps to reproduce: 1. Focus on Location bar, 2. When drop down menu appears with the URLs history, try to remove one of them by focusing on it and hitting Shift-Delete, 3. FF crashes. morkRowMap::Hash [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkRowMap.cpp, line 133] morkAtomBodyMap::GetAtom [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkAtomMap.cpp, line 247] morkTable::CutRow [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp, line 1455] morkTable::CutRow [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp, line 699] nsFormFillController::KeyPress [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp, line 584] DispatchToInterface [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 128] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1597] nsGenericElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 1985] nsHTMLInputElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 1347] PresShell::HandleEventInternal [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 5949] PresShell::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 5801] nsViewManager::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 2252] nsViewManager::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 2026] HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 127] nsWindow::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1093] nsWindow::DispatchKeyEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3031] nsWindow::OnKeyDown [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3157] nsWindow::ProcessMessage [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3995] nsWindow::WindowProc [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1374] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x24407 (0xbff94407) 0x00cd8772
Comment 1•20 years ago
|
||
I would try a newer build. I saw this when I was running the 0907 build, but I updated to 0908 and it stopped.
Reporter | ||
Comment 2•20 years ago
|
||
20040910 build crash on Win2k.
Reporter | ||
Updated•20 years ago
|
Summary: Shift-Delete crashes when removing URL from Location Bar history → Shift-Delete crashes when removing URL from Location Bar history [@ morkRowMap::Hash ]
Comment 3•20 years ago
|
||
Reproduced with Firefox 20040913/Linux-gtk2. Talkback ID: TB802194G
Comment 4•20 years ago
|
||
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040916 Firefox/0.10 happened here when i tried to remove historyitems from the google-searchbox. Below are some talkbackid's, but it seems they are not in the database? TB855833E - 09/17/04 06:54 PM TB855771H - 09/17/04 06:50 PM TB855758Z - 09/17/04 06:49 PM
Related to history delete bug #259685? I don't know if the underlying mechanism is the same, but I remember being pleasantly surprised when I could shift-del in the location bar history just like I could in form control history, so these two bugs caught my eye.
Comment 6•20 years ago
|
||
*** Bug 259685 has been marked as a duplicate of this bug. ***
reproduced with: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040923 Firefox/0.10
Assignee | ||
Updated•20 years ago
|
Assignee: bugs → vladimir
Sorry ben, no can do on this =/
Assignee: vladimir → bugs
WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040928 Firefox/0.10
Comment 11•20 years ago
|
||
Crash. Talkback submitted. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040928 Firefox/0.10
Whiteboard: TB1014753W
Comment 12•20 years ago
|
||
The summary say that the crash happens in the location bar but according to bug 259685 which was duped to this one, the shift+delete crash happens in all text boxes. I also see this in the search bar and about every textbox. So I think the summary of this bug should be changed. Instead of "location bar", it should say textbox.
Comment 13•20 years ago
|
||
FWIW This bug does not manifest itself for me, location bar or forms on web pages. Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20040913 Firefox/0.10 Looking at the comments it appears to be affecting post PR1 builds. This bug caught my eye since I had just hunted down how to delete form auto completes two days ago.
Comment 14•20 years ago
|
||
(In reply to comment #13) > FWIW This bug does not manifest itself for me, location bar or forms on web pages. AFAIK it appeared on the 15th after PR1 ( it works in PR1 ), and it happens in the firefox built-in google searchbar in in web forms. Also, Shift-delete does not delete formhistory anymore ( see comments in Bug 259685 )
Comment 15•20 years ago
|
||
Shift+delete in formhistory crashes for me (and has been doing so for the past several builds...pretty much since after PR1). Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040927 Firefox/0.10 I don't think there's any debate as to whether or not this is actually a bug, it is crashing the browser on any type of formhistory.
Comment 16•20 years ago
|
||
*** Bug 262115 has been marked as a duplicate of this bug. ***
Comment 17•20 years ago
|
||
This is a topcrasher on the Firefox Aviary branch: Rank StackSignature Count 1 morkRowMap::Hash 33 Source File : d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line : 134 ==================================================================================================== Count Offset Real Signature [ 17 morkRowMap::Hash 07009552 - morkRowMap::Hash ] [ 2 morkRowMap::Hash cdee7f0c - morkRowMap::Hash ] Crash date range: 19-SEP-04 to 23-SEP-04 Min/Max Seconds since last crash: 5 - 68625 Min/Max Runtime: 18 - 82884 Count Platform List 10 Windows XP [Windows NT 5.1 build 2600] 7 Windows 2K [Windows NT 5.0 build 2195] 2 Windows 98 [Windows 98 4.10 build 67766446] Count Build Id List 8 2004091907 7 2004092207 2 2004092111 1 2004092007 1 2004091808 No of Unique Users 13 Stack trace(Frame) morkRowMap::Hash [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 134] morkRowMap::GetRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 189] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 1456] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 700] XPTC_InvokeByIndex [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp line 102] XPCWrappedNative::CallMethod [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp line 2028] XPC_WN_CallMethod [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp line 1287] js_Invoke [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 941] js_Interpret [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 2973] js_Invoke [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 958] js_InternalInvoke [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 1035] JS_CallFunctionValue [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c line 3698] nsJSContext::CallEventHandler [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp line 1297] nsJSEventListener::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp line 184] nsXBLPrototypeHandler::ExecuteHandler [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp line 463] nsXBLKeyEventHandler::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp line 146] nsEventListenerManager::HandleEventSubType [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 1436] nsEventListenerManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 1516] nsXULElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp line 2841] nsXULElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp line 2821] nsXULElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp line 2821] nsGenericElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp line 1912] nsHTMLInputElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp line 1399] PresShell::HandleEventInternal [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 6051] PresShell::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 5913] nsViewManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2244] nsViewManager::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2030] HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp line 79] nsWindow::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 1067] nsWindow::DispatchKeyEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 2978] nsWindow::OnKeyDown [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 3068] (956900) Comments: Attempted to remove entry from search bar autocomplete using Shift+Delete. (951256) Comments: I was trying to remove a bad address from the auto-fill list with SHIFT-DEL and the browser crashed. I'm using the nightly build from 9/22/04 and I think this is already a reported bug. (943098) Comments: Trying to delete URL search entries using Shift-Del & it crashed! (935813) Comments: I used shift-Delete to remove an entry from the URL bar history. (917410) Comments: used shift-delete to delete a URL from the drop-down history. (899863) Comments: deleting an item from the search list with shift+del (891018) URL: http://www.wikipedia.org (890440) URL: http://www.wikipedia.org (886562) Comments: deleting autocomplete from search widget ==================================================================================================== Count Offset Real Signature [ 14 morkRowMap::Hash 62a03f05 - morkRowMap::Hash ] Crash date range: 20-SEP-04 to 24-SEP-04 Min/Max Seconds since last crash: 19 - 155645 Min/Max Runtime: 153 - 155689 Count Platform List 9 Windows XP [Windows NT 5.1 build 2600] 5 Windows 2K [Windows NT 5.0 build 2195] Count Build Id List 8 2004091907 3 2004092207 1 2004092308 1 2004092111 1 2004092007 No of Unique Users 11 Stack trace(Frame) morkRowMap::Hash [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 134] morkRowMap::GetRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 189] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 1456] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 700] nsFormFillController::KeyPress [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp line 584] DispatchToInterface [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 127] nsEventListenerManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 1524] nsGenericElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp line 1960] nsHTMLInputElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp line 1399] PresShell::HandleEventInternal [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 6051] PresShell::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 5913] nsViewManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2244] nsViewManager::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2030] HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp line 79] nsWindow::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 1067] nsWindow::DispatchKeyEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 2978] nsWindow::OnKeyDown [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 3068] (966427) Comments: attempting to delete an item from a form autocomplete (966406) Comments: attempting to delete from form autocomplete popup (960150) Comments: Shift+Delete-ing a saved form entry; this is reproducable (939370) Comments: I tried to delete an autocomplete entry
Keywords: topcrash
Summary: Shift-Delete crashes when removing URL from Location Bar history [@ morkRowMap::Hash ] → Shift-Delete crashes when removing URL from Location Bar history - FFBranch [@ morkRowMap::Hash ]
Comment 18•20 years ago
|
||
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041001 Firefox/0.10: Not crashing when deleting from the "Location Bar", but steel crashing when trying to delete textbox autocomplite entrie...
Comment 19•20 years ago
|
||
(In reply to comment #18) > Not crashing when deleting from the "Location Bar", but steel crashing when > trying to delete textbox autocomplite entrie... that's true. I did mention this in Comment #14 ( requesting summary change )
Comment 20•20 years ago
|
||
Traced the source code and found a bug in nsAutoCompleteMdbResult::RemoveValueAt(). The row pointer is being used after it has been removed from the collection. This patch reorders the calls so that the pointer is deleted later. I've tested the patch on my pc and no longer get these crashes.
Attachment #160838 -
Flags: review?
Comment 21•20 years ago
|
||
Comment on attachment 160838 [details] [diff] [review] row being removed too early - should be after CutRow() call Forwarding review? to someone who's reviewed changes here before (and has made patches here, too)... If you just set the review flag to review? without setting a requestee, your patch will wait and wait and wait and wait and rot for all eternity. You'll want to set a requestee in the future. ;-)
Attachment #160838 -
Flags: review? → review?(bryner)
Comment 22•20 years ago
|
||
Comment on attachment 160838 [details] [diff] [review] row being removed too early - should be after CutRow() call good catch.
Attachment #160838 -
Flags: review?(bryner) → review+
Attachment #160838 -
Flags: approval-aviary?
Comment 23•20 years ago
|
||
checked in on trunk (waiting on branch approval)
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Comment 24•20 years ago
|
||
Comment on attachment 160838 [details] [diff] [review] row being removed too early - should be after CutRow() call a=asa for aviary checkin.
Attachment #160838 -
Flags: approval-aviary? → approval-aviary+
Updated•20 years ago
|
Keywords: fixed-aviary1.0
Comment 25•20 years ago
|
||
Woohoo! Verified using a 20041004 branch build.
Status: RESOLVED → VERIFIED
Updated•13 years ago
|
Crash Signature: [@ morkRowMap::Hash ]
You need to log in
before you can comment on or make changes to this bug.
Description
•