419654 - Importing bookmark file corrupts heap (reproducible)

Status: RESOLVED FIXED

(Firefox :: Bookmarks & History, defect, P2)

Description

[Ondrej Brablc]

Attachment: Fix heap corruption and increase initial capacity

During tests of bookmark import performance I have encountered heap corruption. This seems to be reproducible, test case attached (please change the path if you want to test it). Michal, the nearest valgrind master, found the cause of the problem - appending an element to an array leads to array relocation what makes the reference taken earlier invalid. In this case we simply use the reference little earlier.

Additionally I have increased the initial capacity of mFrames to 16 to avoid relocations when new frames are added. This could be reasonable size for bookmark files.

Comment 1

[Ondrej Brablc]

Attachment: Run this in debug mode on Windows

Comment 2

[Ondrej Brablc]

Attachment: Bookmarks for import using tha script above

Comment 3

[Dietrich Ayala (:dietrich)]

Comment on attachment 305784 [details] [diff] [review]
Fix heap corruption and increase initial capacity

good find, thanks.

> 
> Additionally I have increased the initial capacity of mFrames to 16 to avoid
> relocations when new frames are added. This could be reasonable size for
> bookmark files.
> 

there's no telling. 16 could be reasonable for one class of users, and 1600 reasonable for another.

Comment 4

[Ondrej Brablc]

I hope, that 16 levels deep folder nesting will be ok for 99% of users.

Comment 5

[Mike Connor [:mconnor]]

99.999%

Comment 6

[Reed Loden [:reed]]

Checking in browser/components/places/src/nsPlacesImportExportService.cpp;
/cvsroot/mozilla/browser/components/places/src/nsPlacesImportExportService.cpp,v  <--  nsPlacesImportExportService.cpp
new revision: 1.49; previous revision: 1.48
done

Comment 7

[:Gijs (he/him)]

Sorry, but I backed this out because it made centos go orange.

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

This doesn't block beta4, it was a patch taken for opportunity. We'll fix it after.

Comment 9

[Ondrej Brablc]

(In reply to comment #7)
> Sorry, but I backed this out because it made centos go orange.

According to tinderbox it was multiple timeout failure in widgets mochitest: 
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1204448460.1204452527.31977.gz

I have checked those tests and there is no relation to import/export of bookmarks. So it looks like coincidence. Can you please commit again?

Comment 10

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 305784 [details] [diff] [review]
Fix heap corruption and increase initial capacity

We'll do this after beta 4.

Comment 11

[Reed Loden [:reed]]

Comment on attachment 305784 [details] [diff] [review]
Fix heap corruption and increase initial capacity

This is a blocker. No approval1.9 needed.

Comment 12

[Reed Loden [:reed]]

Checking in browser/components/places/src/nsPlacesImportExportService.cpp;
/cvsroot/mozilla/browser/components/places/src/nsPlacesImportExportService.cpp,v  <--  nsPlacesImportExportService.cpp
new revision: 1.57; previous revision: 1.56
done

Comment 13

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv