424163 - topcrash [@ sqlite3BitvecSet]

Status: VERIFIED FIXED

(Toolkit :: Storage, defect, P1)

Description

[David Baron :dbaron:]

A new topcrash appeared in 2008-03-20 builds at the signature sqlite3BitvecSet.  Given that those builds have only been out a few hours so far, it's probably the #1 topcrash on trunk at this point by a good bit.

It's showing up on Windows and Mac.

Typical stack is:

0  	sqlite3BitvecSet  	 mozilla/db/sqlite3/src/sqlite3.c:22783
1 	sqlite3PagerDontRollback 	mozilla/db/sqlite3/src/sqlite3.c:27282
2 	allocateBtreePage 	mozilla/db/sqlite3/src/sqlite3.c:33057
3 	balance_quick 	mozilla/db/sqlite3/src/sqlite3.c:33678
4 	balance_nonroot 	mozilla/db/sqlite3/src/sqlite3.c:33835
5 	balance 	mozilla/db/sqlite3/src/sqlite3.c:34516
6 	sqlite3BtreeInsert 	mozilla/db/sqlite3/src/sqlite3.c:34648
7 	sqlite3VdbeExec 	mozilla/db/sqlite3/src/sqlite3.c:43803
8 	sqlite3Step 	mozilla/db/sqlite3/src/sqlite3.c:39788
9 	sqlite3_step 	mozilla/db/sqlite3/src/sqlite3.c:39852
10 	mozStorageStatement::ExecuteStep(int*) 	mozilla/storage/src/mozStorageStatement.cpp:472
11 	mozStorageStatement::Execute() 	mozilla/storage/src/mozStorageStatement.cpp:448
12 	nsUrlClassifierStore::WriteEntry(nsUrlClassifierEntry&) 	mozilla/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1788
13 	nsUrlClassifierDBServiceWorker::AddChunk(unsigned int, unsigned int, nsTArray<nsUrlClassifierEntry>&) 	mozilla/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:2316
14 	nsUrlClassifierDBServiceWorker::ProcessChunk(int*) 	mozilla/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:2444
15 	nsUrlClassifierDBServiceWorker::UpdateStream(nsACString_internal const&) 	mozilla/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:2806
16 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
17 	nsProxyObjectCallInfo::Run() 	mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
18 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:510
19 	nsThread::ThreadFunc(void*) 	mozilla/xpcom/threads/nsThread.cpp:254
20 	_PR_NativeRunThread 	mozilla/nsprpub/pr/src/threads/combined/pruthr.c:436
21 	pr_root 	mozilla/nsprpub/pr/src/md/windows/w95thred.c:122
22 	_callthreadstartex 	threadex.c:348
23 	_threadstartex 	threadex.c:326
24 	BaseThreadStart 	


Bugs that seem like possible causes: bug 415947, bug 420505, bug 423790.

Comment 1

[Ed Lee :Mardak]

Is this the same as bug 423943?

Comment 2

[Shawn Wilsher :sdwilsh]

I would suspect either bug 415947 or bug 423790 myself.

(In reply to comment #1)
> Is this the same as bug 423943?
possible as well

Comment 3

[Dave Camp (:dcamp)]

423790 didn't touch any of the database access (or C++), I'd suspect 415947.

Comment 4

[Shawn Wilsher :sdwilsh]

SQLite mailing list thread:
http://www.mail-archive.com/sqlite-users%40sqlite.org/msg32514.html

Comment 5

[Shawn Wilsher :sdwilsh]

>  The whole Bitvec thing is new to 3.5.7, but I thought it was
>  thoroughly tested.  I'll have a look.
We may want to back-out Bug 415947 for beta 5.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Please do that, then resolve this bug.

Comment 7

[Shawn Wilsher :sdwilsh]

I won't have time to watch the tree to do that anytime before bake time is over - sorry.  Peter, could you handle that please (and re-open bug 415947 to pickup 3.5.8).

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

Peter, please see comment 5 and comment 7.

Comment 9

[Peter Weilbacher]

Seems like Gavin did the the backout before I had time to react, thanks!

Comment 11

[Henrik Skupin [:whimboo][⌚️UTC+1]]

No crashes anymore for 3 days. I think we can mark it verified.