434590 - Browser crashes when "Today" entry is deleted from History sidebar

Status: VERIFIED DUPLICATE of bug 433525

(Firefox :: Bookmarks & History, defect)

Description

[Jay]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9) Gecko/2008051206 Firefox/3.0

Installed Firefox 3 RC1 with a new/clean profile. The first thing I did is - open the History side bar and deleted all the entries created by the initial mozilla web pages opened by default. I could NOT delete two entries for some reason, but that is a separate issue. So, I deleted the "Today" folder. I clicked on "Getting Started" bookmark on the toolbar. I deleted the "Today" folder again. Clicked on "Getting Started" bookmark again. Boom. The browser crashes. It happens every time.

Reproducible: Always

Steps to Reproduce:
1. Install Firefox 3 RC1 with a new/clean profile.
2. Start the browser. The browser should open starter mozilla pages.
3. Open the History side bar. 
4. Delete "Today" history entry folder. 
5. Open any web page. eg: google.com or mozilla.org
6. Delete "Today" history entry folder.
7. Refresh the page.
8. Wait for a second or two.
Actual Results:  
Crashes (with out any crash report).

Expected Results:  
The browser should function normally.

Some of the steps may not even be necessary to crash the browser.

Comment 1

[Carsten Book [:Tomcat]]

works for me with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9pre) Gecko/2008051806 Minefield/3.0pre ID:2008051806

Do you see this Problem also in Firefox Safe Mode ? Do you have any extension installed ? 

Comment 2

[Jay]

Attachment: Browser before the crash with "Today" folder

Comment 3

[Alice0775 White]

Confirmed.
Crash [@ nsNavHistoryQueryResultNode::IsContainersQuery()]

Crash ID: bp-0203bec7-25da-11dd-bdb6-001321b13766
You can view details of this crash at http://crash-stats.mozilla.com/report/index/0203bec7-25da-11dd-bdb6-001321b13766?date=2008-05-19-19
Crash ID: bp-b3a3e563-25d9-11dd-a5ba-001321b13766
You can view details of this crash at http://crash-stats.mozilla.com/report/index/b3a3e563-25d9-11dd-a5ba-001321b13766?date=2008-05-19-19
Crash ID: bp-933b5207-25d9-11dd-813d-001cc45a2c28
You can view details of this crash at http://crash-stats.mozilla.com/report/index/933b5207-25d9-11dd-813d-001cc45a2c28?date=2008-05-19-19

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008051906 Minefield/3.0pre

Comment 4

[Jay]

(In reply to comment #1)
> works for me with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9pre)
> Gecko/2008051806 Minefield/3.0pre ID:2008051806
> 
> Do you see this Problem also in Firefox Safe Mode ? Do you have any extension
> installed ? 
> 
I see the problem even in Safe Mode. The extensions I have installed are - Flash, Real player, Java 6, Windows Media Player Plug-in.
This is what I use to run Firefox 3.
D:\programs\general\Firefox3\firefox.exe -no-remote -P ff3rc1 -safe-mode

I also have Firefox 2 installed, but it is using a different profile. I doubt if this has anything to do with the crash, but again I am just a user!

Comment 5

[Dietrich Ayala (:dietrich)]

given the stack, i think this is probably a dupe of bug 433525.

can you try the builds at the link below, and see if you can reproduce?

https://build.mozilla.org/tryserver-builds/2008-05-13_17:[e-mail]-bug433525-isContainersQueryCrash/

Comment 6

[Jay]

(In reply to comment #5)
> given the stack, i think this is probably a dupe of bug 433525.
> 
> can you try the builds at the link below, and see if you can reproduce?
> 
> https://build.mozilla.org/tryserver-builds/2008-05-13_17:[e-mail]-bug433525-isContainersQueryCrash/
> 
I tried the following
D:\programs\general\ff3TryBuildMinefield\firefox.exe  -no-remote -P ff3TryBu
ildMinefield -safe-mode

It did not crash immediately but it did crash after a while with the message "firefox.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created." on Windowss 2000.
I just repeated the steps 4 to 8 a couple of times. I do not know what triggered the crash.

Comment 7

[Dietrich Ayala (:dietrich)]

i was able to reproduce the crash with the steps provided. i applied the patch to bug 433525 locally and was no longer able to reproduce the crash.

(In reply to comment #6)
> It did not crash immediately but it did crash after a while with the message
> "firefox.exe has generated errors and will be closed by Windows. You will need
> to restart the program. An error log is being created." on Windowss 2000.
> I just repeated the steps 4 to 8 a couple of times. I do not know what
> triggered the crash.
> 

does this show up in about:crashes?

Comment 8

[Jay]

(In reply to comment #7)
> i was able to reproduce the crash with the steps provided. i applied the patch
> to bug 433525 locally and was no longer able to reproduce the crash.
Using the build from comment #5, it still crashes but just less frequent (and with more effort). So, I can not say for sure if the patch fixed the bug or not and if this crash (after the patch) is a different bug. The crash happened like 3 times in 15 minutes. From what I could figure, it seems like a threading/timing issue.

> (In reply to comment #6)
> > It did not crash immediately but it did crash after a while 
> > I just repeated the steps 4 to 8 a couple of times. I do not know what
> > triggered the crash.
> does this show up in about:crashes?
No. "about:crashes" says "No crash reports have been submitted".

Btw, Dr. Watson (drwtsn32.exe) fires up after the crash and I see "function: js_GetScriptLineExtent" in the exception trace. Reports that it is an "access violation" error. Trace below.

function: js_GetScriptLineExtent
        6011cad9 c1e803           shr     eax,0x3
        6011cadc 803cc5ec94136000                                      ds:01fc69e8=10
                               cmp byte ptr [js_SrcNoteSpec+0x4 (601394ec)+eax*8],0x0
        6011cae4 7505             jnz     js_GetScriptLineExtent+0x3360 (6011fdeb)
        6011cae6 33c0             xor     eax,eax
        6011cae8 40               inc     eax
        6011cae9 eb07             jmp     JS_XDRValue+0x3f2 (601220f2)
        6011caeb 56               push    esi
        6011caec e85adafcff       call    js_SrcNoteLength (600ea54b)
        6011caf1 59               pop     ecx
        6011caf2 03f0             add     esi,eax
FAULT ->6011caf4 8a06             mov     al,[esi]                     ds:030e1e58=??
        6011caf6 84c0             test    al,al
        6011caf8 75a2             jnz     JS_XDRFindClassById+0x33ce (6012569c)
        6011cafa 8bc3             mov     eax,ebx
        6011cafc 2b471c           sub     eax,[edi+0x1c]         ds:03941fae=????????
        6011caff 5f               pop     edi
        6011cb00 5e               pop     esi
        6011cb01 5b               pop     ebx
        6011cb02 40               inc     eax
        6011cb03 c3               ret
        6011cb04 8b442404         mov     eax,[esp+0x4]          ss:00ba68c7=00000000
        6011cb08 56               push    esi

Comment 9

[Dietrich Ayala (:dietrich)]

(In reply to comment #8)
> Btw, Dr. Watson (drwtsn32.exe) fires up after the crash and I see "function:
> js_GetScriptLineExtent" in the exception trace. Reports that it is an "access
> violation" error. Trace below.
> 
> function: js_GetScriptLineExtent
>         6011cad9 c1e803           shr     eax,0x3
>         6011cadc 803cc5ec94136000                                     
> ds:01fc69e8=10
>                                cmp byte ptr [js_SrcNoteSpec+0x4
> (601394ec)+eax*8],0x0
>         6011cae4 7505             jnz     js_GetScriptLineExtent+0x3360
> (6011fdeb)

Do you have Firebug installed? (maybe bug 388993?)

Comment 10

[Dietrich Ayala (:dietrich)]

(or: bug 400618, bug 430205)

Comment 11

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Yes, the stack is identical with the one attached to bug 433525. Let's dupe it.

Jay, as I read from your comments the remaining crash happens after a while and isn't correlated with the steps you mentioned in comment 0. If it doesn't fit to any of the given bugs it should be filed as a new one. But bug 388993 makes sense.

Comment 12

[Jay]

(In reply to comment #9)
No. I do not have Firebug installed. I am running firefox in safe-mode, which
should not have loaded/enabled it even if I had it installed. Am I correct?

(In reply to comment #10)
> (or: bug 400618, bug 430205)
I can't really say if they are related or not. But, just looking at the initial
bug description, it doesn't seem like they are related, because all I am doing
is messing with the "history side bar" as described in comment #0 (initial bug
description) plus changing the "View". As I said in comment #8, the crash still
happens but I just can't reproduce the SEQUENCE of steps.

Naive question: I am just wondering, why is the crash reporter is not firing
after the crash? 

Comment 13

[Jay]

(In reply to comment #11)
> Yes, the stack is identical with the one attached to bug 433525. Let's dupe it.
The stack I attached is from the crash of the Dietrich's trybuild and not RC1.
RC1 crash invoked "crash reporter" but the error message says "Unfortunately crash reporter is unable to submit a crash report. Details: the application did not leave a crash dump file". Crash of the Dietrich's trybuild did not even fire up the crash reporter, but Dr. Watson fired up.

> Jay, as I read from your comments the remaining crash happens after a while and
> isn't correlated with the steps you mentioned in comment 0. If it doesn't fit
> to any of the given bugs it should be filed as a new one. But bug 388993 makes
> sense.
> 
> *** This bug has been marked as a duplicate of bug 433525 ***
> 
I am using similar steps (comment #12) but NOT the exact steps described in comment #0 (initial bug description). The crash still happens, but less frequent. I will see if I can figure out the exact sequence of steps.

Comment 14

[timeless]

http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

the symbol server url you want is different for http://wiki.mozilla.org/Build:TryServer 
builds, afaiu it should be:
http://build.mozilla.org/tryserver-symbols

Comment 15

[Jay]

It looks like the patch fixed the bug. I could not reproduce the crash using the build with the patch on a FASTER computer with Windows Vista Business but it still occurs (less frequently) on a heavily loaded SLOWER desktop with Windows 2000. 

The crash on Windows 2000 could be different. I will try to learn to use WinDbg and I will file a new bug once I have the steps to reproduce on Windows 2000. Can I file a bug against a try-build? 

Discovered another bug  #434669 while trying to test the fix.

Thank you Dietrich and others for quickly resolving this.

Comment 16

[Jay]

Filed another bug 434788
https://bugzilla.mozilla.org/show_bug.cgi?id=434788

Comment 17

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv