434788 - Crash at [@ nsNavHistoryResult::OnEndUpdateBatch] while removing history entries from "Today" folder

Status: RESOLVED WORKSFORME

(Firefox :: Bookmarks & History, defect, P2)

Description

[Jay]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9pre)

From bug# 434590#c15
https://bugzilla.mozilla.org/show_bug.cgi?id=434590#c15
Firefox crashed when I tried to delete the history entries from "Today" folder and open web pages simultaneously. I believe this will happen in RC1 even with the fix from bug# 434590 or bug# 433525

This does not happen frequently and I don't know how to reliably reproduce this. I am guessing the bug has to do with locking and transactions. This may be related to other bugs 401558, 432323, 379880

Output from Windbg
------------------
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=04f798f0 ebx=00000001 ecx=05e1e538 edx=06983184 esi=02ea93fc edi=0000000c
eip=6f6e6e41 esp=0012e8a8 ebp=0012e8bc iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010202
6f6e6e41 ??              ???

Stack Trace from WinDbg:
-----------------------
xul!nsNavHistoryResult::OnEndUpdateBatch(void)+0x3d [e:\builds\sendchange-slave\sendchange-win32\mozilla\toolkit\components\places\src\nsnavhistoryresult.cpp @ 4079]
xul!nsNavHistory::EndUpdateBatch(void)+0x4d [e:\builds\sendchange-slave\sendchange-win32\mozilla\toolkit\components\places\src\nsnavhistory.cpp @ 3631]
xul!nsNavHistory::RemovePagesByTimeframe(int64 aBeginTime = 102, int64 aEndTime = 1211299909249062)+0x14a [e:\builds\sendchange-slave\sendchange-win32\mozilla\toolkit\components\places\src\nsnavhistory.cpp @ 3984]
xul!NS_InvokeByIndex_P(class nsISupports * that = 0x010f6438, unsigned int methodIndex = 0xc, unsigned int paramCount = 2, struct nsXPTCVariant * params = 0x0012e950)+0x27 [e:\builds\sendchange-slave\sendchange-win32\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp @ 102]
xul!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x01371040, XPCWrappedNative::CallMode mode = 268606161 (No matching enumerant))+0x814 [e:\builds\sendchange-slave\sendchange-win32\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2390]
js3250!js_DefineNativeProperty(struct JSContext * cx = <Memory access error>, struct JSObject * obj = 0x04f798f0, long id = <Memory access error>, long value = <Memory access error>, <function> * getter = <Memory access error>, <function> * setter = <Memory access error>, unsigned int attrs = <Memory access error>, unsigned int flags = <Memory access error>, int shortid = <Memory access error>, struct JSProperty ** propp = <Memory access error>)+0x305 [e:\builds\sendchange-slave\sendchange-win32\mozilla\js\src\jsobj.c @ 3152]
xul!xpc_CloneJSFunction(class XPCCallContext * ccx = 0x01236540, struct JSObject * funobj = 0x20000006, struct JSObject * parent = 0x01236570)+0xc6 [e:\builds\sendchange-slave\sendchange-win32\mozilla\js\src\xpconnect\src\xpcwrappednativeinfo.cpp @ 81]


Reproducible: Sometimes

Steps to Reproduce:
1.
2.
3.
Actual Results:  
Firefox crashes

Expected Results:  
Should function normally or display a message if the user is performing an invalid action.

Comment 1

[Lucas Malor (mail: c6kfnkn2uc AT snkmail DOT c0m)]

I confirm the bug. Firefox crashed a few seconds after I reproduced the steps, without any Breakpad catch.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008052206 Minefield/3.0pre

Comment 2

[Marcia Knous [:marcia]]

I hit this crash testing the 3.0.1 candidate on Mac, Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.0.1) Gecko/2008070206 Firefox/3.0.1. I was testing with a new profile and simply deleted a history entry from the sidebar to trigger this crash. I was not able to reproduce it yet.

My crash report is: http://crash-stats.mozilla.com/report/index/4e530db0-4955-11dd-8cf5-001a4bd43e5c.

Comment 3

[Dave Garrett]

Here's a crash report from 3.0.1 on Linux:
bp-634f7797-592a-11dd-a6ba-001a4bd43e5c

0  	 	@0xffffe410  	
1 	libc-2.7.so 	libc-2.7.so@0x2b020 	
2 	libstdc++.so.6.0.9 	libstdc++.so.6.0.9@0xb96ff 	
3 	libstdc++.so.6.0.9 	libstdc++.so.6.0.9@0xb6f84 	
4 	libstdc++.so.6.0.9 	libstdc++.so.6.0.9@0xb6fc1 	
5 	libstdc++.so.6.0.9 	libstdc++.so.6.0.9@0xb7884 	
6 	libxul.so 	nsNavHistoryResult::OnEndUpdateBatch 	mozilla/toolkit/components/places/src/nsNavHistoryResult.cpp:4108
7 	libxul.so 	nsNavHistory::EndUpdateBatch 	mozilla/toolkit/components/places/src/nsNavHistory.cpp:3631
8 	libxul.so 	nsNavHistory::RemovePagesFromHost 	mozilla/toolkit/components/places/src/nsNavHistory.cpp:263
9 	libxul.so 	NS_GetXPTCallStub_P 	
10 	libxul.so 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393
11 	libxul.so 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
12 	libmozjs.so 	js_Invoke 	mozilla/js/src/jsinvoke.c:1297
13 	libmozjs.so 	js_Interpret 	mozilla/js/src/jsinterp.c:4852
14 	libmozjs.so 	js_Invoke 	mozilla/js/src/jsinvoke.c:1313
15 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1523
16 	libxul.so 	nsXPCWrappedJS::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:559
17 	libxul.so 	PrepareAndDispatch 	mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
18 	libxul.so 	NS_GetXPTCallStub_P 	
19 	libxul.so 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393
20 	libxul.so 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
21 	libmozjs.so 	js_Invoke 	mozilla/js/src/jsinvoke.c:1297
22 	libmozjs.so 	js_Interpret 	mozilla/js/src/jsinterp.c:4852
23 	libmozjs.so 	js_Invoke 	mozilla/js/src/jsinvoke.c:1313
24 	libmozjs.so 	js_InternalInvoke 	mozilla/js/src/jsinvoke.c:1369
25 	libmozjs.so 	JS_CallFunctionValue 	mozilla/js/src/jsapi.c:5054
26 	libxul.so 	nsJSContext::CallEventHandler 	mozilla/dom/src/base/nsJSEnvironment.cpp:1962
27 	libxul.so 	nsJSEventListener::HandleEvent 	mozilla/dom/src/events/nsJSEventListener.cpp:248
28 	libxul.so 	nsEventListenerManager::HandleEventSubType 	mozilla/content/events/src/nsEventListenerManager.cpp:1080
29 	libxul.so 	nsEventListenerManager::HandleEvent 	mozilla/content/events/src/nsEventListenerManager.cpp:1184
30 	libxul.so 	nsEventTargetChainItem::HandleEvent 	mozilla/content/events/src/nsEventDispatcher.cpp:210
31 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	mozilla/content/events/src/nsEventDispatcher.cpp:268
32 	libxul.so 	nsEventDispatcher::Dispatch 	mozilla/content/events/src/nsEventDispatcher.cpp:483
33 	libxul.so 	nsXULElement::PreHandleEvent 	mozilla/content/xul/content/src/nsXULElement.cpp:1656
34 	libxul.so 	nsEventTargetChainItem::PreHandleEvent 	mozilla/content/events/src/nsEventDispatcher.cpp:186
35 	libxul.so 	nsEventDispatcher::Dispatch 	mozilla/content/events/src/nsEventDispatcher.cpp:440
36 	libxul.so 	PresShell::HandleDOMEventWithTarget 	mozilla/layout/base/nsPresShell.cpp:5967
37 	libxul.so 	nsXULMenuCommandEvent::Run 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:2068
38 	libxul.so 	nsThread::ProcessNextEvent 	mozilla/xpcom/threads/nsThread.cpp:510
39 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:227
40 	libxul.so 	nsBaseAppShell::Run 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
41 	libxul.so 	nsAppStartup::Run 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
42 	libxul.so 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3170
43 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
44 	libc-2.7.so 	libc-2.7.so@0x1638f 	

Also have not been able to reproduce it.

Comment 5

[Marco Bonardo [:mak]]

i guess if this is the same as Bug 470586

Comment 6

[Dietrich Ayala (:dietrich)]

Can anyone reproduce this in a recent nightly?

Comment 7

[Dietrich Ayala (:dietrich)]

removing wanted? request. if it's reproducible still, it'll block.

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Because we aren't able to search for signatures of sub-frames right now, it's hard to tell if the crash is still reported. Samuel, do you know a way how to get this information?

Comment 9

[Samuel Sidler (old account; do not CC)]

You can file a Server Ops bug and ask for a manual sql query to be run...

Comment 10

[Henrik Skupin [:whimboo][⌚️UTC+2]]

As given by bug 483184 no more crashes with this signature can be seen on trunk and 1.9.1. Marking as WFM for now until someone can reproduce it clearly.

Comment 11

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv