449221 - Bookmarks-> Organize Bookmarks freezes/crashes the Browser [@ nsLineBreaker::FlushCurrentWord] [@ memcpy]

Status: VERIFIED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008080504 Minefield/3.1a2pre ID:2008080504

Same as bug 447884, but a regression for tonight's build.

1. New profile, start firefox
2. Bookmarks > Organize Bookmarks

Expected:
- Organize Bookmarks UI

Actual:
- Browser hangs

Comment 1

[u88484]

Sorry if Places is not right.  I can't figure out what is supposed to be filed where since there is a Bookmarks & History and Places.

Comment 2

[karunakar reddy]

Still crashing - tried with Gecko/2008080505 Minefield/3.1a2pre - Build ID: 2008080505

Comment 3

[Steve England [:stevee]]

No Hanging:
firefox-3.1a2pre.en-US.win32 04-Aug-2008 1625
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008080415 Minefield/3.1a2pre

Hanging:
firefox-3.1a2pre.en-US.win32 04-Aug-2008 1731
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008080416 Minefield/3.1a2pre

Now to work out how to get a checkin range :-)

Comment 4

[Steve England [:stevee]]

Now, if I've done my range-finding properly, then this bug is caused by one of these changesets:

6ad2e5aa3c64	Merge Quotes and CounterData storage types into ValuePairList. (Bug 322475) r+sr=bzbarsky

85a9eb44b240	Make scrollbars not be reflow roots anymore, since they don't obey all the invariants needed. (Bug 366791) r+sr=bzbarsky

49dbf253c174	Untabify the few lines with tabs in nsStyleStruct.h

8666db48bea6	Label types of nsStyleCoord and nsStyleSides. b=443057 r+sr=bzbarsky

However it's perfectly possible I've messed the range up because this stuff isn't simple anymore. Cc'ng bz since he's involved in all three of the patches that made code changes.

Comment 5

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008080504 Minefield/3.1a2pre ID:2008080504

Actually, if do the STR in comment 0 but leave the browser long enough, it actually crashes.

http://crash-stats.mozilla.com/report/index/7df86c2b-6310-11dd-88f4-001a4bd43ef6?p=1

Signature	nsLineBreaker::FlushCurrentWord()
UUID	7df86c2b-6310-11dd-88f4-001a4bd43ef6
Time	2008-08-05 10:01:35-07:00
Uptime	41
Product	Firefox
Version	3.1a2pre
Build ID	2008080504
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	AuthenticAMD family 6 model 8 stepping 1
Crash Reason	EXCEPTION_STACK_OVERFLOW
Crash Address	0x1010b46b
Comments	bug 449221

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	nsLineBreaker::FlushCurrentWord 	content/base/src/nsLineBreaker.cpp:77
1 	xul.dll 	nsTArray<nsLineBreaker::TextItem>::AppendElements<nsLineBreaker::TextItem> 	obj-firefox/dist/include/xpcom/nsTArray.h:554
2 	xul.dll 	xul.dll@0x2895ab

Comment 6

[Steve England [:stevee]]

Two more crash stacks, this time at memcpy

Signature	memcpy
UUID	0044efe3-6313-11dd-9221-001321b13766
Time	2008-08-05 10:20:14-07:00
Uptime	37
Product	Firefox
Version	3.1a2pre
Build ID	2008080504
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	AuthenticAMD family 6 model 8 stepping 1
Crash Reason	EXCEPTION_STACK_OVERFLOW
Crash Address	0x78148333
Comments	

Frame  	Module  	Signature [Expand]  	Source
0 	mozcrt19.dll 	memcpy 	memcpy.asm:113
1 	xul.dll 	xul.dll@0x30b0c1 	
2 		@0x3775b 	





Signature	memcpy
UUID	412c2d7d-6313-11dd-a2f4-001a4bd43e5c
Time	2008-08-05 10:22:03-07:00
Uptime	103
Product	Firefox
Version	3.1a2pre
Build ID	2008080504
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	AuthenticAMD family 6 model 8 stepping 1
Crash Reason	EXCEPTION_STACK_OVERFLOW
Crash Address	0x78148333
Comments	

Frame  	Module  	Signature [Expand]  	Source
0 	mozcrt19.dll 	memcpy 	memcpy.asm:113
1 	xul.dll 	xul.dll@0x30b0c1 	
2 		@0x3775b 

Comment 7

[Boris Zbarsky [:bzbarsky]]

This worksforme on mac.  Could be dependent on Windows native theme stuff, I guess....

I really wish the breakpad stacks had something to do with reality.  Say the stack to the actual stack overflow?  That would let us know what's going one.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Bernd got this in a debugger.  The infinite recursion looks like this:

 	PresShell::ProcessReflowCommands(int aInterruptible=0)  Line 6449
 	PresShell::DoFlushPendingNotifications(mozFlushType aType=Flush_Layout,
          int aInterruptibleReflow=0)  Line 4589
 	PresShell::FlushPendingNotifications(mozFlushType aType=Flush_Layout)
          Line 4525
 	PresShell::HandlePostedReflowCallbacks()  Line 4489
 	PresShell::DidDoReflow()  Line 6260
 	PresShell::ProcessReflowCommands(int aInterruptible=0)  Line 6449

So at a guess, scrollbars are posting reflow callbacks that then reflow the scrollbar, etc, etc.

Comment 9

[Bernd]

Attachment: stack

I just updated my build after my checkin from yesterday. Without the update it was OK, now it hangs and I just stopped the debugger to see where it hangs

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Can you get a stack for where the reflow callbacks are being posted?

Comment 11

[Bill Gianopoulos [:WG9s]]

I you are having difficulty reproducing this with Bookmarks -> Organize Bookmarks, I find it crashes much more reliable by right clicking on a bookmark and selecting Properties from the context menu.

Comment 12

[John]

^^ Yes, that is the only way it hangs for me.

Comment 13

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Sorry, cannot reproduce it with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008080504 Minefield/3.1a2pre. I can open the Library and Firefox doesn't hang/crash.

Comment 14

[Stappel]

It crashes everytime when i try to right click on a bookmark and select properties from the context menu.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008080603 Minefield/3.1a2pre

Comment 15

[Jim Jeffery not reading bug-mail 1/2/11]

Not-responding, crash on Vista HP SP1 also:

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/2008080603 Minefield/3.1a2pre Firefox/3.0 ID:2008080603

Comment 16

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: stack showing the problem

Comment 17

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I backed out bug 366791.

Comment 18

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Ok, I also crash that way.

David, do you know why the stack sent by breakpad is still totally empty? This interferes my work all the last days. As example: bp-e31b3333-63f9-11dd-a25d-001cc4e2bf68

Comment 19

[Boris Zbarsky [:bzbarsky]]

Someone should probably file a breakpad bug here, fwiw...

Comment 20

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to comment #19)
> Someone should probably file a breakpad bug here, fwiw...

Sorry for using this bug but could it be related to bug 411171 or bug 445090 which are already filed for Thunderbird?

Comment 21

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

No.  Those are bugs that would cause no symbols to be available for the build; in this case a certain type of crash produces unusable reports.

Comment 22

[(not currently active) Ted Mielczarek]

(In reply to comment #18)
> Ok, I also crash that way.
> 
> David, do you know why the stack sent by breakpad is still totally empty? This
> interferes my work all the last days. As example:
> bp-e31b3333-63f9-11dd-a25d-001cc4e2bf68
> 

That report looks fine to me right now. Perhaps it just got delayed in processing?

In fact, since it was a stack overflow, it probably took significant time to process, so you saw it as it was mid-processing, in which case you want bug 422945 to be fixed.

Comment 24

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080808031528 Minefield/3.1a2pre ID:20080808031528
-->VERIFIED

Comment 25

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv