457828 - Spontaneous, frequent crashes in nsUrlClassifierDBService

Status: VERIFIED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

My trunk builds, starting today I think, are crashing very frequently with this stack:

(gdb) where
#0  0x125b3c65 in nsUrlClassifierFragmentSet::UnlinkEntry (this=0xde4008, entry=0x0) at nsUrlClassifierUtils.h:201
#1  0x125b6ddb in nsUrlClassifierFragmentSet::Put (this=0xde4008, fragment=@0xb0452ca0) at nsUrlClassifierUtils.h:159
#2  0x125aa41c in nsUrlClassifierDBServiceWorker::CheckKey (this=0xde3e00, spec=@0xb0452d0c, hostKey=@0xb0452ca0, results=@0x1fe7e1f0) at /Users/roc/mozilla-checkin/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1565
#3  0x125b0ae5 in nsUrlClassifierDBServiceWorker::DoLookup (this=0xde3e00, spec=@0xb0452d0c, c=0x21dcaf60) at /Users/roc/mozilla-checkin/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1680
#4  0x125b0cd4 in nsUrlClassifierDBServiceWorker::HandlePendingLookups (this=0xde3e00) at /Users/roc/mozilla-checkin/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1714
#5  0x125b330d in nsUrlClassifierDBServiceWorker::Lookup (this=0xde3e00, spec=@0x1710c1a0, c=0x0) at /Users/roc/mozilla-checkin/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1766
#6  0x004980a1 in NS_InvokeByIndex_P (that=0xde3e00, methodIndex=3, paramCount=2, params=0x195b3ba0) at /Users/roc/mozilla-checkin/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
#7  0x004872e8 in nsProxyObjectCallInfo::Run (this=0x20d2edc0) at /Users/roc/mozilla-checkin/xpcom/proxy/src/nsProxyEvent.cpp:181
#8  0x0047d2a2 in nsThread::ProcessNextEvent (this=0x1eda2220, mayWait=1, result=0xb0452ecc) at /Users/roc/mozilla-checkin/xpcom/threads/nsThread.cpp:510
#9  0x004072bc in NS_ProcessNextEvent_P (thread=0x1eda2220, mayWait=1) at nsThreadUtils.cpp:227
#10 0x0047d4b1 in nsThread::ThreadFunc (arg=0x1eda2220) at /Users/roc/mozilla-checkin/xpcom/threads/nsThread.cpp:254
#11 0x0064839f in _pt_root (arg=0x1eda2440) at /Users/roc/mozilla-checkin/nsprpub/pr/src/pthreads/ptthread.c:221
#12 0x96ecc6f5 in _pthread_start ()
#13 0x96ecc5b2 in thread_start ()

This happens at random times and is the worst trunk bug I've had in a long time. My current build's changeset is 961d90be2ba8.

Comment 1

[Johnathan Nightingale [:johnath]]

Looks like Mossop backed out that exact changeset due to random crashes, so it would be good to know if it's still happening on trunk.  The only obvious urlclassifier changes lately are from bug 453723, whose changeset is also in your window (74aad43f37a5).  If the backout on 961d... doesn't stop the crashing, it would e interesting to know if backing out 74aa... does.

Comment 2

[Tony Chung [:tchung]]

I repro'd it on trunk:  Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b1pre) Gecko/20080930022236 Minefield/3.1b1pre

It looks like it only happens on this build, and mac only.  See crash stacks: http://tinyurl.com/4n6qge

Frame  	Module  	Signature [Expand]  	Source
0 	XUL 	nsUrlClassifierDBServiceWorker::CheckKey 	toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:201
1 	XUL 	nsUrlClassifierDBServiceWorker::DoLookup 	toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1680
2 	XUL 	nsUrlClassifierDBServiceWorker::HandlePendingLookups 	toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1714
3 	XUL 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4 	XUL 	nsProxyObjectCallInfo::Run 	xpcom/proxy/src/nsProxyEvent.cpp:181
5 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
6 	XUL 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:227
7 	XUL 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:254
8 	libnspr4.dylib 	pt_root 	nsprpub/pr/src/pthreads/ptthread.c:221
9 	libSystem.B.dylib 	libSystem.B.dylib@0x31c54

Comment 3

[Tony Chung [:tchung]]

by the way, i repro'd this while signed in on ebay.com

Comment 4

[Marcia Knous [:marcia]]

I am not able to reproduce this on Windows using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b1pre) Gecko/20080930050845 Minefield/3.1b1pre. On 10.5 Mac the first time I visited verisign.com I got an immediate crash in the same stack.

Comment 5

[Tony Chung [:tchung]]

This is crashing repeatedly on mac for me and marcia.   Flagging as blocker.

Comment 6

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080930093007 Minefield/3.1b1pre ID:20080930093007

The above build is the 2nd windows nightly (post mossop's backout) and I received a random crash too.

http://crash-stats.mozilla.com/report/index/59db8afd-8f19-11dd-a25b-001a4bd43ed6?p=1

So looks like Mossop's backout has not fixed the random crasher, which means bug 453723 is more likely to be responsible for this bug (per comment 1). Setting the block chain as appropriate and CC'ng Dave Camp

Comment 7

[Steve England [:stevee]]

Littlemutt found a range:
 http://forums.mozillazine.org/viewtopic.php?p=4617015#p4617015

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=07da123ca0b3&tochange=edc314aed893

Comment 8

[Dave Camp (:dcamp)]

Yeah, this is almost certainly 453723, I'll back out.

Comment 9

[Cork]

I can verify that the last hourly does not crash for me.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b1pre) Gecko/20080930 Minefield/3.1b1pre ID:20080930133116

Comment 11

[Chris Blore]

Seems fixed for me too on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b1pre) Gecko/20081001 Minefield/3.1b1pre

Firefox hasn't crashed yet when it was doing so a few times an hour since yesterday.

Comment 12

[Jesse Ruderman]

#1 3.1b1pre topcrash

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fixed by backout

Comment 14

[Tony Chung [:tchung]]

Verified fix on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b1) Gecko/20081007 Firefox/3.1b1