46686 - Crash upon adding two bookmarks of the same URL

Status: VERIFIED FIXED

(SeaMonkey :: Bookmarks & History, defect, P3)

Description

[Blake Ross]

Build ID: 2000072708 WinNT 4, also seen on linux

Steps to Reproduce:
(1) Go to mozilla.org (happens on any site, though)
(2) Add the page to your bookmarks (Bookmarks | Add Current Page)
(3) Repeat step 2.

Result: crash.  Asa tested and found that it happens when you bookmark the same 
URL twice, not two separate pages with the same title.

Comment 1

[Blake Ross]

This is bad, must fix for beta3 and relnote for beta2.

Comment 2

[Robert John Churchill]

Chris, according to the stack trace, this is crashing at FireNewlyMatchedRules() 
in the XUL template builder while trying to set container attributes... perhaps 
related to the "empty" calculation changes that just went into the tree... care 
to take a look-see?

  0864829C    PPC  05E7B954  AddBookmark__18nsBookmarksServiceFPCcPCwiPCw+006BC
  0864813C    PPC  05E6FFEC  
  08647EAC    PPC  07153A80  RDFContainerImpl::AppendElement(nsIRDFNode*)+00178
  08647E2C    PPC  070CA090  InMemoryDataSource::Assert(nsIRDFResource*, 
nsIRDFResource*, nsI
RDFNode*, int)+001C0
  08647DBC    PPC  05E8A340  nsBookmarksService::OnAssert(nsIRDFResource*, 
nsIRDFResource*, n
sIRDFNode*)+000EC
  08647D4C    PPC  070E0C1C  CompositeDataSourceImpl::OnAssert(nsIRDFResource*, 
nsIRDFResourc
e*, nsIRDFNode*)+00154
  08647CDC    PPC  071C0E14  nsXULTemplateBuilder::OnAssert(nsIRDFResource*, 
nsIRDFResource*,
 nsIRDFNode*)+00110
  08647C1C    PPC  071C0C44  nsXULTemplateBuilder::FireNewlyMatchedRules(const 
ClusterKeySet&

Comment 3

[Robert John Churchill]

Note: no need to put [rjc] in status area, so removing.

Comment 4

[Claudius Gayle]

I don't see this on any of the beta2 branch builds on any platform(2000073104 Mac+Linux, 2000072904 Win). removing relnote2 
keyword.

Comment 5

[Stephen Koren]

I see this on 081108 Win32, but only the first time I do it. After I get the
crash, I can't reproduce it. However, every time I install the browser and add
two bookmarks of the same URL, it crashes, but it will work from then on.

Comment 6

[Chris Waterson]

WORKSFORME in WinNT, 2000-08-18-08. I notice an interesting side effect though.
If you add a bookmark more than once, it only *appears* once. But it takes an
equal number of "delete" operations in the "manage bookmarks" window to kill it.
Filed bug 49534 on that gem.

Comment 7

[Blake Ross]

*** Bug 51116 has been marked as a duplicate of this bug. ***

Comment 8

[Blake Ross]

Reopening per bug 51116...

Comment 9

[Stephen Koren]

Only happening with Ctrl+D. Using Bookmarks | Add Current Page works fine.

Comment 10

[Blake Ross]

Using the menu item also makes it crash sometimes.

New stack trace:

nsAssignmentSet::List::AddRef() line 374 + 10 bytes
ns_if_addref(0x0a840200) line 1101 + 14 bytes
nsAssignmentSet::ConstIterator::operator++() line 430 + 19 bytes
nsAssignmentSet::GetAssignmentFor(17408, 0x0079d7e4) line 434 + 22 bytes
nsXULTemplateBuilder::SetContainerAttrs(0x030ed390, 0x00efbe68) line 6650
nsXULTemplateBuilder::FireNewlyMatchedRules({...}) line 4662
nsXULTemplateBuilder::OnAssert(0x030efda8, 0x030f1600, 0x030f1030, 0x01363ea0, 
0x030f7f10) line 4699 + 15 bytes
CompositeDataSourceImpl::OnAssert(0x030f1604, 0x030f1074, 0x030f1030, 
0x01363ea0, 0x030f7f10) line 1441
nsBookmarksService::OnAssert(0x030f1080, 0x030f3110, 0x030f1030, 0x01363ea0, 
0x030f7f10) line 4573
InMemoryDataSource::Assert(0x030f3110, 0x030f1030, 0x01363ea0, 0x030f7f10, 1) 
line 1153
nsBookmarksService::Assert(0x030f1074, 0x030f1030, 0x01363ea0, 0x030f7f10, 1) 
line 2918 + 36 bytes
RDFContainerImpl::AppendElement(0x01364b00, 0x030f7f10) line 232 + 40 bytes
BookmarkParser::AddBookmark({...}, 0x01361ee0, 0x01360510, 968205836, 0, 0, 
0x00000000, 0x030f2c40, 0x00000000, 0x01361fd0) line 1423 + 44 bytes
nsBookmarksService::AddBookmark(0x030f1070, 0x01361ee0, 0x01360510, 0, 
0x01361fd0) line 2530 + 50 bytes
XPTC_InvokeByIndex(0x030f1070, 5, 4, 0x0079de1c) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(0x020c52f0, 0x035ad570, 0x035ab8fc, 
CALL_METHOD, 4, 0x02cd7fec, 0x0079dfcc) line 915 + 43 bytes
WrappedNative_CallMethod(0x020c52f0, 0x02d1a1b8, 4, 0x02cd7fec, 0x0079dfcc) 
line 226 + 34 bytes
js_Invoke(0x020c52f0, 4, 0) line 716 + 23 bytes
js_Interpret(0x020c52f0, 0x0079e908) line 2517 + 15 bytes
js_Invoke(0x020c52f0, 1, 2) line 732 + 13 bytes
js_InternalInvoke(0x020c52f0, 0x02cbcc50, 46910656, 0, 1, 0x0079ea9c, 
0x0079ea2c) line 805 + 19 bytes
JS_CallFunctionValue(0x020c52f0, 0x02cbcc50, 46910656, 1, 0x0079ea9c, 
0x0079ea2c) line 3147 + 31 bytes
nsJSContext::CallEventHandler(0x020c42c0, 0x02cbcc50, 0x02cbccc0, 1, 
0x0079ea9c, 0x0079ea98, 0) line 861 + 33 bytes
nsJSEventListener::HandleEvent(0x013602e4) line 154 + 64 bytes
nsEventListenerManager::HandleEventSubType(0x033a0480, 0x013602e4, 0x031382fc, 
8, 7) line 788 + 19 bytes
nsEventListenerManager::HandleEvent(0x02116030, 0x0079f144, 0x0079f0dc, 
0x031382fc, 7, 0x0079f18c) line 1666 + 39 bytes
nsXULElement::HandleDOMEvent(0x031382f0, 0x02116030, 0x0079f144, 0x0079f0dc, 1, 
0x0079f18c) line 3249
PresShell::HandleDOMEventWithTarget(0x02140d70, 0x031382f0, 0x0079f144, 
0x0079f18c) line 4087 + 39 bytes
nsMenuFrame::Execute() line 1497
nsMenuFrame::HandleEvent(0x02d03054, 0x02116030, 0x0079f5fc, 0x0079f4ec) line 
378
PresShell::HandleEventInternal(0x0079f5fc, 0x01356ed0, 0x0079f4ec) line 4055 + 
38 bytes
PresShell::HandleEvent(0x02140d74, 0x01356ed0, 0x0079f5fc, 0x0079f4ec, 0, 1) 
line 3975 + 23 bytes
nsView::HandleEvent(0x01356ed0, 0x0079f5fc, 8, 0x0079f4ec, 0, 1) line 379
nsView::HandleEvent(0x01355630, 0x0079f5fc, 8, 0x0079f4ec, 0, 1) line 352
nsView::HandleEvent(0x0134b140, 0x0079f5fc, 8, 0x0079f4ec, 0, 1) line 352
nsView::HandleEvent(0x0213f490, 0x0079f5fc, 28, 0x0079f4ec, 1, 1) line 352
nsViewManager2::DispatchEvent(0x0213f670, 0x0079f5fc, 0x0079f4ec) line 1429
HandleEvent(0x0079f5fc) line 68
nsWindow::DispatchEvent(0x0213f354, 0x0079f5fc, nsEventStatus_eIgnore) line 614 
+ 10 bytes
nsWindow::DispatchWindowEvent(0x0079f5fc) line 635
nsWindow::DispatchMouseEvent(301, 0x00000000) line 3811 + 21 bytes
ChildWindow::DispatchMouseEvent(301, 0x00000000) line 4021
nsWindow::ProcessMessage(514, 0, 1966315, 0x0079f978) line 2889 + 24 bytes
nsWindow::WindowProc(0x00000c54, 514, 0, 1966315) line 883 + 27 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()
007989fe()

Comment 11

[Chris Waterson]

Attachment: fix

Comment 12

[Chris Waterson]

This had to do with the order-of-operations in the fix for bug 45951. We need to
make sure that we update the container attr's *first*, because if we fall into
the "else" clause, we'll nuke "bestmatch" when removing from the match set.

Comment 13

[Robert John Churchill]

Yep, r=rjc  :)

Comment 14

[Blake Ross]

johng/vera: can we get this +'d so the patch can go in?  it's a pretty 
important [crasher] bug anyways...

Comment 15

[Chris Waterson]

fix checked in

Comment 16

[R.K.Aa.]

*** Bug 52424 has been marked as a duplicate of this bug. ***

Comment 17

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Verified on NT & Linux.