488729 - Crash [@0xffffffff from nsNavBookmarks::InsertBookmark]

Status: RESOLVED WORKSFORME

(Toolkit :: Places, defect)

Description

[Shawn Wilsher :sdwilsh]

I saw this yesterday, and now today:
 0  0xffffffff
    eip = 0xffffffff   esp = 0x0012e77c   ebp = 0x0012e7a4   ebx = 0x00000001
    esi = 0x00000010   edi = 0x00000002   eax = 0x044ea080   ecx = 0x0354d7b8
    edx = 0x713b00fb   efl = 0x00010202
 1  xul.dll!nsNavBookmarks::InsertBookmark(__int64,nsIURI *,int,nsACString_internal const &,__int64 *) [nsNavBookmarks.cpp:817957a7c933 : 1122 + 0x29]
    eip = 0x1053ee65   esp = 0x0012e7ac   ebp = 0x0012e830
 2  xul.dll!NS_InvokeByIndex_P [xptcinvoke.cpp:817957a7c933 : 101 + 0x2]
    eip = 0x105f89ff   esp = 0x0012e894   ebp = 0x0012e8c0
 3  xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [xpcwrappednative.cpp:817957a7c933 : 2321 + 0x18]
    eip = 0x1002bc2a   esp = 0x0012e8bc   ebp = 0x0012e8c0
 4  xul.dll!XPC_WN_CallMethod(JSContext *,JSObject *,unsigned int,int *,int *) [xpcwrappednativejsops.cpp:817957a7c933 : 1585 + 0x9]
    eip = 0x1002dae0   esp = 0x0012ea80   ebp = 0x0012e8e4   ebx = 0x00fce5f0
 5  js3250.dll!js_Invoke [jsinterp.cpp:817957a7c933 : 1380 + 0x1b]
    eip = 0x0033252e   esp = 0x0012eb3c   ebp = 0x1005787d

Wish we had more of a stack than that though...

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1239897089.1239904863.17368.gz&fulltext=1#err1
WINNT 5.2 mozilla-central unit test on 2009/04/16 08:51:29

Comment 1

[Graydon Hoare :graydon]

Another crash on this point, a transient orange yesterday on tracemonkey: 

http://tinderbox.mozilla.org/showlog.cgi?log=TraceMonkey/1240591214.1240597886.13970.gz

The short log doesn't even manage to extract a stack *at all* -- whatever's doing the pattern matching is only pulling out a load map -- but the fulltext version shows the same sort of stack:

http://tinderbox.mozilla.org/showlog.cgi?log=TraceMonkey/1240591214.1240597886.13970.gz&fulltext=1

Thread 0 (crashed)
 0  0xffffffff
    eip = 0xffffffff   esp = 0x0012e77c   ebp = 0x0012e7a4   ebx = 0x00000001
    esi = 0x00000010   edi = 0x00000002   eax = 0x02eaa958   ecx = 0x052e9610
    edx = 0x772d00f9   efl = 0x00010202
 1  xul.dll!nsNavBookmarks::InsertBookmark(__int64,nsIURI *,int,nsACString_internal const &,__int64 *) [nsNavBookmarks.cpp:b404007efd79 : 1122 + 0x29]
    eip = 0x1053f0f3   esp = 0x0012e7ac   ebp = 0x0012e830
 2  xul.dll!NS_InvokeByIndex_P [xptcinvoke.cpp:b404007efd79 : 101 + 0x2]
    eip = 0x105f8d2c   esp = 0x0012e894   ebp = 0x0012e8c0
 3  xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [xpcwrappednative.cpp:b404007efd79 : 2321 + 0x18]
    eip = 0x1002bc87   esp = 0x0012e8bc   ebp = 0x0012e8c0
 4  js3250.dll!ReservedSlotIndexOK + 0x9
    eip = 0x00306600   esp = 0x0012e938   ebp = 0x0012e8e4   ebx = 0x01f1ea70

Comment 2

[Marco Bonardo [:mak]]

something trying to insert a null uri?
Is this still a concern now that we added null checks?

Comment 3

[Marco Bonardo [:mak]]

we have not seen this for 4 months nor i can find a signature in releases, i'd suppose is WFM actually, we have not enough informations to move on or to detect what could have fixed the issue, btw we have null checks now too.