536308 - crash [@ arena_dalloc_small | arena_dalloc | free | sqlite3_free | pcache1TruncateUnsafe] and [@ pcache1TruncateUnsafe ]

Status: RESOLVED INVALID

(Core :: SQLite and Embedded Database Bindings, defect)

Description

[Wayne Mery (:wsmwk)]

... sqlite3_free | pcache1TruncateUnsafe is a topcrash for thunderbird 3.0.0, and the two sigs together are 2.2% of crashes.  unable to find an equivalent stack for Mac

#8 crash [[@ arena_dalloc_small | arena_dalloc | free | sqlite3_free | pcache1TruncateUnsafe ]
goes back as least as far as 3.0b2
bp-51f23499-2365-4dcf-82e6-7de6a2091217
0	mozcrt19.dll	arena_dalloc_small	 objdir-tb/mozilla/memory/jemalloc/src/jemalloc.c:4442
1	mozcrt19.dll	arena_dalloc	objdir-tb/mozilla/memory/jemalloc/src/jemalloc.c:4565
2	mozcrt19.dll	free	objdir-tb/mozilla/memory/jemalloc/src/jemalloc.c:6404
3	sqlite3.dll	sqlite3_free	db/sqlite3/src/sqlite3.c:16108
4	sqlite3.dll	pcache1TruncateUnsafe	db/sqlite3/src/sqlite3.c:30491
5	sqlite3.dll	pcache1Truncate	db/sqlite3/src/sqlite3.c:30801
6	sqlite3.dll	sqlite3PcacheTruncate	db/sqlite3/src/sqlite3.c:29946
7	sqlite3.dll	sqlite3PagerClose	db/sqlite3/src/sqlite3.c:33944
8	sqlite3.dll	sqlite3BtreeClose	db/sqlite3/src/sqlite3.c:39651
9	sqlite3.dll	sqlite3_close	db/sqlite3/src/sqlite3.c:95348
10	thunderbird.exe	mozilla::storage::Connection::Close	storage/src/mozStorageConnection.cpp:521 

#41 crash [@ pcache1TruncateUnsafe]
bp-7fd6d1e7-dacc-4988-81cc-7229d2091212
0	sqlite3.dll	pcache1TruncateUnsafe	 db/sqlite3/src/sqlite3.c:30490
1	sqlite3.dll	pcache1Truncate	db/sqlite3/src/sqlite3.c:30801
2	sqlite3.dll	sqlite3PcacheTruncate	db/sqlite3/src/sqlite3.c:29946
3	sqlite3.dll	sqlite3PagerClose	db/sqlite3/src/sqlite3.c:33944
4	sqlite3.dll	sqlite3BtreeClose	db/sqlite3/src/sqlite3.c:39651
5	sqlite3.dll	sqlite3_close	db/sqlite3/src/sqlite3.c:95348
6	thunderbird.exe	mozilla::storage::Connection::Close	storage/src/mozStorageConnection.cpp:521

Comment 1

[Wayne Mery (:wsmwk)]

sdwilsh, asuth, is additional data needed to move this forward for 1.9.1 and 1.9.2?

#2 crash for thunderbird 3.0.1. there are a few for FF 3.6, eg bp-ba6c445f-c02c-48c9-83a9-13d002100122

Comment 2

[Shawn Wilsher :sdwilsh]

Are we seeing this on trunk at all?  I've upgraded SQLite there, and there are a number of crash fixes in it.

Comment 3

[Wayne Mery (:wsmwk)]

The short answer is no.  But then there is little hope, let alone a guarantee, of seeing "release crashes" on trunk 3.2a1pre (or one step removed in 3.1a1pr) given the number of users on the non-release branches. 
 3.2a1pre has only 24 of the top 300 slots populated
  http://crash-stats.mozilla.com/topcrasher/byversion/Thunderbird/3.2a1pre
 3.1a1pre has only 26 of the top 300 slots populated
  http://crash-stats.mozilla.com/topcrasher/byversion/Thunderbird/3.1a1pre

Still, it is my hope to determine via someone's skills if this is fixed in 1.9.2, or whether we need to dig further for steps, testcases, etc.

Comment 4

[Shawn Wilsher :sdwilsh]

Well, 1.9.1 and 1.9.2 are running the same version of SQLite, so I'd expect it existing there.

Comment 5

[Daniel Veditz [:dveditz]]

Not blocking a 1.9.1 release but will take a patch.

Comment 6

[Andrew Sutherland [:asuth] (he/him)]

Just so we're all on the same page, the Thunderbird 3.1a1 mozilla release branch has the same version as mozilla-central trunk/1.9.3, SQLite 3.6.22.

Comment 7

[Dan Mosedale (:dmosedale, :dmose)]

I don't think we'd block 3.1 on this at this point, given that we don't know if it's actually a significant problem in 1.9.1.  Wayne & others, if we do get confirmation of that (presumably we'll be able to get more testers later in the cycle), feel free to renominate.

Comment 8

[Wayne Mery (:wsmwk)]

dmose, I think you mean we don't know if it's a significant problem in 1.9.2 :)  quite true, for thunderbird - no dev branch crashes found (unlike bug sqlite3DbMallocRaw [1] which still is reported on trunk, but on 3.0.1 ranking dropped like a stone)

However, there are FF crashes on 1.9.2 branch for both crash sigs:
* http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.2&branch=1.9.3&query_search=signature&query_type=exact&query=arena_dalloc_small%20|%20arena_dalloc%20|%20free%20|%20sqlite3_free%20|%20pcache1TruncateUnsafe&date=&range_value=4&range_unit=weeks&process_type=all&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=arena_dalloc_small%20|%20arena_dalloc%20|%20free%20|%20sqlite3_free%20|%20pcache1TruncateUnsafe
* http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.2&branch=1.9.3&query_search=signature&query_type=exact&query=pcache1TruncateUnsafe&date=&range_value=4&range_unit=weeks&process_type=all&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=pcache1TruncateUnsafe

storage dudes, where does that leaves us?


[1] sqlite3DbMallocRaw http://crash-stats.mozilla.com/report/list?product=Thunderbird&branch=1.9.2&branch=1.9.3&query_search=signature&query_type=contains&query=sqlite&date=&range_value=4&range_unit=weeks&process_type=all&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=sqlite3DbMallocRaw

Comment 9

[Wayne Mery (:wsmwk)]

(In reply to comment #8)
> (unlike bug sqlite3DbMallocRaw [1] which still is reported on trunk, but on 3.0.1 ranking dropped like a stone)

wrong reference - I meant bug 537063 - mozilla::storage::Row::initialize(sqlite3_stmt*)

Comment 10

[Andrew Sutherland [:asuth] (he/him)]

(In reply to comment #8)
> storage dudes, where does that leaves us?

The solution to all theoretical SQLite problems is to upgrade to the latest SQLite, and this is what we are doing for Thunderbird.  In practice, memory related bugs like this always sound like code other than SQLite's fault.

Thunderbird 3.0.2 has SQLite 3.6.22. (3.0 and 3.0.1 had 3.6.20)
Thunderbird 3.1a1 had SQLite 3.6.22.
I'll make sure Thunderbird 3.1b1 has 3.6.22.  Nightlies may be on 3.6.20 if they're not using the 3.1a1 mozilla-1.9.2 Thunderbird release branch.

Comment 11

[Dan Mosedale (:dmosedale, :dmose)]

3.1/1.9.2 nightlies are not using that relbranch, so presumably they are still on 3.6.20.

Comment 12

[Shawn Wilsher :sdwilsh]

Where do we stand on this?

Comment 13

[Andrew Sutherland [:asuth] (he/him)]

I am invalidating and if we need a bug to track the signature in the future it should stay in the thunderbird or mailnews products.

Comment 14

[Andrew Sutherland [:asuth] (he/him)]

er, and I'm invalidating because this just looks like heap corruption being surfaced because sqlite is on the stack using the allocator and has nothing inherently to do with sqlite or mozStorage.

Comment 15

[Daniel Veditz [:dveditz]]

I guess "wontfix" is a better branch resolution since the crash does still show up in crash-stats I believe.