643674 - firefox 4 crash [@ nsCookieService::HandleCorruptDB(DBState*) ] and t [@ nsCookieService::HandleCorruptDB ]

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect)

Description

[chris hofmann]

there is a new start up crash regression in 4.0 that spans all platforms that looks something like this.

1 	nsCookieService::HandleCorruptDB(DBState*)  670 windows crashes	
2 	nsCookieService::HandleCorruptDB  79 mac and linux crashes

ramp up in crashes started just after the release of beta1 on December 22 

maybe something to do with cookie changes made around then, or prior.


reports look like

https://crash-stats.mozilla.com/report/index/40b48a03-7474-4c6b-8ff8-c2bce2110317


....Signature number: 124-nsCookieService::HandleCorruptDBDBState
______ distribution of 25 different stacks, looking at top 10 frames
     17  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|nspr4.dll|PR_AssertCurrentThreadOwnsLock
0|5|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *)
0|6|xul.dll|MessageLoop::RunInternal()
0|7|xul.dll|MessageLoop::RunHandler()
0|8|mozcrt19.dll|_VEC_memzero
0|9|xul.dll|

      3  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *)
0|5|xul.dll|
0|6|xul.dll|MessageLoop::RunInternal()
0|7|xul.dll|MessageLoop::RunHandler()
0|8|mozcrt19.dll|_VEC_memzero
0|9|xul.dll|

      1  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|xul.dll|NS_IsMainThread_P()
0|5|xul.dll|nsXMLHttpRequest::Send(nsIVariant *)

      1  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|nspr4.dll|PR_GetThreadPrivate
0|5|xul.dll|nsXULWindow::ShowModal()
0|6|xul.dll|nsContentTreeOwner::ShowAsModal()
0|7|xul.dll|nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow *,char const *,char const *,char const *,int,nsIArray *,int,nsIDOMWindow * *)
0|8|xul.dll|nsWindowWatcher::OpenWindowJS(nsIDOMWindow *,char const *,char const *,char const *,int,nsIArray *,nsIDOMWindow * *)
0|9|xul.dll|nsGlobalWindow::OpenInternal(nsAString_internal const &,nsAString_internal const &,nsAString_internal const &,int,int,int,int,nsIArray *,nsISupports *,nsIPrincipal *,JSContext *,nsIDOMWindow * *)

      1  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|nspr4.dll|PR_GetThreadPrivate
0|5|xul.dll|nsXMLHttpRequest::Send(nsIVariant *)
0|6||
0|7|xul.dll|nsCycleCollectingAutoRefCnt::incr(nsISupports *)
0|8|mozjs.dll|obj_keys

      1  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|nspr4.dll|PR_AssertCurrentThreadOwnsLock
0|5|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *)
0|6|xul.dll|MessageLoop::RunInternal()
0|7|xul.dll|MessageLoop::RunHandler()
0|8|hnetcfg.dll|_saupdate_IID_Lookup
0|9|xul.dll|MessageLoop::Run()

      1  stacks like
0|0|xul.dll|nsCookieService::HandleCorruptDB(DBState *)
0|1|xul.dll|DBListenerErrorHandler::HandleError(mozIStorageError *)
0|2|xul.dll|mozilla::storage::`anonymous namespace'::ErrorNotifier::Run()
0|3|xul.dll|nsThread::ProcessNextEvent(int,int *)
0|4|nspr4.dll|PR_AssertCurrentThreadOwnsLock
0|5|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *)
0|6|xul.dll|MessageLoop::RunInternal()
0|7|xul.dll|MessageLoop::RunHandler()
0|8|comres.dll|COMResModuleInstance
0|9|xul.dll|MessageLoop::Run()

Correlation to startup or time of session
106 total crashes for nsCookieService::HandleCorruptDB on 20110320-crashdata.csv
86 startup crashes inside 30 sec.
104 startup crashes inside 3 min.
41 repeated crashes inside 3 min. of last crash

urls look like a lot of start pages and addon update checks.

domains of sites
  25 http://www.google.com
   9 http://www.facebook.com
   9 \N//
   4 jar:file://
   4 https://services.addons.mozilla.org
   4 http://co122w.col122.mail.live.com
   3 http://www.google.co.in
   3 http://google.com
   2 http://www.rambler.ru
   2 http://www.google.lt
   2 http://www.google.it
   2 http://vkontakte.ru
   2 http://home.mywebsearch.com

more reports at

Comment 1

[chris hofmann]

https://crash-stats.mozilla.com/report/list?signature=nsCookieService%3A%3AHandleCorruptDB%28DBState*%29

https://crash-stats.mozilla.com/report/list?signature=nsCookieService%3A%3AHandleCorruptDB

Comment 2

[(no longer active)]

Attachment: Patch (v1)

Comment 3

[Shawn Wilsher :sdwilsh]

Comment on attachment 522255 [details] [diff] [review]
Patch (v1)

r=sdwilsh

Comment 4

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/da46b5e30792