681795 - Crash [@ __CFStringCreateImmutableFunnel3 ] [@ CoreFoundation@0x2ac0 ] while moving bookmarks

Status: RESOLVED DUPLICATE of bug 673301

(Core :: Widget: Cocoa, defect)

Description

[Scoobidiver (away)]

It is a new crash signature in 7.0 and is #5 top crasher in 7.0b1 on Mac OS X and #1 top crasher without Mac OS X Lion crashes.

Comments are all about moving bookmarks

Signature	__CFStringCreateImmutableFunnel3
UUID	9436aea7-0359-4be6-8ff3-a4bc42110822
Date Processed	2011-08-22 05:32:46.486453
Uptime	863
Last Crash	1.8 hours before submission
Install Age	3.7 days since version was first installed.
Install Time	2011-08-18 20:21:47
Product	Firefox
Version	7.0
Build ID	20110816154714
Release Channel	beta
OS	Mac OS X
OS Version	10.5.8 9L31a
CPU	x86
CPU Info	family 6 model 23 stepping 6
Crash Reason	EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash Address	0x0
User Comments	Sooooo many crashes today!!!!
App Notes 	Renderers: 0x24200,0x20400

Frame 	Module 	Signature [Expand] 	Source
0 	CoreFoundation 	__CFStringCreateImmutableFunnel3 	
1 	CoreFoundation 	CFStringCreateWithCharacters 	
2 	Foundation 	-[NSPlaceholderString initWithCharacters:length:] 	
3 	Foundation 	+[NSString stringWithCharacters:length:] 	
4 	XUL 	nsClipboard::PasteboardDictFromTransferable 	widget/src/cocoa/nsClipboard.mm:428
5 	XUL 	SetUpDragClipboard 	widget/src/cocoa/nsDragService.mm:122
6 	XUL 	nsDragService::InvokeDragSession 	widget/src/cocoa/nsDragService.mm:264
7 	XUL 	nsBaseDragService::InvokeDragSessionWithImage 	widget/src/xpwidgets/nsBaseDragService.cpp:286
8 	XUL 	nsEventStateManager::DoDefaultDragStart 	content/events/src/nsEventStateManager.cpp:2317
9 	XUL 	nsEventStateManager::GenerateDragGesture 	content/events/src/nsEventStateManager.cpp:2074
10 	XUL 	nsEventStateManager::PreHandleEvent 	content/events/src/nsEventStateManager.cpp:1160
11 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:7076
12 	XUL 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6923
13 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6758
14 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1053
15 	XUL 	HandleEvent 	view/src/nsView.cpp:160
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=__CFStringCreateImmutableFunnel3

Comment 1

[Marcia Knous [:marcia]]

I can reproduce this easily using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:8.0a2) Gecko/20110824 Firefox/8.0a2, although I get a bit of a different stack:

https://crash-stats.mozilla.com/report/index/bp-dfad45ea-1b69-4a9f-8d77-181a72110824

STR:
1. Install Aurora with a fresh profile.
2. Enable the Bookmarks Toolbar.'
3. Try to drag the "Latest Headlines" feed to the right with your mouse.
4. Crash.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

Please try to find a regression range.

Comment 3

[Marcia Knous [:marcia]]

From what I can see in crash stats, this likely regressed between Firefox 6 and 7.0b1, since the crashes that predominantly show in crash stats show buildID=20110816154714 which is the B1 build ID. I don't see any crashes showing up from 6.

We built 7.0b1 from http://hg.mozilla.org/releases/mozilla-beta/rev/8786e3e49240. 

We built 6.0 from http://hg.mozilla.org/releases/mozilla-beta/rev/8263a2c99c2a.

Will keep digging further.

Comment 4

[Marcia Knous [:marcia]]

I forgot to add in the last comment that this happens on both 10.6 and 10.7 according to crash stats. While I could reproduce the issue easily in Aurora I have not yet been able to crash FF 7b1.

Comment 5

[Marcia Knous [:marcia]]

I was able to reproduce the crash on 10.6 using Firefox 7 as well as Aurora following the STR in Comment 1.

Comment 6

[Onno Witvliet]

Bug 678145 looks like a duplicate of this bug.

Comment 7

[Scoobidiver (away)]

Dupe of bug 673301?

Comment 8

[Marco Bonardo [:mak]]

(In reply to Scoobidiver from comment #7)
> Dupe of bug 673301?

I think so, someone may try to repro on Firefox 9

Comment 9

[Onno Witvliet]

I have tested with:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0a1) Gecko/20110819 Firefox/9.0a1
Build from http://hg.mozilla.org/mozilla-central/rev/1881f9b5f8b5
(first Nightly that contains the fix for bug 673301).

The crash has gone!