711914 - Fetching bookmarks information during onBeforeItemRemove may break the bookmarks cache

Status: RESOLVED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[Usman Latif]

Attachment: test.js

User Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7

Steps to reproduce:

I called removeFolderChildren on a folder that contained a child folder. The child folder contained a single bookmark.

Note: This bug reports the same issue as Bug 675416. The fix for bug 675416 is not comprehensive and fails in some cases.


Actual results:


After deleting the parent folder I was able to retrieve the information of the child folder. 

It is also possible to create additional bookmarks so that one of the new bookmarks reuses the id of the deleted folder and the bookmark service returns the information of the deleted folder in place of the newly created bookmark.



Expected results:

Firefox should have thrown an exception instead.

Comment 1

[Marco Bonardo [:mak]]

thanks for filing the bug, taking to check what happens.

Comment 2

[Marco Bonardo [:mak]]

Attachment: patch v1.0

The bug is caused by the calling order in the internal loop of RemoveFolderchildren. We can't change ordering in that loop since it may cause unwanted regressions. So I decided than rather than addressing each single possible failure point it's better to increase checks on the cache.
This makes the cache stronger by tracking items in the critical path, while registered they won't be added to the cache. Also asserts that each END has a corresponding BEGIN by checking the hash contents.

Comment 3

[Marco Bonardo [:mak]]

Ps: the existing assertion was catching this failure, but we didn't have a test leveraging that path. That's why I think this different approach is better, it enforces the condition.

Comment 4

[Marco Bonardo [:mak]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3c371703da3c

Comment 5

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/3c371703da3c