Closed Bug 784643 Opened 12 years ago Closed 11 years ago

Intermittent crash in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul, browser_bug581253.js, test_update.js [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex]

Categories

(Toolkit :: Storage, defect)

Product:
Toolkit
Component:
Storage
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: emorley, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

+++ This bug was initially created as a clone of Bug #734796 +++

(Out of room in the summary)

https://tbpl.mozilla.org/php/getParsedLog.php?id=14590837&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=14753999&tree=Mozilla-Inbound
Summary: Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js → Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js
https://tbpl.mozilla.org/php/getParsedLog.php?id=15544530&tree=Mozilla-Inbound
Summary: Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js → Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js
https://tbpl.mozilla.org/php/getParsedLog.php?id=15602060&tree=Mozilla-Inbound
Summary: Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js → Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js
https://tbpl.mozilla.org/php/getParsedLog.php?id=15769970&tree=Mozilla-Inbound
Summary: Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js → Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul
Whiteboard: [orange]
Crash Signature: [@ sqlite3VdbeParameterIndex] [@ mozilla::storage::Statement::GetParameterIndex] → [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex] [@ mozilla::storage::Statement::GetParameterIndex]
Summary: Intermittent sqlite crash [@ sqlite3VdbeParameterIndex][@ mozilla::storage::Statement::GetParameterIndex] in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul → Intermittent crash in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex]
Marco, please can you take a look at this, it's quite high up the top-oranges list.
Flags: needinfo?(mak77)
So looks like we crash here:

SQLITE_PRIVATE int sqlite3VdbeParameterIndex(Vdbe *p, const char *zName, int nName){
  int i;
  if( p==0 ){
    return 0;
  }
  if( zName ){
    for(i=0; i<p->nzVar; i++){
      const char *z = p->azVar[i];
      if( z && memcmp(z,zName,nName)==0 && z[nName]==0 ){    <====

out code doesn't seem to do anything particularly bad regarding the string

439   if (!mDBStatement)
440     return NS_ERROR_NOT_INITIALIZED;
441 
442   // We do not accept any forms of names other than ":name", but we need to add
443   // the colon for SQLite.
444   nsAutoCString name(":");
445   name.Append(aName);
446   int ind = ::sqlite3_bind_parameter_index(mDBStatement, name.get());

Maybe Neil, who knows strings internal much better than me, has some idea.
Flags: needinfo?(mak77) → needinfo?(neil)
the nName parameter is calculated by sqlite3Strlen30(zName)

SQLITE_PRIVATE int sqlite3Strlen30(const char *z){
  const char *z2 = z;
  if( z==0 ) return 0;
  while( *z2 ){ z2++; }
  return 0x3fffffff & (int)(z2 - z);
}
zName can't be nullptr for two reasons, a) .get() on an ns(Auto)CString can never return nullptr, and b) sqlite was able to query the length of the string.

p is mDBStatement, which is known not to be null, and very unlikely to be pointing into deleted memory, because we null out mDBStatement after finalising it.

I can't see how azVar can point to deleted memory either, as sqlite3_prepare only returns the statement if the parse succeeds.

So I'm afraid I have to draw a blank.

I do have a linux64 build, so I could in theory run the failing test repeatedly in case it crashes locally, if someone can tell me the appropriate python command (or make command, if you insist) to run the test under gdb.
Flags: needinfo?(neil)
I think 
./mach xpcshell-test --debug --interactive path_to_test
should do the job
I suppose our current autostring implementation warranties a flat string, right?

The only thing I may think about is some compiler optimization generating "random" bad code
(In reply to Marco Bonardo from comment #57)
> I think 
> ./mach xpcshell-test --debug --interactive path_to_test
> should do the job

Did I say mach? No, I did not.

(In reply to Marco Bonardo from comment #58)
> I suppose our current autostring implementation warranties a flat string, right?
.get() only works on flat strings!

> The only thing I may think about is some compiler optimization generating
> "random" bad code
Well, certainly the stack doesn't show the call to sqlite3_bind_parameter_index, so something got "optimised"... of course, if that means it doesn't fail in debug builds, then I would presumably have to make (or mach) an opt build...
(In reply to neil@parkwaycc.co.uk from comment #59)
> (In reply to Marco Bonardo from comment #57)
> > I think 
> > ./mach xpcshell-test --debug --interactive path_to_test
> > should do the job
> 
> Did I say mach? No, I did not.

Well you're going to have to get used to it soon mr grumpy :P
https://tbpl.mozilla.org/php/getParsedLog.php?id=17655114&tree=Mozilla-Inbound
Summary: Intermittent crash in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex] → Intermittent crash in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul, browser_bug581253.js [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex]
Blocks: 824029
Summary: Intermittent crash in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul, browser_bug581253.js [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex] → Intermittent crash in test_update_strictcompat.js, test_tags.js, browser_bookmarksProperties.js, test_bug335238.js, test_bug631374_tags_selector_scroll.xul, browser_bug581253.js, test_update.js [@ libc-2.11.so@0x80f9c | sqlite3VdbeParameterIndex]
(OrangeWFM bugs not modified in > 2 months)
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.