994344 - crash in mozilla::net::Seer::GetDBFileSize()

Status: VERIFIED FIXED

(Core :: Networking, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-deb9481b-2782-4bd4-8924-7ae872140409.
=============================================================

Spun off of https://bugzilla.mozilla.org/show_bug.cgi?id=987248#c10

This is affecting Fx29, 30, and 31, mostly on Windows XP and Windows 7. It seems to be a startup crash, and most of the reports are in Fx29. 

More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Anet%3A%3ASeer%3A%3AGetDBFileSize%28%29

Signature 	mozilla::net::Seer::GetDBFileSize() More Reports Search
UUID 	deb9481b-2782-4bd4-8924-7ae872140409
Date Processed	2014-04-09 18:22:06.078519
Uptime	36
Last Crash	51 seconds before submission
Install Age 	1020569 since version was first installed.
Install Time 	2014-03-28 22:52:17
Product 	Firefox
Version 	29.0
Build ID 	20140318013849
Release Channel 	beta
OS 	Windows NT
OS Version 	5.1.2600 Service Pack 3
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 15 stepping 13 | 2
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 	0x0
Email Address 	
URL 	
Exploitability 	ERROR: dump not analyzed
User Comments 	
App Notes 	

AdapterVendorID: 0x8086, AdapterDeviceID: 0x2772, AdapterSubsysID: 72671462, AdapterDriverVersion: 6.14.10.4926

Processor Notes 	sp-processor03_phx1_mozilla_com.18278:2012; HybridCrashProcessor

EMCheckCompatibility 	
True

Adapter Vendor ID 	
0x8086

Adapter Device ID 	
0x2772

Total Virtual Memory 	
2147352576

Available Virtual Memory 	
1921622016

System Memory Use Percentage 	
89

Available Page File 	
618881024

Available Physical Memory 	
54394880

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::net::Seer::GetDBFileSize() 	netwerk/base/src/Seer.cpp
1 	xul.dll 	mozilla::net::Seer::MaybeScheduleCleanup() 	netwerk/base/src/Seer.cpp
2 	xul.dll 	mozilla::net::SeerPredictionEvent::Run() 	netwerk/base/src/Seer.cpp
3 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
4 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	xpcom/glue/nsThreadUtils.cpp
5 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate *) 	ipc/glue/MessagePump.cpp
6 	xul.dll 	_SEH_epilog4 	
7 		@0x8dfff68 	
8 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
9 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
10 	msvcr100.dll 	_callthreadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c
11 	msvcr100.dll 	_threadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c
12 	kernel32.dll 	BaseThreadStart

Comment 1

[Marco Bonardo [:mak] (Away Apr 25 - May 5)]

looks like you should null-check mDB, if opening failed (maybe due to a corrupted db) it would be nullptr.
little OT: instead of manually handling transactions, in some case you should use mozStorageTransaction (that automatically commits or rollbacks when going out of scope), so you don't risk to leave a dangling open transaction around (that'd be really bad cause makes your journal grow indefinitely)

Comment 2

[Robert Kaiser]

This is one of the notable regressions from 28 beta to 29 beta, so nominating for tracking.

Comment 3

[u408661]

Attachment: patch

Patch to ensure we have a db AND the tables exist (so we don't end up with sql errors, either).

https://tbpl.mozilla.org/?tree=Try&rev=4282529c788f

Comment 4

[u408661]

Thanks, Patrick. Try looks good, just waiting for trees to open.

Comment 5

[u408661]

Setting checkin-needed, in case a sheriff can get to this before I finally find a time when trees are open.

Comment 6

[Patrick McManus [:mcmanus]]

   https://hg.mozilla.org/integration/mozilla-inbound/rev/4fffea7451ba

merry christmas

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Nicholas, could you fill the uplift request today ? (Monday) Beta 8 is going to build today. Thanks

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4fffea7451ba

Comment 9

[u408661]

Comment on attachment 8404861 [details] [diff] [review]
patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 881804
User impact if declined: Crashes as in bug description
Testing completed (on m-c, etc.): On m-c
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch: none

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/3be2814c6897
https://hg.mozilla.org/releases/mozilla-beta/rev/e24aafe4dffd

Comment 11

[Ioana (away)]

Socorro doesn't show this crash on any builds post 04/15:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3ASeer%3A%3AGetDBFileSize%28%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&version=Firefox%3A31.0a1&version=Firefox%3A30.0a2&version=Firefox%3A29.0b&version=Firefox%3A28.0&hang_type=any&date=2014-04-22+09%3A00%3A00&range_value=4#tab-reports