build ID: 20040907 on Linux & Win2k, found 3 others Talkback ID with such crash and comments which indicate it could be a regression (since 09/05 ?): http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=morkRowMap%3A%3AHash&vendor=All&product=FirefoxTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime= Steps to reproduce: 1. Focus on Location bar, 2. When drop down menu appears with the URLs history, try to remove one of them by focusing on it and hitting Shift-Delete, 3. FF crashes. morkRowMap::Hash [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkRowMap.cpp, line 133] morkAtomBodyMap::GetAtom [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkAtomMap.cpp, line 247] morkTable::CutRow [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp, line 1455] morkTable::CutRow [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp, line 699] nsFormFillController::KeyPress [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp, line 584] DispatchToInterface [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 128] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1597] nsGenericElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 1985] nsHTMLInputElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 1347] PresShell::HandleEventInternal [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 5949] PresShell::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 5801] nsViewManager::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 2252] nsViewManager::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 2026] HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 127] nsWindow::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1093] nsWindow::DispatchKeyEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3031] nsWindow::OnKeyDown [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3157] nsWindow::ProcessMessage [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3995] nsWindow::WindowProc [c:/builds/tinderbox/firefox/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1374] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x24407 (0xbff94407) 0x00cd8772

I would try a newer build. I saw this when I was running the 0907 build, but I updated to 0908 and it stopped.

20040910 build crash on Win2k.

Reproduced with Firefox 20040913/Linux-gtk2. Talkback ID: TB802194G

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040916 Firefox/0.10 happened here when i tried to remove historyitems from the google-searchbox. Below are some talkbackid's, but it seems they are not in the database? TB855833E - 09/17/04 06:54 PM TB855771H - 09/17/04 06:50 PM TB855758Z - 09/17/04 06:49 PM

Related to history delete bug #259685? I don't know if the underlying mechanism is the same, but I remember being pleasantly surprised when I could shift-del in the location bar history just like I could in form control history, so these two bugs caught my eye.

*** Bug 259685 has been marked as a duplicate of this bug. ***

Blocking flag from Asa in bug 259685.

reproduced with: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040923 Firefox/0.10

Sorry ben, no can do on this =/

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040928 Firefox/0.10

Crash. Talkback submitted. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040928 Firefox/0.10

The summary say that the crash happens in the location bar but according to bug 259685 which was duped to this one, the shift+delete crash happens in all text boxes. I also see this in the search bar and about every textbox. So I think the summary of this bug should be changed. Instead of "location bar", it should say textbox.

FWIW This bug does not manifest itself for me, location bar or forms on web pages. Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20040913 Firefox/0.10 Looking at the comments it appears to be affecting post PR1 builds. This bug caught my eye since I had just hunted down how to delete form auto completes two days ago.

(In reply to comment #13) > FWIW This bug does not manifest itself for me, location bar or forms on web pages. AFAIK it appeared on the 15th after PR1 ( it works in PR1 ), and it happens in the firefox built-in google searchbar in in web forms. Also, Shift-delete does not delete formhistory anymore ( see comments in Bug 259685 )

Shift+delete in formhistory crashes for me (and has been doing so for the past several builds...pretty much since after PR1). Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040927 Firefox/0.10 I don't think there's any debate as to whether or not this is actually a bug, it is crashing the browser on any type of formhistory.

*** Bug 262115 has been marked as a duplicate of this bug. ***

This is a topcrasher on the Firefox Aviary branch: Rank StackSignature Count 1 morkRowMap::Hash 33 Source File : d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line : 134 ==================================================================================================== Count Offset Real Signature [ 17 morkRowMap::Hash 07009552 - morkRowMap::Hash ] [ 2 morkRowMap::Hash cdee7f0c - morkRowMap::Hash ] Crash date range: 19-SEP-04 to 23-SEP-04 Min/Max Seconds since last crash: 5 - 68625 Min/Max Runtime: 18 - 82884 Count Platform List 10 Windows XP [Windows NT 5.1 build 2600] 7 Windows 2K [Windows NT 5.0 build 2195] 2 Windows 98 [Windows 98 4.10 build 67766446] Count Build Id List 8 2004091907 7 2004092207 2 2004092111 1 2004092007 1 2004091808 No of Unique Users 13 Stack trace(Frame) morkRowMap::Hash [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 134] morkRowMap::GetRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 189] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 1456] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 700] XPTC_InvokeByIndex [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp line 102] XPCWrappedNative::CallMethod [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp line 2028] XPC_WN_CallMethod [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp line 1287] js_Invoke [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 941] js_Interpret [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 2973] js_Invoke [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 958] js_InternalInvoke [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c line 1035] JS_CallFunctionValue [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c line 3698] nsJSContext::CallEventHandler [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp line 1297] nsJSEventListener::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp line 184] nsXBLPrototypeHandler::ExecuteHandler [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp line 463] nsXBLKeyEventHandler::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp line 146] nsEventListenerManager::HandleEventSubType [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 1436] nsEventListenerManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 1516] nsXULElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp line 2841] nsXULElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp line 2821] nsXULElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp line 2821] nsGenericElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp line 1912] nsHTMLInputElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp line 1399] PresShell::HandleEventInternal [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 6051] PresShell::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 5913] nsViewManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2244] nsViewManager::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2030] HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp line 79] nsWindow::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 1067] nsWindow::DispatchKeyEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 2978] nsWindow::OnKeyDown [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 3068] (956900) Comments: Attempted to remove entry from search bar autocomplete using Shift+Delete. (951256) Comments: I was trying to remove a bad address from the auto-fill list with SHIFT-DEL and the browser crashed. I'm using the nightly build from 9/22/04 and I think this is already a reported bug. (943098) Comments: Trying to delete URL search entries using Shift-Del & it crashed! (935813) Comments: I used shift-Delete to remove an entry from the URL bar history. (917410) Comments: used shift-delete to delete a URL from the drop-down history. (899863) Comments: deleting an item from the search list with shift+del (891018) URL: http://www.wikipedia.org (890440) URL: http://www.wikipedia.org (886562) Comments: deleting autocomplete from search widget ==================================================================================================== Count Offset Real Signature [ 14 morkRowMap::Hash 62a03f05 - morkRowMap::Hash ] Crash date range: 20-SEP-04 to 24-SEP-04 Min/Max Seconds since last crash: 19 - 155645 Min/Max Runtime: 153 - 155689 Count Platform List 9 Windows XP [Windows NT 5.1 build 2600] 5 Windows 2K [Windows NT 5.0 build 2195] Count Build Id List 8 2004091907 3 2004092207 1 2004092308 1 2004092111 1 2004092007 No of Unique Users 11 Stack trace(Frame) morkRowMap::Hash [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 134] morkRowMap::GetRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowMap.cpp line 189] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 1456] morkTable::CutRow [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/db/mork/src/morkTable.cpp line 700] nsFormFillController::KeyPress [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp line 584] DispatchToInterface [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 127] nsEventListenerManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp line 1524] nsGenericElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp line 1960] nsHTMLInputElement::HandleDOMEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp line 1399] PresShell::HandleEventInternal [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 6051] PresShell::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp line 5913] nsViewManager::HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2244] nsViewManager::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp line 2030] HandleEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp line 79] nsWindow::DispatchEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 1067] nsWindow::DispatchKeyEvent [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 2978] nsWindow::OnKeyDown [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp line 3068] (966427) Comments: attempting to delete an item from a form autocomplete (966406) Comments: attempting to delete from form autocomplete popup (960150) Comments: Shift+Delete-ing a saved form entry; this is reproducable (939370) Comments: I tried to delete an autocomplete entry

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041001 Firefox/0.10: Not crashing when deleting from the "Location Bar", but steel crashing when trying to delete textbox autocomplite entrie...

(In reply to comment #18) > Not crashing when deleting from the "Location Bar", but steel crashing when > trying to delete textbox autocomplite entrie... that's true. I did mention this in Comment #14 ( requesting summary change )

Traced the source code and found a bug in nsAutoCompleteMdbResult::RemoveValueAt(). The row pointer is being used after it has been removed from the collection. This patch reorders the calls so that the pointer is deleted later. I've tested the patch on my pc and no longer get these crashes.

Comment on attachment 160838 [details] [diff] [review] row being removed too early - should be after CutRow() call Forwarding review? to someone who's reviewed changes here before (and has made patches here, too)... If you just set the review flag to review? without setting a requestee, your patch will wait and wait and wait and wait and rot for all eternity. You'll want to set a requestee in the future. ;-)

Comment on attachment 160838 [details] [diff] [review] row being removed too early - should be after CutRow() call good catch.

checked in on trunk (waiting on branch approval)

Comment on attachment 160838 [details] [diff] [review] row being removed too early - should be after CutRow() call a=asa for aviary checkin.

Woohoo! Verified using a 20041004 branch build.