205492 - Browser crashes as it loads the URL [@ nsWindow::NativeCreate]

Status: RESOLVED FIXED

(Core Graveyard :: GFX: Gtk, defect)

Description

[Gavrila]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.1; Linux)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030430 Debian/1.3-5

The browser crashes while it's loading the page http://www.gabibbiesaltati.cjb.net/ 

Reproducible: Always

Steps to Reproduce:
1. Load URL http://www.gabibbiesaltati.cjb.net/		 
2. 
3. 
Actual Results:  
browser crashed		 

Expected Results:  
loaded successfully the page 

It crashes on Galeon too, so I think it's an engine issue

Comment 1

[Gavrila]

that url is successfully loaded on konqueror browser 

Comment 2

[Matthias Versen [:Matti]]

wfm with win2k build 20030512..

Reporter:
Please try it again with 1.4b because your build is to old (we accept only bugs
from the latest milestone) and please use a mozilla.org build and not a debian
one. (they add their own patches in their builds and we don't accept such bugs
until you can reproduce this with a mozilla.org build)

Comment 3

[Gavrila]

Tried it with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

Same result.... the page loads a bit then mozilla crashes without reporting
anything.

Comment 4

[Greg K.]

WorksForMe using FizzillaMach/2003-05-07-14-1.4b. Gavrila, does TalkBack run
after these crashes? If so, please provide a representative incident ID.

Comment 5

[Mitch]

Confirmed. Crashes for me too on Linux with mozilla cvs 20030512.
Stripped stack below. Anyone have a debug build to do a proper stack ?
Possibly only a gtk2 problem. Can someone confirm/deny with a gtk1 build ?

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 688)]
0x412b300e in nsWindow::NativeCreate ()
   from /usr/local/mozilla/components/libwidget_gtk2.so
(gdb) bt
#0  0x412b300e in nsWindow::NativeCreate ()
   from /usr/local/mozilla/components/libwidget_gtk2.so
#1  0x412af1ce in nsWindow::Create ()
   from /usr/local/mozilla/components/libwidget_gtk2.so
#2  0x40f96aaa in NSGetModule ()
   from /usr/local/mozilla/components/libgklayout.so
#3  0x40d7800b in NSGetModule ()
   from /usr/local/mozilla/components/libgklayout.so
#4  0x40d7576f in NSGetModule ()
   from /usr/local/mozilla/components/libgklayout.so
#5  0x40d74ed7 in NSGetModule ()
   from /usr/local/mozilla/components/libgklayout.so
#6  0x41220ced in NSGetModule ()
   from /usr/local/mozilla/components/libdocshell.so
#7  0x4121e76e in NSGetModule ()
   from /usr/local/mozilla/components/libdocshell.so
#8  0x4121fa3f in NSGetModule ()
   from /usr/local/mozilla/components/libdocshell.so
#9  0x41231c9a in NSGetModule ()
   from /usr/local/mozilla/components/libdocshell.so
#10 0x41235fca in NSGetModule ()
   from /usr/local/mozilla/components/libdocshell.so
#11 0x41235456 in NSGetModule ()
   from /usr/local/mozilla/components/libdocshell.so
#12 0x40b3c052 in NSGetModule () from /usr/local/mozilla/components/libnecko.so

etc...

Comment 6

[Andrew Schultz]

Attachment: stacktrace

stacktrace from gtk2/CVS.  worksforme with gtk1

Comment 7

[Andrew Schultz]

==> gtk

Comment 8

[Christopher Blizzard (:blizzard)]

Hey, something that crashes for me for a change.  Check that out.

Comment 9

[Mitch]

Anyone looking at this ? Still crashes with cvs 20030610.

Comment 10

[Brian Ryner (not reading)]

I'm also seeing this, on the following URL:

http://sports.espn.go.com/mlb/playoffs2003/news/story?id=1635910

The cause of the crash itself is that gtk2's nsWindow isn't prepared for being
initialized as a child window, but with no parent nsIWidget.  We could
bulletproof it a bit there, but this should probably not be happening at all.

I think part of the problem might be what happens in nsView::CreateWidget(). 
GetOffsetFromWidget() is failing to fill in |parent| with a valid nsIWidget. 
roc, any idea what that means?

Comment 11

[Andrew Schultz]

*** Bug 221747 has been marked as a duplicate of this bug. ***

Comment 12

[Robert O'Callahan (:roc) (email my personal email if necessary)]

GetOffsetFromWidget() just walks the view tree looking for a view with a widget.
If it's not finding a widget, then I guess there's no view with a widget...

Comment 13

[Brian Ryner (not reading)]

Is the root view supposed to have a widget?

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yes, it always should.

Comment 15

[Christopher Blizzard (:blizzard)]

*ahem*

Comment 16

[Christopher Blizzard (:blizzard)]

Anyone have any ideas?

Comment 17

[Christopher Blizzard (:blizzard)]

*** Bug 222061 has been marked as a duplicate of this bug. ***

Comment 18

[Christopher Blizzard (:blizzard)]

*** Bug 224383 has been marked as a duplicate of this bug. ***

Comment 19

[Christopher Blizzard (:blizzard)]

*** Bug 225130 has been marked as a duplicate of this bug. ***

Comment 20

[Christopher Blizzard (:blizzard)]

Attachment: wallpaper patch

This patch papers over the problem.

Comment 21

[Christopher Blizzard (:blizzard)]

Comment on attachment 136725 [details] [diff] [review]
wallpaper patch

Easy crasher fix.

Comment 22

[chris hofmann]

Comment on attachment 136725 [details] [diff] [review]
wallpaper patch

a=chofmann for 1.6

Comment 23

[Christopher Blizzard (:blizzard)]

Checked in.  Should take this for 1.4.2, too.

Comment 24

[Mike Kaply [:mkaply]]

Comment on attachment 136725 [details] [diff] [review]
wallpaper patch

a=mkaply for 1.4.2

Comment 25

[Christopher Blizzard (:blizzard)]

Fixed on the 1.4 branch before 1.4.2.

Comment 26

[Olivier Cahagne]

*** Bug 230748 has been marked as a duplicate of this bug. ***

Comment 27

[Malcolm Rowe]

*** Bug 230879 has been marked as a duplicate of this bug. ***

Comment 28

[Gavrila]

Attachment: Strace of the crash

Still crashing with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5)
Gecko/20040112 Firebird/0.7 on gentoo gnu/linux. Attached the strace (opened
the program, pasted the url and presssed enter)

Comment 29

[Mitch]

Gavrila, strace is useless. Please provide a debugging stack from
the crash 

  http://www.mozilla.org/unix/debugging-faq.html

Also, i've just tried it with Firebird and no crash, so the crash
you are seeing is probably unrealted. But we can't tell until you 
provide a good debug stack.

Comment 30

[Gavrila]

Attachment: Crash debug

Tnx for the faq... I followed them and obtained this one attached.

Regards

Comment 31

[Jungshik Shin]

What we need is the stack __back trace__. Please, do the following:

 1. build a debug build, which you apparently already did.
 2. run it as you usually do (you don't have to run it inside a gdb)
 3. when your debug build crashes, you'll get an instruction like
    'gdb <mozilla/firebird_binary_path> <process_id>'  (where <process_id> is a
number)
 4. copy & paste it and run the command.
 5. At gdb, run 'bt' (back trace) and attach the output here. 

Comment 32

[Gavrila]

Attachment: Stack Backtrace

Here it is the backtrace of the stack. I hope I have done things well this
time:)