257196 - crash on exit after installing incompatible extension [@ moz_gtk_get_widget_border() ]

Status: VERIFIED FIXED

(Core Graveyard :: GFX: Gtk, defect)

Description

[Asa Dotzler [:asa]]

After installing the incompatible extension on linux I did not get the error
warning from bug 247322 and I crash consistently on exit. Tested with the latest
branch linux build on Fedora Core 2 with the "content holder" extension.

moz_gtk_get_widget_border() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/gfx/src/gtk/gtk2drawing.c,
line 1262]
nsNativeThemeGTK::GetWidgetBorder() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/gfx/src/gtk/nsNativeThemeGTK.cpp,
line 549]
nsBox::GetBorder() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 710]
nsBox::GetBorderAndPadding() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 616]
nsBox::AddBorderAndPadding() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1442]
nsSprocketLayout::GetPrefSize() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 1326]
nsContainerBox::GetPrefSize() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 505]
nsBoxFrame::GetPrefSize() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 936]
nsSprocketLayout::GetPrefSize() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 1297]
nsContainerBox::GetPrefSize() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 505]
nsBoxFrame::GetPrefSize() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 936]
nsSprocketLayout::PopulateBoxSizes() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 784]
nsSprocketLayout::Layout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 239]
nsContainerBox::DoLayout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 710]
nsBox::Layout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1001]
nsStackLayout::Layout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsStackLayout.cpp,
line 322]
nsContainerBox::DoLayout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 710]
nsBox::Layout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1001]
nsBoxFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 868]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 252]
PresShell::InitialReflow() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 658]
nsXULDocument::StartLayout() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 2197]
nsXULDocument::ResumeWalk() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3050]
nsDocumentOpenInfo::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 540]
nsCachedChromeChannel::HandleStopLoadEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/chrome/src/nsChromeProtocolHandler.cpp,
line 692]
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 395]
event_processor_callback() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x4939f (0x002f039f)
libglib-2.0.so.0 + 0x23faa (0x002cafaa)
libglib-2.0.so.0 + 0x25068 (0x002cc068)
libglib-2.0.so.0 + 0x253a0 (0x002cc3a0)
libglib-2.0.so.0 + 0x2560d (0x002cc60d)
nsAppShell::DispatchNativeEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 279]
nsXULWindow::ShowModal() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 710]
nsContentTreeOwner::ShowAsModal() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp,
line 449]
nsWindowWatcher::OpenWindowJS() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 710]
nsWindowWatcher::OpenWindow() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 457]
nsPromptService::DoDialog() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/embedding/components/windowwatcher/src/nsPromptService.cpp,
line 626]
nsPromptService::Alert() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/embedding/components/windowwatcher/src/nsPromptService.cpp,
line 63]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2027]
XPC_WN_CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Invoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 958]
nsXPCWrappedJSClass::CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1336]
nsXPCWrappedJS::CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
PrepareAndDispatch() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp,
line 100]
nsObserverService::NotifyObservers() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/ds/nsObserverService.cpp,
line 710]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2027]
XPC_WN_CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Invoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 958]
nsXPCWrappedJSClass::CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1336]
nsXPCWrappedJS::CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
PrepareAndDispatch() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp,
line 100]
WSPAsyncProxyCreator::OnError() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/extensions/webservices/proxy/src/wspfactory.cpp,
line 151]
nsWSDLLoadRequest::HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/extensions/webservices/wsdl/src/nsWSDLLoader.cpp,
line 135]
nsXMLHttpRequest::NotifyEventListeners() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/extensions/xmlextras/base/src/nsXMLHttpRequest.cpp,
line 710]
nsXMLHttpRequest::Error() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/extensions/xmlextras/base/src/nsXMLHttpRequest.cpp,
line 1716]
nsXMLHttpRequest::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/extensions/xmlextras/base/src/nsXMLHttpRequest.cpp,
line 606]
nsHttpChannel::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 606]
nsInputStreamPump::OnStateStop() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 606]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 339]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 395]
event_processor_callback() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x4939f (0x002f039f)
libglib-2.0.so.0 + 0x23faa (0x002cafaa)
libglib-2.0.so.0 + 0x25068 (0x002cc068)
libglib-2.0.so.0 + 0x253a0 (0x002cc3a0)
libglib-2.0.so.0 + 0x259e3 (0x002cc9e3)
libgtk-x11-2.0.so.0 + 0x11fa23 (0x004fea23)
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 144]
nsAppShellService::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
xre_main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 692]
main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 59]
libc.so.6 + 0x15475 (0x00af4475)

Comment 1

[Adam Hauner]

There are over 300 incidents, the most with M1.7, many with Thunderbird, some
with Firefox:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=moz_gtk_get_widget_border

Comment 2

[chris hofmann]

asa, we think this is fixed.  can you get someone to verify.  pull the keyword
if not fixed..  thanks

Comment 3

[timeless]

*** Bug 269486 has been marked as a duplicate of this bug. ***

Comment 4

[Darin Fisher]

This is definitely not fixed.  I've been hitting this nearly every day when I
shutdown my browser (latest 1.8 branch) on Linux.

Comment 5

[Scott MacGregor]

Jay can you provide some talkback analyis on this crash to see how prevalent it
is in 1.5b1 / branch builds? 

Comment 6

[Asa Dotzler [:asa]]

This isn't showing up in topcrash data for 1.5 beta at all.

Comment 7

[Darin Fisher]

This happens whenever some code decides to launch a modal dialog after the
quit-application event.  I'm not sure why this happens every time I shutdown my
copy of Firefox (perhaps it is due to some extension).  The fix is probably
pretty trivial... just some null checks in the native widget code, or defer
native widget shutdown until xpcom-shutdown instead of quit-application.

Comment 8

[Benjamin Smedberg]

Native-widget shutdown ought to happen at xpcom-shutdown anyway, because
quit-application is not a guaranteed event in embedding situations.

Comment 9

[Darin Fisher]

Attachment: v1 patch

Here's a patch then.  I haven't had a chance to test this out thoroughly yet.

Comment 10

[Darin Fisher]

-> core

Comment 11

[Benjamin Smedberg]

Comment on attachment 195891 [details] [diff] [review]
v1 patch

r=me FWIW, I'm obviously not a widget/gfx peer

Comment 12

[Christian :Biesinger (don't email me, ping me on IRC)]

will this fix bug 244549?

Comment 13

[Darin Fisher]

fixed-on-trunk

Comment 14

[Scott MacGregor]

Comment on attachment 195891 [details] [diff] [review]
v1 patch

approving this low risk crash fix for the branch.

Comment 15

[Darin Fisher]

fixed1.8

Comment 16

[Jay Patel [:jay]]

v.fixed on trunk and branch per Talkback data.  Although there are still some
incidents for 1.0.x releases, I don't see anything on the latest trunk or branch
nightlies.

Comment 17

[Frank Yan (:fryn)]

(In reply to comment #16)
> v.fixed on trunk and branch per Talkback data.  Although there are still some
> incidents for 1.0.x releases, I don't see anything on the latest trunk or branch
> nightlies.

yeah, it still occurs on 1.0.x releases.
the xpcom running when it shouldn't be seems to be te problem, so by looking at
the code for the patch, it looks like it should fix it.

Comment 18

[Frank Yan (:fryn)]

has it been checked into the trunk and the branch.

Comment 19

[Darin Fisher]

This patch was checked in on the trunk and the mozilla1.8 branch, which means
that Firefox 1.5 will have this patch.  Firefox 1.0.x does not have the patch,
and there are no plans to fix this on the Firefox 1.0 branch.