297636 - crash on dnd to self-closing window [@ libc.so.6 - nsWindow::OnDragEnter() ] [@ firefox-bin - nsWindow::OnDragEnter() ]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect)

Description

[Christian Persch (GNOME) (away; not receiving bug mail)]

firefox built from cvs, 2005-06-13.

Steps to reproduce:
0) Load the testcase
1) Click on the "Test case for bug 150632" link
2) Position the popup window so that you can drag from the opening window to the
popup window
3) Drag the favicon drag handle in the location entry of the opening window to
the popup window. You have be quick so that you reach the window before it closes.

How often is this reproducible:
I manage to get this about every 2nd drag.

Result:
(Gecko:10436): Gdk-CRITICAL **: gdk_window_peek_children: assertion
`GDK_IS_WINDOW (window)' failed

(Gecko:10436): GLib-GObject-CRITICAL **: g_object_get_data: assertion
`G_IS_OBJECT (object)' failed

Program received signal SIGSEGV, Segmentation fault.
0x00000081 in ?? ()
(gdb) where
#0  0x00000081 in ?? ()
#1  0xb5cef44a in nsWindow::OnDragEnter (this=0x89372b0, aX=350, aY=62) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:2204
#2  0xb5ceea6c in nsWindow::OnDragMotionEvent (this=0x89372b0,
aWidget=0x89bf938, aDragContext=0x8096630, aX=350, aY=62, aTime=11532030,
aData=0x89372b0)
    at /opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:1964
#3  0xb5cf3eec in nsWindow::FireDragMotionTimer (this=0x89372b0) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:4137
#4  0xb5cf3f8f in nsWindow::DragMotionTimerCallback (aClosure=0x89372b0) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:4162
#5  0xb78e9200 in g_main_context_wakeup () from /usr/lib/libglib-2.0.so.0
#6  0xb78e6d0f in g_main_depth () from /usr/lib/libglib-2.0.so.0
#7  0xb78e7cb5 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#8  0xb78e7fd7 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#9  0xb78e851e in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#10 0xb7b7f10f in IA__gtk_main () at gtkmain.c:963
#11 0xb5cfb0ba in nsAppShell::Run (this=0x8217ba0) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsAppShell.cpp:139
#12 0xb5c50c12 in nsAppStartup::Run (this=0x8217690) at
/opt/source/firefox-trunk/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:144
#13 0x080573be in XRE_main (argc=1, argv=0xbffff784, aAppData=0x8072400) at
/opt/source/firefox-trunk/mozilla/toolkit/xre/nsAppRunner.cpp:2122
#14 0x0804ff6c in main (argc=1, argv=0xbffff784) at
/opt/source/firefox-trunk/mozilla/browser/app/nsBrowserApp.cpp:61

Comment 1

[Adam Guthrie]

*** Bug 254263 has been marked as a duplicate of this bug. ***

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Same happens for me with Thunderbird for several times:

Incident id: TB11798076K

Stack Signature	 libc.so.6 + 0x29a27 (0xb751ca27) 40a1107f
Product ID	Thunderbird15
Build ID	2005102519
Trigger Time	2005-11-13 12:13:36.0
Platform	LinuxIntel
Operating System	Linux 2.6.13-kanotix-8
Module	libc.so.6 + (00029a27)
URL visited	
User Comments	Message content wasn't displayed anymore when clicking on several messages in messagepane. When closing Thunderbird the crash occurs.
Since Last Crash	12 sec
Total Uptime	12 sec
Trigger Reason	SIGIOT: Abort or IOT Instruction: (signal 6)
Source File, Line No.	N/A
Stack Trace 	
libc.so.6 + 0x29a27 (0xb751ca27)
libc.so.6 + 0x2b35b (0xb751e35b)
libstdc++.so.5 + 0x91da7 (0xb76c8da7)
libstdc++.so.5 + 0x91de4 (0xb76c8de4)
libstdc++.so.5 + 0x92308 (0xb76c9308)
nsWindow::OnDragEnter()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 2207]
nsWindow::OnDragMotionEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1968]
nsWindow::FireDragMotionTimer()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4122]
nsWindow::DragMotionTimerCallback()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4146]
libglib-2.0.so.0 + 0x271d4 (0xb79ce1d4)
libglib-2.0.so.0 + 0x25421 (0xb79cc421)
libglib-2.0.so.0 + 0x28687 (0xb79cf687)
libglib-2.0.so.0 + 0x28bd8 (0xb79cfbd8)
libgtk-x11-2.0.so.0 + 0x111989 (0xb7c6d989)
nsAppShell::Run()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 848]
main()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mail/app/nsMailApp.cpp, line 63]
libc.so.6 + 0x14ec0 (0xb7507ec0)

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

This crash is really annoying. Since a couple of days I can see the following behavior for both Firefox and Thunderbird.

After working an amount of time with Firefox, the browser content isn't updated anymore. I still get a blank page or the last displayed content stays forever. Same happens in Thunderbird within the messagepane. When closing the applications in that state both are crashing.

Jay, I can't search for other current crash reports on talkback. The search function doesn't give any reports but hangs forever.

Incidents:
TB12014550K
TB12008132Y

Comment 4

[Adam Guthrie]

*** Bug 345724 has been marked as a duplicate of this bug. ***

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This is showing up as one of the top Linux crashes for Firefox2 beta2, with incidents like this:

Incident ID: 22792812
Stack Signature	firefox-bin + 0x402 (0x00d82402) 14e8c510
Product ID	Firefox2
Build ID	2006082101
Trigger Time	2006-09-01 18:56:57.0
Platform	LinuxIntel
Operating System	Linux 2.6.17-1.2174_FC5
Module	firefox-bin + (00000402)
URL visited	gmail.com friendster.com
User Comments	i've close the window with gmail and friendster page on the tabs and it crashes
Since Last Crash	8 sec
Total Uptime	8 sec
Trigger Reason	SIGIOT: Abort or IOT Instruction: (signal 6)
Source File, Line No.	N/A
Stack Trace 	
firefox-bin + 0x402 (0x00d82402)
libc.so.6 + 0x29671 (0x0087a671)
libstdc++.so.5 + 0x92617 (0x006ab617)
libstdc++.so.5 + 0x92664 (0x006ab664)
libstdc++.so.5 + 0x92ba7 (0x006abba7)
nsWindow::OnDragEnter()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 2317]
nsWindow::OnDragMotionEvent()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 2074]
nsWindow::FireDragMotionTimer()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 4236]
nsWindow::DragMotionTimerCallback()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 4263]
libglib-2.0.so.0 + 0x25876 (0x0390a876)
libglib-2.0.so.0 + 0x2515d (0x0390a15d)
libglib-2.0.so.0 + 0x283ef (0x0390d3ef)
libglib-2.0.so.0 + 0x28799 (0x0390d799)
libgtk-x11-2.0.so.0 + 0x11e634 (0x03d84634)
nsAppShell::Run()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2440]
main()  [mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x15724 (0x00866724)

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Plussing as topcrasher, not sure if it'll actually block the release, but this seems to be what we're doing with topcrashers.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Not actually a blocker, but still nice to have.

Comment 8

[Michael Wu [:mwu]]

Attachment: Cancel DnD timer when destroying window

The problem is that the drag motion timer callback is being called after the window is destroyed. This patch makes sure the timer is canceled while the window is being destroyed.

Comment 9

[Michael Wu [:mwu]]

Checking in widget/src/gtk2/nsWindow.cpp;
/cvsroot/mozilla/widget/src/gtk2/nsWindow.cpp,v  <--  nsWindow.cpp
new revision: 1.183; previous revision: 1.182
done

Comment 10

[Michael Wu [:mwu]]

Attachment: Cancel DnD timer when destroying window (branch)

Probably low risk since there's no reason for the drag timer to keep running after the window is destroyed.

Comment 11

[Mike Schroepfer]

Comment on attachment 237985 [details] [diff] [review]
Cancel DnD timer when destroying window (branch)

a=schrep for drivers for topcrash.

Comment 12

[Michael Wu [:mwu]]

Branch:
Checking in widget/src/gtk2/nsWindow.cpp;
/cvsroot/mozilla/widget/src/gtk2/nsWindow.cpp,v  <--  nsWindow.cpp
new revision: 1.145.2.7; previous revision: 1.145.2.6
done