235453 - crash after closing "Save as" for closed page [@ nsContentTreeOwner::SetBlurSuppression]

Status: RESOLVED DUPLICATE of bug 366828

(Core :: DOM: Navigation, defect)

Description

[Arne Vogel]

User-Agent:       
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040206

When the "Save as" dialog appears for a page that was already closed, pressing
any of the two buttons will crash the browser.

This is IMHO very bad since the "Save as" dialog may take some time to appear,
which may look like it didn't succeed, and also because the keys S and W are so
close to each other on western PC keyboards, which means that a slip of the
finger can produce the Ctrl+S, Ctrl+W sequence for "Save As", "Close tab" rsp.
"Close" instead of either Ctrl+S or Ctrl+W.

Hint: Mozilla Firefox 0.8 seems unaffected.


Reproducible: Always
Steps to Reproduce:
1. Issue "Save as" on any web page.
2. Close the tab/window before the "Save as" file selection dialog appears.
3. Wait for the file selection dialog to pop up.
4. Select "Save" or "Cancel".

Actual Results:  
Browser crashes, and all windows disappear.

Expected Results:  
Normal operation continues.

gdb reported (no debugging symbols in executable) a SIGSEGV in thread 16384
(which is the first thread for which a [New Thread...] message was displayed),
module /usr/lib/mozilla/components/libnsappshell.so.

Comment 1

[Boris Zbarsky [:bzbarsky]]

> 2. Close the tab/window before the "Save as" file selection dialog appears.

I can't seem to manage to do this....  If I close the window before the
filepicker comes up, it just never comes up.

Comment 2

[basic]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040225

confirmed. If you do a "save as", focus the window you did the "save as" from,
press ctrl-w. click cancel on the "save as". --> crash.

Trace below:

#0  0x414e711f in nsChromeTreeOwner::SetBlurSuppression(int) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libnsappshell.so
#1  0x409f431d in XPTC_InvokeByIndex ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/libxpcom.so
#2  0x412245f1 in XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so
#3  0x4122aabe in XPC_WN_GetterSetter(JSContext*, JSObject*, unsigned, long*,
long*) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so
#4  0x4004bd75 in js_Invoke () from ./libmozjs.so
#5  0x4004c1b1 in js_InternalInvoke () from ./libmozjs.so
#6  0x4004c27c in js_InternalGetOrSet () from ./libmozjs.so
#7  0x40061d41 in js_SetProperty () from ./libmozjs.so
#8  0x40054444 in js_Interpret () from ./libmozjs.so
#9  0x4004be80 in js_Invoke () from ./libmozjs.so
#10 0x4121f5b3 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned
short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so
---Type <return> to continue, or q <return> to quit---
#11 0x4121b6b1 in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo
const*, nsXPTCMiniVariant*) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so
#12 0x409f44c4 in PrepareAndDispatch ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/libxpcom.so
#13 0x409f431d in XPTC_InvokeByIndex ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/libxpcom.so
#14 0x412245f1 in XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so
#15 0x4122a9a0 in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*,
long*) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so
#16 0x4004bd75 in js_Invoke () from ./libmozjs.so
#17 0x40050ba0 in js_Interpret () from ./libmozjs.so
#18 0x4004be80 in js_Invoke () from ./libmozjs.so
#19 0x4121f5b3 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned
short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) ()
   from /mnt/build/mozilla/obj-seamonkey/dist/bin/components/libxpconnect.so

Comment 3

[basic]

Attachment: another trace

here's another trace from a debug build

Comment 4

[basic]

I suspect this bug is related to some of the bugs below, specially bug 99728:

a fix for this will probably come from bug 160621 or bug 224454

bug 53476 parent menus accessible from Keyboard while modal dialog is up
bug 55472 modal dialog parent has active min/max/close widgets [linux]
bug 99728 Modal dialogs do not block keyboard events (only mouse events)
bug 160621 gtk2 should use nsIWidget::Enable() for modality, not window groups
bug 224454 Prompts should not be application modal but just window modal

Comment 5

[hahn]

i am observing a (probably) related bug on mozilla 2004060706, always reproducible:

1. click on a link to a pdf
2. in the "opening... what should mozilla do"-dialog, choose save as, click ok
3. after the save as dialog pops up, click "cancel" in the "opening... what
should mozilla do"-dialog, which is still open
4. click cancel in the "save as" dialog
5. crash

see talkback id TB82254M

Comment 6

[Bill Nottingham]

Attachment: Another crash traceback, similar to the first one posted

Here's a traceback from a 1.7 build under Fedora Core 2+, built with gcc-3.4,
when doing a save-to-disk.

It more-or-less matches the first one in the list (crash in
SetBlurSuppression).

Comment 7

[Bill Nottingham]

Related to bug 232497?

Comment 8

[Robin Monks]

Switiching to core in expectation of exact dupes from other products.

Comment 9

[Robin Monks]

Moving QA to correct bug. Adding keywords.

Comment 10

[Robin Monks]

*** Bug 234560 has been marked as a duplicate of this bug. ***

Comment 11

[Robin Monks]

*** Bug 269595 has been marked as a duplicate of this bug. ***

Comment 12

[Mats Palmgren (inactive)]

It was fixed on trunk by bug 366828.