249520 - Crash on exit when the gtkmozembed widget is created but never shown

Status: RESOLVED FIXED

(Core Graveyard :: Embedding: GTK Widget, defect)

Description

[Steven Brown]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113
Build Identifier: 

gtkmozembed calls EmbedPrivate::Destroy() even when it hasn't called
EmbedPrivate::Init(), which is wrong, and causes a null pointer dereference.
This can happen when a gtkmozembed widget has been created, but never realized.
E.g., never 'show' the widget and exit.  Crash.

The fix is to have gtkmozembed check (the same way EmbedPrivate checks) if
EmbedPrivate has been Init()ed before Destroy()ing.


Reproducible: Always
Steps to Reproduce:
1. Create but never show the gtkmozembed widget.
2. Exit.



Actual Results:  
Crash.

Expected Results:  
Not crash. :)

Comment 1

[Steven Brown]

Attachment: Patch to fix the bug.

Comment 2

[Steven Brown]

Attachment: Test case.

Minimal test of the bug.  In the real world, I encounter this bug when I have a
gtkmozembed widget on a tab of my application that the user didn't visit before
exiting.

Comment 3

[chris hofmann]

dougt might also help to get this reviewed and checked in...

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 152164 [details] [diff] [review]
Patch to fix the bug.

Brian, could you take a look, please?

Comment 5

[Steven Brown]

Btw, the same fix needs to be applied to FireFox as well, as it seems to also be
a source for gtkmozembed (I'm not familiar with how FireFox is branched, but on
a coworker's gentoo box, FireFox brought in its own gtkmozembed).

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fix checked in to the trunk.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 152164 [details] [diff] [review]
Patch to fix the bug.

I think this is worth taking on the 1.7 branch.  It's a pretty straightforward
null-check crash fix.

Comment 8

[Mike Kaply [:mkaply]]

Comment on attachment 152164 [details] [diff] [review]
Patch to fix the bug.

a=mkaply for 1.7.2

Comment 9

[Olivier Cahagne]

*** Bug 255649 has been marked as a duplicate of this bug. ***