276193 - unreproducable linux clipboard Crash after locking up, form/textentry-related? [@ 0x00000001 - libgobject-2.0.so.0 + 0x1b9b2 (0x405569b2)]

Status: RESOLVED INCOMPLETE

(Core :: Widget: Gtk, defect)

Description

[[e-mail]]

This is an erratic crash that occurs randomly - sometimes not for two weeks
sometimes two times a day. There are several situations I remember:
*) typing text in a textarea field in a form, then clocking on the scrollbar of
the FF window.
*) opening several tabs in rapit succession, then clicking on the menu bar
(while a page with a form is shown?)

In general, I seem to remember that FF showed the busy clock cursor doing
something that should not really lock it up: opening tabs or entering text in a
textarea field. When that happens, I usually continue to type or click,
expecting these events to get stuffed in a queue and be processed whenever FF
comes back. But sometimes in such situations, FF will crash instead.

I have a couple of TBs sent on this, but I do not know how to  find these IDs
when the TB manager is not active, nor do I know how to start it by hand - if
anyone tell me I will post the IDs here.

Comment 1

[[e-mail]]

Ahh found out myself: here are the latest 65 TB ids, all from the same day and
all with certainty related to this bug. I have a lot more, but would not be able
to tell with certainty whether they are really the same bug:

TB2758918K, TB2758574M, TB2758466K, TB2752545E, TB2750853E

Comment 2

[[e-mail]]

> Ahh found out myself: here are the latest 65 TB ids
That should read "5 TB ids" of course.

Comment 3

[Nickolay_Ponomarev]

All but two have no stack trace.

TB2750853E [@ XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode)()]
TB2758466K [@0x00000001]

Comment 4

[[e-mail]]

Just crashed again: I was posting something to MozillaZine, typing into the
reply textarea. Then I opened a new tab. The odd thing is that after the new tab
was shown, the busy clock cursor did not go away. So I started typing into the
url bar "blindly" ... usually, after the busy clock cursor goes away the url bar
will be filled from the event queue, but in this case FF crashed. The talkback
program came up automatically and I submitted talkback id TB2792890H

Comment 5

[Nickolay_Ponomarev]

No stack trace. Look at it yourself:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2792890H

Comment 6

[[e-mail]]

(In reply to comment #5)
> No stack trace. Look at it yourself:
>
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2792890H

Yes, just saw it. It is a segmentation fault - why is there no stack trace? Is
there a way to produce one - I thought there would be one each time FF
segfaults? This is a crash that seems to occur randomly - I immediately try to
go through exactly the same steps and there was no crash. On the other hand it
does seem to occur with a reliable statistic regularity when I type in a form,
open a new tab and type or click while the busy clock icon is showing.

Comment 7

[[e-mail]]

Yet another one: TB2795793Q - again, no stacktrace.
This looks more and more like a problem related to timing when opening a new
tab: this time a simply opened a new tab and clicked in the url bar, again while
the busy clock icon was showing and FF crashed shortly after. 

Comment 8

[[e-mail]]

Last one for a while: in order to make sure that no extension is involved I
renamed both the chrome and extensions directories in the profile. Then I did
some wild clicking again: once FF showed the busy cursor after opening a new tab
I clicked ahead ... in the url entry field, the tab bar, the menu bar and all
over again. FF got totally unresponsive (not repainting the window any more when
I moved it over the screen) and promptly crashed. Talkback ID is TB2796532W. 

Comment 9

[timeless]

Incident ID: 2796532
Stack Signature	0x00000001 151a268a
Product ID	Firefox10
Build ID	2004110712
Trigger Time	2004-12-28 16:09:19.0
Platform	LinuxIntel
Operating System	Linux 2.6.8-24.5-default
Module	
URL visited	
User Comments	
Since Last Crash	0 sec
Total Uptime	318 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
0x00000001
libgobject-2.0.so.0 + 0x1b9b2 (0x405569b2)
libgtk-x11-2.0.so.0 + 0x20fd64 (0x403a0d64)
DispatchSelectionNotifyEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsClipboard.cpp,
line 743]
wait_for_retrieval() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsClipboard.cpp,
line 831]
wait_for_contents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsClipboard.cpp,
line 875]
nsClipboard::GetTargets() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsClipboard.cpp,
line 435]
nsClipboard::HasDataMatchingFlavors() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsClipboard.cpp,
line 364]
nsPlaintextEditor::CanPaste() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp,
line 488]
nsPasteCommand::IsCommandEnabled() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/editor/libeditor/base/nsEditorCommands.cpp,
line 710]
nsControllerCommandTable::IsCommandEnabled() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/embedding/components/commandhandler/src/nsControllerCommandTable.cpp,
line 710]
nsBaseCommandController::IsCommandEnabled() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp,
line 118]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2033]
XPC_WN_CallMethod() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 2978]
js_Invoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_InternalInvoke() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 1036]
JS_CallFunctionValue() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsapi.c,
line 3698]
nsJSContext::CallEventHandler() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1296]
nsJSEventListener::HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 177]
nsEventListenerManager::HandleEventSubType() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1436]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1529]
nsXULElement::HandleDOMEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
nsXULCommandDispatcher::UpdateCommands() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/xul/document/src/nsXULCommandDispatcher.cpp,
line 376]
GlobalWindowImpl::UpdateCommands() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 3788]
nsFocusController::UpdateCommands() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsFocusController.cpp,
line 710]
nsFocusController::SetSuppressFocus() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsFocusController.cpp,
line 119]
nsDocShell::SetupNewViewer() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 710]
nsDocShell::Embed() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 692]
nsDocShell::CreateContentViewer() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 704]
nsDSURIContentListener::DoContent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDSURIContentListener.cpp,
line 110]
nsDocumentOpenInfo::TryContentListener() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 725]
nsDocumentOpenInfo::DispatchContent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 704]
nsDocumentOpenInfo::OnStartRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 322]
nsHttpChannel::CallOnStartRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 640]
nsHttpChannel::ProcessNormal() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 777]
nsHttpChannel::ProcessResponse() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 713]
nsInputStreamPump::OnStateStart() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 381]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 340]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 395]
event_processor_callback() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x4ad5f (0x405c3d5f)
libglib-2.0.so.0 + 0x23d17 (0x4059cd17)
libglib-2.0.so.0 + 0x26467 (0x4059f467)
libglib-2.0.so.0 + 0x27677 (0x405a0677)
libgtk-x11-2.0.so.0 + 0x111e43 (0x402a2e43)
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 144]
nsAppShellService::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
xre_main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 692]
main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 59]
libc.so.6 + 0x14b14 (0x4097bb14)

Comment 10

[Christopher Blizzard (:blizzard)]

Probably the code that turns async clipboard events on linux into the sync api
that mozilla expects.

Comment 11

[whorfin]

Same stack trace [and sometimes no stacktrace, ie clobbered stack].
For me the symptoms are:
I'm doing nothing in firefox, i'm using something else; typically
a text editor or reading mail in thunderbird.  I move the mouse
over firefox because i'm just about to type something, and blammo.
TB36117393K, TB36145851W, TB36270225E, TB36355053M, TB36390758Q are
from the past week on one linux box.

Comment 12

[Karl Tomlinson (:karlt)]

This may have been caused by the same issue as bug 451341.
If so, it would now be fixed.

Comment 13

[Jesse Ruderman]

This bug got fairly messy, and at least one of the crashes might have been bug 451341.  Please file a new bug report if you're still hitting crashes.