297570 - Crash in nsMenuFrame when moving over GM Tools menu - crash [@ nsMenuFrame::IsDisabled 6fa23437 ]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jaime Mitchell (use [e-mail] for email)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050613
Firefox/1.0+ ID:2005061303

Install GM 0.3.4
Select the tools menu and move over the GM menu enteries using either the mouse
or keyboard

Firefox crashes

The stack in bug 273981 looks simular.

TB ID's TB6635514E TB6633224Y

Comment 1

[Jaime Mitchell (use [e-mail] for email)]

Talkback stack data:

Stack Signature	 nsMenuFrame::IsDisabled 6fa23437
Product ID	FirefoxTrunk
Build ID	2005061219
Trigger Time	2005-06-13 09:39:20.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00268651)
URL visited	move over tools menu
User Comments	
Since Last Crash	5124 sec
Total Uptime	12480 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1315
Stack Trace 	
nsMenuFrame::IsDisabled 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1315]
nsMenuFrame::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 499]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6409]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6189]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2502]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2224]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1173]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5801]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 6047]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1351]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 145]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Martijn Wargers (dead)]

The crash doesn't happen in 2005-06-03 trunk build, but it happens in 2005-06-04
build.
This crash happens because of the "Hide empty menus from xul.css" patch of bug
295711.

I'll attach a testcase that is derived from the GM tools menu. It has included
the css rule patch from xul.css, so this can be tested in older builds.
This testcase crashes even in Mozilla1.0

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase

Open the menu, then hover over the menuitem to trigger the crash.

Comment 4

[Benjamin Smedberg]

display:none menus don't have frames, a simple null-check is probably
sufficient, but I'm not sure about this code.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Null check on what?  The crash is in a nsMenuFrame member method (not
class-static), and the caller null-checks before making the call (that is,
nsMenuFrame::HandleEvent is only called on non-null menu frames).  So we're most
likely either making the call on a deleted object or somehow deleting the object
in the middle of the call.  Either way, a null-check won't help.

In general, changing anything in menus from the layout side (and that includes
xul.css!) is very very regression prone; at this point I'd rather we hold such
changes until Gecko alpha milestones when we have the time needed to sort out
the regressions.

Comment 6

[Benjamin Smedberg]

Boris, the DOMI-as-extension change is very important for application update and
other situations: would changing display: none to visibility: collapse be
sufficient?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Sufficient for what purpose?

Comment 8

[Benjamin Smedberg]

To prevent crashes and other misbehavior in layout while still hiding <menu>s
without a <menupopup>.

Comment 9

[Boris Zbarsky [:bzbarsky]]

My question was what you mean by "hiding".  If you mean "make the user not be
able to click on them in Windows/Linux", then probably yes.  If you mean "don't
show it on Mac", then I don't know.

Comment 10

[Benjamin Smedberg]

I've already dealt with the mac menus with code in widget/src/mac, AFAICT this
bug is present for gecko-drawn menus only.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Ah, if we're not worrying about mac, then visibility:collapse might work, yes.

Comment 12

[Benjamin Smedberg]

Attachment: Use visibility instead of display

We should test that this actually prevents the crash (which I have not
reproduced).

Comment 13

[Mike Connor [:mconnor]]

Comment on attachment 186340 [details] [diff] [review]
Use visibility instead of display

r=me

Comment 14

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 186340 [details] [diff] [review]
Use visibility instead of display

r=bzbarsky, if this gets tested and a followup filed as needed to sort out the
real underlying problem

Comment 15

[Jaime Mitchell (use [e-mail] for email)]

Applying attachment 186340 [details] [diff] [review] to a local vs7 build prevents the crash.

The last of the 3 GM menu options disapears when moving the mouse over it rather
than a crash occuring.

Thanks for the quick fix.

Comment 16

[Boris Zbarsky [:bzbarsky]]

> The last of the 3 GM menu options disapears

Hmm... why is that happening?

Comment 17

[Jaime Mitchell (use [e-mail] for email)]

To add to my rather vague comment before.

Load firefox go to tools menu there is a "manage user scripts" disabled sub
menu. Moving the mouse over this menu disapears.

Close firefox and reopen the sub menu is back and mouse over makes it disapear
again for the browser session.

Comment 18

[Benjamin Smedberg]

*** Bug 273981 has been marked as a duplicate of this bug. ***

Comment 19

[Benjamin Smedberg]

Fixed for 1.8b3 (toolkit and xpfe versions).

Comment 20

[Boris Zbarsky [:bzbarsky]]

Err... except the behavior described in comment 17 sounds very very wrong.  Do
we have a bug filed on that?  It should be blocking 1.8b3, if so.  If we don't
have a bug, could someone who can clearly describe the steps to reproduce and
resulting behavior plees file it?

Comment 21

[Martijn Wargers (dead)]

Well, this is perfectly logical: with menu:empty {visibility:collapse;} the menu
gets hidden when all the childnodes in the menu get removed.
So that last patch does exactly what it promises to do.
Like bug 295711, comment 5 said, maybe it is better to just disable the a menu
that is empty, so just do for menu:empty the same as is done here:
http://lxr.mozilla.org/seamonkey/source/toolkit/themes/winstripe/global/menu.css#60

Comment 22

[Benjamin Smedberg]

There is a crucial difference between removing all the <menuitem>s from the
<menupopup> (which is IMO a UI error, there should at least be a disabled item
with label "(Empty)" like the bookmarks UI does), and removing the <menupopup>
from the <menu>, which should act as if the menu doesn't even exist.

Comment 23

[Boris Zbarsky [:bzbarsky]]

My point is that mousing over a menuitem as in comment 17 should not cause it to
disappear.

Comment 24

[Marian POPESCU]

(In reply to comment #19)
> Fixed for 1.8b3 (toolkit and xpfe versions).

Still crashes on Linux :
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050617 Firefox/1.0+
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050618 Firefox/1.0+
Loaded the testcase and crashes when hovering the menuitem.

[root@zeus /opt/MozillaFirefox]$strace ./firefox
execve("./firefox", ["./firefox"], [/* 28 vars */]) = 0
brk(0)                                  = 0x8321000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=111100, ...}) = 0
old_mmap(NULL, 111100, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fb8000
close(3)                                = 0
open("/lib/libtermcap.so.2", O_RDONLY)  = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\33"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=12924, ...}) = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7fb7000
old_mmap(0xa21000, 14632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
= 0xa21000
old_mmap(0xa24000, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0xa24000
close(3)                                = 0
open("/lib/libdl.so.2", O_RDONLY)       = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0\254\204"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=16244, ...}) = 0
old_mmap(0x84a000, 12404, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
= 0x84a000
old_mmap(0x84c000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x84c000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\n\317p"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1489572, ...}) = 0
old_mmap(0x6f8000, 1219548, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x6f8000
old_mmap(0x81c000, 16384, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x124000) = 0x81c000
old_mmap(0x820000, 7132, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x820000
close(3)                                = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7fb6000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7fb66c0, limit:1048575,
seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0,
useable:1}) = 0
mprotect(0x84c000, 4096, PROT_READ)     = 0
mprotect(0x81c000, 8192, PROT_READ)     = 0
mprotect(0x6f0000, 4096, PROT_READ)     = 0
munmap(0xb7fb8000, 111100)              = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
open("/dev/tty", O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3
close(3)                                = 0
brk(0)                                  = 0x8321000
brk(0x8342000)                          = 0x8342000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=48558080, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7db6000
close(3)                                = 0
getuid32()                              = 0
getgid32()                              = 0
geteuid32()                             = 0
getegid32()                             = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
time(NULL)                              = 1119088478
open("/etc/mtab", O_RDONLY)             = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=709, ...}) = 0
mmap2(NULL, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7d96000
read(3, "/dev/hda17 / reiserfs rw 0 0\n/de"..., 131072) = 709
close(3)                                = 0
munmap(0xb7d96000, 131072)              = 0
open("/proc/meminfo", O_RDONLY)         = 3
fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7db5000
read(3, "MemTotal:      1035464 kB\nMemFre"..., 1024) = 670
close(3)                                = 0
munmap(0xb7db5000, 4096)                = 0
rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0
rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0
rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0
rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0
rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0
rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigaction(SIGQUIT, {SIG_IGN}, {SIG_DFL}, 8) = 0
uname({sys="Linux", node="zeus.softexpert.lan", ...}) = 0
stat64("/opt/MozillaFirefox", {st_mode=S_IFDIR|0777, st_size=1120, ...}) = 0
stat64(".", {st_mode=S_IFDIR|0777, st_size=1120, ...}) = 0
getpid()                                = 16395
open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=22294, ...}) = 0
mmap2(NULL, 22294, PROT_READ, MAP_SHARED, 3, 0) = 0xb7db0000
close(3)                                = 0
getppid()                               = 16394
getpgrp()                               = 16394
rt_sigaction(SIGCHLD, {0x807871f, [], 0}, {SIG_DFL}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
open("./firefox", O_RDONLY|O_LARGEFILE) = 3
ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfdd2c68) = -1 ENOTTY (Inappropriate
ioctl for device)
_llseek(3, 0, [0], SEEK_CUR)            = 0
read(3, "#!/bin/sh\n#\n# ***** BEGIN LICENS"..., 80) = 80
_llseek(3, 0, [0], SEEK_SET)            = 0
getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0
dup2(3, 255)                            = 255
close(3)                                = 0
fcntl64(255, F_SETFD, FD_CLOEXEC)       = 0
fcntl64(255, F_GETFL)                   = 0x8000 (flags O_RDONLY|O_LARGEFILE)
fstat64(255, {st_mode=S_IFREG|0755, st_size=5129, ...}) = 0
_llseek(255, 0, [0], SEEK_CUR)          = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(255, "#!/bin/sh\n#\n# ***** BEGIN LICENS"..., 5129) = 5129
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
pipe([3, 4])                            = 0
rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0
_llseek(255, -1680, [3449], SEEK_CUR)   = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
child_tidptr=0xb7fb6708) = 16396
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 16396
waitpid(-1, 0xbfdd22dc, WNOHANG)        = -1 ECHILD (No child processes)
sigreturn()                             = ? (mask now [])
rt_sigaction(SIGCHLD, {0x807871f, [], 0}, {0x807871f, [], 0}, 8) = 0
close(4)                                = 0
read(3, ".\n", 128)                     = 2
read(3, "", 128)                        = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGINT, {0x80760d4, [], 0}, {SIG_DFL}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGINT, {SIG_DFL}, {0x80760d4, [], 0}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(255, "progbase=`basename \"$progname\"`\n"..., 5129) = 1680
pipe([3, 4])                            = 0
rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0
_llseek(255, -1648, [3481], SEEK_CUR)   = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
child_tidptr=0xb7fb6708) = 16397
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGCHLD, {0x807871f, [], 0}, {0x807871f, [], 0}, 8) = 0
close(4)                                = 0
read(3, "firefox\n", 128)               = 8
read(3, "", 128)                        = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGINT, {0x80760d4, [], 0}, {SIG_DFL}, 8) = 0
waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 16397
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
waitpid(-1, 0xbfdd22dc, WNOHANG)        = -1 ECHILD (No child processes)
sigreturn()                             = ? (mask now [])
rt_sigaction(SIGINT, {SIG_DFL}, {0x80760d4, [], 0}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(255, "run_moz=\"$curdir/run-mozilla.sh\""..., 5129) = 1648
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
access("./run-mozilla.sh", X_OK)        = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
open("./init.d/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 3
fstat64(3, {st_mode=S_IFDIR|0755, st_size=72, ...}) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7d8f000
getdents64(3, /* 3 entries */, 131072)  = 80
getdents64(3, /* 0 entries */, 131072)  = 0
munmap(0xb7d8f000, 135168)              = 0
close(3)                                = 0
open("/root/.mozilla/firefox/init.d/",
O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = -1 ENOENT (No such file or directory)
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
access("./init.d/S*", X_OK)             = -1 ENOENT (No such file or directory)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
access("/root/.mozilla/firefox/init.d/S*", X_OK) = -1 ENOENT (No such file or
directory)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0
_llseek(255, -91, [5038], SEEK_CUR)     = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
child_tidptr=0xb7fb6708) = 16398
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGINT, {0x80760d4, [], 0}, {SIG_DFL}, 8) = 0
waitpid(-1, ./run-mozilla.sh: line 131: 16403 Segmentation fault      "$prog"
${1+"$@"}
[{WIFEXITED(s) && WEXITSTATUS(s) == 139}], 0) = 16398
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
waitpid(-1, 0xbfdd265c, WNOHANG)        = -1 ECHILD (No child processes)
sigreturn()                             = ? (mask now [])
rt_sigaction(SIGINT, {SIG_DFL}, {0x80760d4, [], 0}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(255, "exitcode=$?\n\n## Stop addon scrip"..., 5129) = 91
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
open("/root/.mozilla/firefox/init.d/",
O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = -1 ENOENT (No such file or directory)
open("./init.d/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 3
fstat64(3, {st_mode=S_IFDIR|0755, st_size=72, ...}) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7d8f000
getdents64(3, /* 3 entries */, 131072)  = 80
getdents64(3, /* 0 entries */, 131072)  = 0
munmap(0xb7d8f000, 135168)              = 0
close(3)                                = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
access("/root/.mozilla/firefox/init.d/K*", X_OK) = -1 ENOENT (No such file or
directory)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
access("./init.d/K*", X_OK)             = -1 ENOENT (No such file or directory)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
exit_group(139)                         = ?
[root@zeus /opt/MozillaFirefox]$

Comment 25

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050618
Firefox/1.0+ ID:2005061804
Still crashes for me too.
TB6778055G [@  nsMenuFrame::BuildAcceleratorText]

Comment 26

[Boris Zbarsky [:bzbarsky]]

Reopening per comments

Comment 27

[[e-mail]]

If you really want to remove a menu or menuitem from the screen then only
display: none; works, as keyboard navigation works off the frames... visibility:
collapse; also doesn't remove margins in those themes that use them.

Comment 28

[Martijn Wargers (dead)]

Can it be that the people who are still crashing with current trunk builds,
still have menu:empty { display:none } in their xul cache?
Steve and Marian, when you put add the property nglayout.debug.disable_xul_cache
to about:config and set it to true (boolean), and then do a restart, do you
still crash when moving over the GM Tools menu?

Comment 29

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050620
Firefox/1.0+ ID:2005062002 -- New Profile.
For me,
nglayout.debug.disable_xul_cache = false, testcase = crash, TB6843982X
nglayout.debug.disable_xul_cache = true, testcase still = crash, TB6843993M

Comment 30

[Mats Palmgren (inactive)]

We're doing a synchronous re-framing while we have the old frames
for that content still on the call stack:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCSSFrameConstructor.cpp&rev=1.1105&root=/cvsroot&mark=10331,10427-10447#10410

the frame has been destroyed after the |SetAttr| here:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/xul/base/src/nsMenuFrame.cpp&rev=1.292&root=/cvsroot&mark=573#561

A bit of ad-hoc tracing for the testcase:

[0x87b3370] PresShell::HandleEventInternal L11: mCurrentEventFrame=0x8723ce4
aView=0x8638468
 ++++++++++++++++++++++++++++++++++++++++
Menu(menu)(0)@0x8723ce4 {0,0,4995,315} [state=805000b0] [content=0x87ce6f8]
[sc=0x8723c34]<
  Text(label)(-1)[value=Hovering over this should not crash Mozilla]@0x8723dec
{300,30,4080,255} [state=000000a0] [content=0x8636c20]
  Box(hbox)(-1)@0x8723ec0 next=0x8724088 {4410,157,345,0} [state=80c000a0]
[content=0x87d1fc8] [sc=0x8723e68]<
    Area(label)(0)@0x8724034 {105,0,210,0} [state=00d00000] sc=0x8723f2c(i=0,b=0)<
    >
  >
  Box(hbox)(-1)@0x8724088 {4845,105,120,105} [state=804000a0]
[content=0x8638778] [sc=0x8723f84]<
    ImageBox(image)(0)@0x87241a4 {0,0,60,105} [state=000000a0] [content=0x86387f8]
  >
>
 ----------------------------------------
[0x8723ce4] nsMenuFrame::HandleEvent ENTER
[0x8723ce4] nsMenuFrame::HandleEvent NS_MOUSE_MOVE
[0x8723ce4] nsMenuFrame::HandleEvent NS_MOUSE_MOVE 1
[0x8723ce4] nsMenuFrame::HandleEvent NS_MOUSE_MOVE
mMenuParent=0x87dfd20->SetCurrentMenuItem(this=0x8723ce4)
[0x87dfcb4] nsMenuPopupFrame::SetCurrentMenuItem mCurrentMenu=(nil)
mTimerMenu=(nil) aMenuItem=0x8723d50
[0x87dfcb4] nsMenuPopupFrame::SetCurrentMenuItem 4
[0x87dfcb4] nsMenuPopupFrame::SetCurrentMenuItem 5
[0x8723ce4] nsMenuFrame::SelectMenu doc=0x87ad6f8
[0x87ce6f8] nsXULElement::SetAttr ENTER
[0x87ce6f8] nsXULElement::SetAttrAndNotify
[0x87ce6f8] nsXULElement::SetAttrAndNotify before binding->AttributeChanged
[0x8638778] nsXULElement::SetAttr ENTER
[0x8638778] nsXULElement::SetAttrAndNotify
[0x8638778] nsXULElement::SetAttrAndNotify doc->AttributeChanged before
doc=0x87ad6f8 0x87ad6f8
[0x8638778] nsXULElement::SetAttrAndNotify doc->AttributeChanged after
doc=0x87ad6f8 0x87ad6f8
[0x8638778] nsXULElement::SetAttr EXIT
[0x87ce6f8] nsXULElement::SetAttrAndNotify after binding->AttributeChanged
[0x87ce6f8] nsXULElement::SetAttrAndNotify doc->AttributeChanged before
doc=0x87ad6f8 0x87ad6f8
nsCSSFrameConstructor::AttributeChanged before ProcessOneRestyle menuactive
aContent=0x87ce6f8 doc=0x87ad6f8
[0x8723dec] nsFrame::Destroy content=0x8636c20 view=(nil) shell=0x87b3370
[0x8724034] nsFrame::Destroy content=0x87d2028 view=(nil) shell=0x87b3370
[0x8723ec0] nsFrame::Destroy content=0x87d1fc8 view=(nil) shell=0x87b3370
[0x87241a4] nsFrame::Destroy content=0x86387f8 view=(nil) shell=0x87b3370
[0x8724088] nsFrame::Destroy content=0x8638778 view=(nil) shell=0x87b3370
[0x8723ce4] nsFrame::Destroy content=0x87ce6f8 view=(nil) shell=0x87b3370
nsCSSFrameConstructor::AttributeChanged after ProcessOneRestyle menuactive
aContent=0x87ce6f8 doc=0x87ad6f8
[0x87ce6f8] nsXULElement::SetAttrAndNotify doc->AttributeChanged after
doc=0x87ad6f8 0x87ad6f8
[0x87ce6f8] nsXULElement::SetAttr EXIT
nsMenuFrame::SelectMenu mContent=0xdddddddd

<<< crash


I couldn't find a solution without regressing the bugs Boris was fixing,
bug 262031, bug 279308 etc.

Comment 31

[Boris Zbarsky [:bzbarsky]]

Benjamin, any chance of coming up with an approach here that doesn't require a
(much needed) full rewrite of how XUL menus work?

Comment 32

[[e-mail]]

Attachment: Proposed patch

Changing the _moz-menuactive attribute don't have side effects any more.

Comment 33

[Chris Beard]

closing down for 1.8b3, let's try and get this in for 1.8b4

Comment 34

[Boris Zbarsky [:bzbarsky]]

Neil, what changed about this code since I fixed bug 262031?  At the time,
_moz_menuactive did something nontrivial when it was changed, but I can't recall
where that code was...

Comment 35

[[e-mail]]

Ah, well I was just going by the comment in nsPopupSetFrame::ActivatePopup ;-)

Comment 36

[[e-mail]]

So perhaps changing the _moz-menuactive attribute has never had side effects...

Comment 37

[Boris Zbarsky [:bzbarsky]]

The point is, does this patch regress bug 262031?  That bug is why I added the
menuactive check.  If removing it doesn't break those testcases, then it's all
good by me.

Comment 38

[[e-mail]]

Comment on attachment 187944 [details] [diff] [review]
Proposed patch

Sigh...

bsmedberg, perhaps some script to remove those empty menus on startup?

Comment 39

[Benjamin Smedberg]

What is different about the GM tools menus than any other of our menus? Are they
dynamically removing <menupopup> elements or somesuch?

Comment 40

[Martijn Wargers (dead)]

(In reply to comment #39)
> What is different about the GM tools menus than any other of our menus? Are they
> dynamically removing <menupopup> elements or somesuch?
Yes, I think so. At least, that's what I got by trying to make a minimized testcase.

Comment 41

[Jaime Mitchell (use [e-mail] for email)]

*** Bug 299777 has been marked as a duplicate of this bug. ***

Comment 42

[Asa Dotzler [:asa]]

after reconsidering the general user impact, removing blocker status.

Comment 43

[Ryan VanderMeulen [:RyanVM]]

No crash here when hovering over the expanded menu item now that the popup rewrite has landed. FIXED