crash on dnd to self-closing window [@ libc.so.6 - nsWindow::OnDragEnter() ] [@ firefox-bin - nsWindow::OnDragEnter() ]

RESOLVED FIXED in mozilla1.8.1

Status

()

Core
Widget: Gtk
--
critical
RESOLVED FIXED
13 years ago
7 years ago

People

(Reporter: Christian Persch (GNOME) (away; not receiving bug mail), Assigned: mwu)

Tracking

({crash, fixed1.8.1, topcrash})

Trunk
mozilla1.8.1
x86
Linux
crash, fixed1.8.1, topcrash
Points:
---
Bug Flags:
blocking1.8.1 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(2 attachments)

firefox built from cvs, 2005-06-13.

Steps to reproduce:
0) Load the testcase
1) Click on the "Test case for bug 150632" link
2) Position the popup window so that you can drag from the opening window to the
popup window
3) Drag the favicon drag handle in the location entry of the opening window to
the popup window. You have be quick so that you reach the window before it closes.

How often is this reproducible:
I manage to get this about every 2nd drag.

Result:
(Gecko:10436): Gdk-CRITICAL **: gdk_window_peek_children: assertion
`GDK_IS_WINDOW (window)' failed

(Gecko:10436): GLib-GObject-CRITICAL **: g_object_get_data: assertion
`G_IS_OBJECT (object)' failed

Program received signal SIGSEGV, Segmentation fault.
0x00000081 in ?? ()
(gdb) where
#0  0x00000081 in ?? ()
#1  0xb5cef44a in nsWindow::OnDragEnter (this=0x89372b0, aX=350, aY=62) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:2204
#2  0xb5ceea6c in nsWindow::OnDragMotionEvent (this=0x89372b0,
aWidget=0x89bf938, aDragContext=0x8096630, aX=350, aY=62, aTime=11532030,
aData=0x89372b0)
    at /opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:1964
#3  0xb5cf3eec in nsWindow::FireDragMotionTimer (this=0x89372b0) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:4137
#4  0xb5cf3f8f in nsWindow::DragMotionTimerCallback (aClosure=0x89372b0) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsWindow.cpp:4162
#5  0xb78e9200 in g_main_context_wakeup () from /usr/lib/libglib-2.0.so.0
#6  0xb78e6d0f in g_main_depth () from /usr/lib/libglib-2.0.so.0
#7  0xb78e7cb5 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#8  0xb78e7fd7 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#9  0xb78e851e in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#10 0xb7b7f10f in IA__gtk_main () at gtkmain.c:963
#11 0xb5cfb0ba in nsAppShell::Run (this=0x8217ba0) at
/opt/source/firefox-trunk/mozilla/widget/src/gtk2/nsAppShell.cpp:139
#12 0xb5c50c12 in nsAppStartup::Run (this=0x8217690) at
/opt/source/firefox-trunk/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:144
#13 0x080573be in XRE_main (argc=1, argv=0xbffff784, aAppData=0x8072400) at
/opt/source/firefox-trunk/mozilla/toolkit/xre/nsAppRunner.cpp:2122
#14 0x0804ff6c in main (argc=1, argv=0xbffff784) at
/opt/source/firefox-trunk/mozilla/browser/app/nsBrowserApp.cpp:61

Comment 1

13 years ago
*** Bug 254263 has been marked as a duplicate of this bug. ***

Updated

13 years ago
Depends on: 269568

Updated

13 years ago
Summary: crash on dnd to self-closing window → crash on dnd to self-closing window [@ libc.so.6 - nsWindow::OnDragEnter() ]
Same happens for me with Thunderbird for several times:

Incident id: TB11798076K

Stack Signature	 libc.so.6 + 0x29a27 (0xb751ca27) 40a1107f
Product ID	Thunderbird15
Build ID	2005102519
Trigger Time	2005-11-13 12:13:36.0
Platform	LinuxIntel
Operating System	Linux 2.6.13-kanotix-8
Module	libc.so.6 + (00029a27)
URL visited	
User Comments	Message content wasn't displayed anymore when clicking on several messages in messagepane. When closing Thunderbird the crash occurs.
Since Last Crash	12 sec
Total Uptime	12 sec
Trigger Reason	SIGIOT: Abort or IOT Instruction: (signal 6)
Source File, Line No.	N/A
Stack Trace 	
libc.so.6 + 0x29a27 (0xb751ca27)
libc.so.6 + 0x2b35b (0xb751e35b)
libstdc++.so.5 + 0x91da7 (0xb76c8da7)
libstdc++.so.5 + 0x91de4 (0xb76c8de4)
libstdc++.so.5 + 0x92308 (0xb76c9308)
nsWindow::OnDragEnter()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 2207]
nsWindow::OnDragMotionEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1968]
nsWindow::FireDragMotionTimer()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4122]
nsWindow::DragMotionTimerCallback()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4146]
libglib-2.0.so.0 + 0x271d4 (0xb79ce1d4)
libglib-2.0.so.0 + 0x25421 (0xb79cc421)
libglib-2.0.so.0 + 0x28687 (0xb79cf687)
libglib-2.0.so.0 + 0x28bd8 (0xb79cfbd8)
libgtk-x11-2.0.so.0 + 0x111989 (0xb7c6d989)
nsAppShell::Run()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 848]
main()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mail/app/nsMailApp.cpp, line 63]
libc.so.6 + 0x14ec0 (0xb7507ec0)
This crash is really annoying. Since a couple of days I can see the following behavior for both Firefox and Thunderbird.

After working an amount of time with Firefox, the browser content isn't updated anymore. I still get a blank page or the last displayed content stays forever. Same happens in Thunderbird within the messagepane. When closing the applications in that state both are crashing.

Jay, I can't search for other current crash reports on talkback. The search function doesn't give any reports but hangs forever.

Incidents:
TB12014550K
TB12008132Y

Comment 4

12 years ago
*** Bug 345724 has been marked as a duplicate of this bug. ***

Updated

12 years ago
Assignee: blizzard → nobody
Keywords: crash
This is showing up as one of the top Linux crashes for Firefox2 beta2, with incidents like this:

Incident ID: 22792812
Stack Signature	firefox-bin + 0x402 (0x00d82402) 14e8c510
Product ID	Firefox2
Build ID	2006082101
Trigger Time	2006-09-01 18:56:57.0
Platform	LinuxIntel
Operating System	Linux 2.6.17-1.2174_FC5
Module	firefox-bin + (00000402)
URL visited	gmail.com friendster.com
User Comments	i've close the window with gmail and friendster page on the tabs and it crashes
Since Last Crash	8 sec
Total Uptime	8 sec
Trigger Reason	SIGIOT: Abort or IOT Instruction: (signal 6)
Source File, Line No.	N/A
Stack Trace 	
firefox-bin + 0x402 (0x00d82402)
libc.so.6 + 0x29671 (0x0087a671)
libstdc++.so.5 + 0x92617 (0x006ab617)
libstdc++.so.5 + 0x92664 (0x006ab664)
libstdc++.so.5 + 0x92ba7 (0x006abba7)
nsWindow::OnDragEnter()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 2317]
nsWindow::OnDragMotionEvent()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 2074]
nsWindow::FireDragMotionTimer()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 4236]
nsWindow::DragMotionTimerCallback()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 4263]
libglib-2.0.so.0 + 0x25876 (0x0390a876)
libglib-2.0.so.0 + 0x2515d (0x0390a15d)
libglib-2.0.so.0 + 0x283ef (0x0390d3ef)
libglib-2.0.so.0 + 0x28799 (0x0390d799)
libgtk-x11-2.0.so.0 + 0x11e634 (0x03d84634)
nsAppShell::Run()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2440]
main()  [mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x15724 (0x00866724)
Keywords: topcrash
Summary: crash on dnd to self-closing window [@ libc.so.6 - nsWindow::OnDragEnter() ] → crash on dnd to self-closing window [@ libc.so.6 - nsWindow::OnDragEnter() ] [@ firefox-bin - nsWindow::OnDragEnter() ]

Updated

12 years ago
Flags: blocking1.8.1?
Plussing as topcrasher, not sure if it'll actually block the release, but this seems to be what we're doing with topcrashers.
Flags: blocking1.8.1? → blocking1.8.1+
Not actually a blocker, but still nice to have.
Flags: blocking1.8.1+ → blocking1.8.1-
(Assignee)

Comment 8

12 years ago
Created attachment 237887 [details] [diff] [review]
Cancel DnD timer when destroying window

The problem is that the drag motion timer callback is being called after the window is destroyed. This patch makes sure the timer is canceled while the window is being destroyed.
Assignee: nobody → flamingice
Status: NEW → ASSIGNED
Attachment #237887 - Flags: review?(roc)
Attachment #237887 - Flags: superreview+
Attachment #237887 - Flags: review?(roc)
Attachment #237887 - Flags: review+
(Assignee)

Comment 9

12 years ago
Checking in widget/src/gtk2/nsWindow.cpp;
/cvsroot/mozilla/widget/src/gtk2/nsWindow.cpp,v  <--  nsWindow.cpp
new revision: 1.183; previous revision: 1.182
done
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.8.1
Flags: blocking1.8.1- → blocking1.8.1?
(Assignee)

Comment 10

12 years ago
Created attachment 237985 [details] [diff] [review]
Cancel DnD timer when destroying window (branch)

Probably low risk since there's no reason for the drag timer to keep running after the window is destroyed.
Attachment #237887 - Attachment is obsolete: true
Attachment #237985 - Flags: approval1.8.1?
(Assignee)

Updated

12 years ago
Attachment #237887 - Attachment is obsolete: false

Comment 11

12 years ago
Comment on attachment 237985 [details] [diff] [review]
Cancel DnD timer when destroying window (branch)

a=schrep for drivers for topcrash.
Attachment #237985 - Flags: approval1.8.1? → approval1.8.1+
Flags: blocking1.8.1? → blocking1.8.1+
(Assignee)

Comment 12

12 years ago
Branch:
Checking in widget/src/gtk2/nsWindow.cpp;
/cvsroot/mozilla/widget/src/gtk2/nsWindow.cpp,v  <--  nsWindow.cpp
new revision: 1.145.2.7; previous revision: 1.145.2.6
done
Keywords: fixed1.8.1
Crash Signature: [@ libc.so.6 - nsWindow::OnDragEnter() ] [@ firefox-bin - nsWindow::OnDragEnter() ]
You need to log in before you can comment on or make changes to this bug.