307840 - Having Clear Private Data set to run at the closing of Firefox causes the program to hang in Linux [@ nsDragService::Observe]

Status: VERIFIED FIXED

(Firefox :: Settings UI, defect)

Description

[tim]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4

when clear private data is set to run at closing on linux, this does not happen
in either the windows or macos versions, it causes the program to not terminated
untill killed via the kill command, or restart of the system.

this does not happen when it is disabled

Reproducible: Always

Steps to Reproduce:
1. open up firefox 1.5b1
2. go to edit preferences
3. click the privacy tab
4. under privacy click the button "Settings..."
5. under the Settings section click "Clear private data on closing Firefox" to
enable it
6. ensure that "Ask me before clearing private data" is also enabled
7. close firefox
8. attempt to reopen firefox

Actual Results:  
firefox would not reopen due to it continuing to run, but not responding
it needed to be killed via the kill command

Expected Results:  
The program should have opened up the clear private data toolbox
and the program should terminate

this crashed on a fully updated intel 686 running fedora core 3 under the k
desktop environment, this has not been tested on any other linux distrobutions.

the easy workaround is to disable the data being cleared on exit, and clearing
it manually.

Comment 1

[Glen]

I'm having similar problems with the latest nightly build of Firefox (Sept 13th,
2005), running under Suse 9.3.  I have it set to clear all private data
automatically when I exit firefox, but when I exit it still asks me if I would
like to clear the private data.  The buttons to clear or cancel are also strange
looking at that point.

Comment 2

[Adam Guthrie]

Confirmed. The behavior here is pretty odd. The "ask to clear" window comes up
on close (usually), and it's all messed up (see screenshot). Then if you click
anywhere in the window you get a crash. The dialog also comes up again on
restart but looks normal this time.

The three crashes I got on branch are: TB9309606K, TB9309557Y, and TB9309476G
The ones from trunk are: TB9309417Q, TB9309252W, and TB9309245E

Comment 3

[Adam Guthrie]

Attachment: screenshot of the "ask to clear" dialog

Comment 4

[Asa Dotzler [:asa]]

Has this always failed since we got this feature or is this a recent regression.
if it regressed, what build last worked and can we identify the change that
broke it?

Comment 5

[Adam Guthrie]

mconnor suggested that the patch for bug 284086 might have caused this, and I
verified that it regressed between a day of when the patch landed, but did not
backout the patch by hand and retest to be 100% sure, but I'd say I'm 99%. :)

Comment 6

[Giorgio Maone [:ma1]]

I cannot test this right now (can't build a debug Linux version), but looking at
the Firefox output reported in
https://bugzilla.mozilla.org/show_bug.cgi?id=284086#c39 and
https://bugzilla.mozilla.org/show_bug.cgi?id=284086#c41 I'd guess that some
important GTK structure gets destroyed during the PROFILE_BEFORE_CHANGE
broadcast notification. 
It looks like a premature cleanup which could be moved to XPCOM shutdown. 
Is a GTK expert already CCed? 

Comment 7

[tim]

it last worked in the original build of deer park alpha two

another work around is to disable the "Ask me before clearing private data"

Comment 8

[tim]

also a similar bug exists in the windows version, atleast from my testing

if you have "Saved Passwords" selected it crashes

Comment 9

[Adam Guthrie]

(In reply to comment #8)
> also a similar bug exists in the windows version, atleast from my testing
> 
> if you have "Saved Passwords" selected it crashes

Could you please provide some more information into this? Maybe a talkback ID of
the crash and what the window looks like/how it behaves when it comes up.

Comment 10

[tim]

when you have it set to clear the private data on closing, and "Saved Passwords" is selected, upon 
closing firefox1.5beta the program stops responding, a dialogue from windows informs us of this. this 
has only been tested in win98, and me. there was no error id provided by firefox, then again it was 
running under windos

the error does not occur when "Saved Passwords" is not selected (this does not have any effect on the 
linux or macos versions)

Comment 11

[Asa Dotzler [:asa]]

Jay, do you see any crash data for this in talkback?

Tim, MozQA, are you still seeing this in the latest nightly build?

Comment 12

[tim]

talkback doesnt have a chance to start, atleast from what i can tell it doesnt appear to be getting the 
signal that firefox has crashed.

as for the latest build, i havent tested it with that, i will test it later today if i get the chance

Comment 13

[tim]

latest nightly build appears to have an even worse problem

it has the same problem as before, but now after you kill it, it is not possible
start the application up again. When you try to start it, the application begins
to load, and then kills itself before bringing up the confirmation to clear
private data, like it will do with the first build of beta 1 with settings
listed above.

Comment 14

[Mike Connor [:mconnor]]

WFM yesterday's branch build.

Comment 15

[Tracy Walker [:tracy]]

WFM - Firefox 1.4 2005-09-29-06-mozilla1.8 on Linux Fedora Core 3

Comment 16

[Asa Dotzler [:asa]]

wfm per above comments

Comment 17

[Kevin Brosnan]

This still crashes for me, Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5)
Gecko/20051001.

TB10017316E TB10017094K TB9980878M TB9980767Z

Comment 18

[Adam Guthrie]

Incident ID: 10017094
Stack Signature	libgtk-x11-2.0.so.0 + 0x200942 (0xb7cb3942) 0d51b488
Product ID	Firefox15
Build ID	2005100104
Trigger Time	2005-10-01 23:49:15.0
Platform	LinuxIntel
Operating System	Linux 2.6.12-9-386
Module	libgtk-x11-2.0.so.0 + (00200942)
URL visited	
User Comments	cancled clear private data
Since Last Crash	4 sec
Total Uptime	4 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
libgtk-x11-2.0.so.0 + 0x200942 (0xb7cb3942)
nsDragService::Observe() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsDragService.cpp,
line 137]
nsObserverService::NotifyObservers() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/ds/nsObserverService.cpp,
line 848]
nsAppStartup::Quit() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 848]
nsAppStartup::Observe() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 510]
nsObserverService::NotifyObservers() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/ds/nsObserverService.cpp,
line 848]
nsXULWindow::Destroy() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 848]
nsWebShellWindow::Destroy() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 850]
nsChromeTreeOwner::Destroy() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpfe/appshell/src/nsChromeTreeOwner.cpp,
line 354]
nsGlobalWindow::ReallyCloseWindow() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 848]
nsGlobalWindow::CloseWindow() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 731]
nsJSContext::ScriptEvaluated() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 2036]
nsCxPusher::Pop() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsContentUtils.cpp,
line 848]
nsEventListenerManager::HandleEventSubType() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 666]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1784]
nsXULElement::HandleDOMEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2153]
PresShell::HandleDOMEventWithTarget() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6462]
nsButtonBoxFrame::DoMouseClick() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp,
line 179]
nsButtonBoxFrame::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp,
line 150]
PresShell::HandleEventInternal() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6407]
PresShell::HandleEventWithTarget() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6265]
nsEventStateManager::CheckForAndDispatchClick() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 3038]
nsEventStateManager::PostHandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 165]
PresShell::HandleEventInternal() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 848]
PresShell::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6202]
nsViewManager::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 848]
nsViewManager::DispatchEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 2246]
HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsView.cpp,
line 251]
nsCommonWidget::DispatchEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 219]
nsWindow::OnButtonReleaseEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 1594]
button_release_event_cb() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 3722]
libgtk-x11-2.0.so.0 + 0x11ff4c (0xb7bd2f4c)
libgobject-2.0.so.0 + 0x93a8 (0xb79903a8)
libgobject-2.0.so.0 + 0x17b13 (0xb799eb13)
libgobject-2.0.so.0 + 0x18ec3 (0xb799fec3)
libgobject-2.0.so.0 + 0x194c3 (0xb79a04c3)
libgtk-x11-2.0.so.0 + 0x20205f (0xb7cb505f)
libgtk-x11-2.0.so.0 + 0x11e687 (0xb7bd1687)
libgtk-x11-2.0.so.0 + 0x11eac0 (0xb7bd1ac0)
libgdk-x11-2.0.so.0 + 0x3fb2d (0xb7a75b2d)
libglib-2.0.so.0 + 0x244ee (0xb79264ee)
libglib-2.0.so.0 + 0x274f6 (0xb79294f6)
libglib-2.0.so.0 + 0x279d8 (0xb79299d8)
nsAppShell::DispatchNativeEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 276]
nsXULWindow::ShowModal() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 848]
nsContentTreeOwner::ShowAsModal() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp,
line 431]
nsWindowWatcher::OpenWindowJS() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 848]
nsWindowWatcher::OpenWindow() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 476]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2138]
XPC_WN_CallMethod() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1402]
js_Invoke() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1163]
js_Interpret() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 3483]
js_Invoke() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1183]
nsXPCWrappedJSClass::CallMethod() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 462]
PrepareAndDispatch() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp,
line 100]
nsObserverService::NotifyObservers() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/ds/nsObserverService.cpp,
line 848]
nsXREDirProvider::DoShutdown() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsXREDirProvider.cpp,
line 636]
ScopedXPCOMStartup::~ScopedXPCOMStartup() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 550]
XRE_main() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 848]
main() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 62]
libc.so.6 + 0x14ea2 (0xb745aea2)

Comment 19

[Giorgio Maone [:ma1]]

Attachment: Avoids double "quit-application" notifications

GTK2 (and GTK) nsDragService instances observe "quit-application" in a
non-idempotent fashion: if notified twice, they attempt destruction of an
already destroyed mHiddenWidget (
http://lxr.mozilla.org/mozilla1.8/source/widget/src/gtk2/nsDragService.cpp#136)
causing this crash.
Rather than putting a local patch, with this attachment I'm ensuring
"quit-application" is not notified as a result of the Sanitizer dialog being
closed, usually after a previous notification.

Comment 20

[Giorgio Maone [:ma1]]

Attachment: 1.8 branch - Avoids double "quit-application" notifications

Branch diff

Comment 21

[Robert Strong (they/them - no direct email)]

Thanks Giorgio, I just did a trace and came to the same conclusion.

Comment 22

[Mike Connor [:mconnor]]

Comment on attachment 198619 [details] [diff] [review]
Avoids double "quit-application" notifications

r=me for this one too, as noted on IRC we want to change the const from
appShell to appStartup

Comment 23

[Giorgio Maone [:ma1]]

Attachment: const renamed

Same as attachment 198619 [details] [diff] [review] (r=mconnor), with the renaming asked.

Comment 24

[Giorgio Maone [:ma1]]

Attachment: 1.8 branch - const renamed

Same as attachment 198620 [details] [diff] [review] for 1.8 branch (r=mconnor), with the renaming asked.

Comment 25

[Asa Dotzler [:asa]]

Comment on attachment 198704 [details] [diff] [review]
1.8 branch - const renamed

moving request to 1.8rc1 since 1.8b5 has shipped.

Comment 26

[Asa Dotzler [:asa]]

Comment on attachment 198703 [details] [diff] [review]
const renamed

moving request to 1.8rc1 since 1.8b5 has shipped.

Comment 27

[:Gavin Sharp [email: [e-mail]]]

Trunk:
mozilla/browser/components/nsBrowserGlue.js; new revision: 1.8;

1.8 Branch:
mozilla/browser/components/nsBrowserGlue.js; new revision: 1.4.2.7;

Comment 28

[Scott MacGregor]

As Adam pointed out, this bug appears to still be a problem on the branch. See Bug 314755.