Reproducable crash [@ gtk_moz_embed_get_title]

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
12 years ago
2 years ago

People

(Reporter: pvanhoof, Unassigned)

Tracking

({crash})

Trunk
x86
Linux
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [closeme 2016-11-21], crash signature)

(Reporter)

Description

12 years ago
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1228790096 (LWP 31980)]
0xb7138d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
(gdb) bt
#0  0xb7138d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
#1  0xb7138eac in nsFixedSizeAllocator::Alloc () from /usr/lib/firefox/libxpcom_core.so
#2  0xb4f22f24 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#3  0xb4f2453d in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#4  0xb4f1bc17 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#5  0xb71315be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#6  0xb71754b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#7  0xb712eb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#8  0xb489c0ad in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#9  0xb457ba57 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#10 0xb71315be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#11 0xb71754b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#12 0xb712eb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#13 0xb712ebd8 in nsCreateInstanceByCID::operator() () from /usr/lib/firefox/libxpcom_core.so
#14 0xb712e735 in nsCOMPtr_base::assign_from_helper () from /usr/lib/firefox/libxpcom_core.so
#15 0xb45ad600 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#16 0xb45ada62 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#17 0xb45adc5e in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#18 0xb502a890 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#19 0xb502c5b4 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#20 0xb4337b1b in NSGetModule () from /usr/lib/firefox/components/libwebbrwsr.so
#21 0xb4330943 in NSGetModule () from /usr/lib/firefox/components/libwebbrwsr.so
#22 0xb7e96ab4 in gtk_moz_embed_get_title () from /usr/lib/firefox/libgtkembedmoz.so
#23 0xb7e93729 in gtk_moz_embed_open_stream () from /usr/lib/firefox/libgtkembedmoz.so

Reproducible: Always

Steps to Reproduce:
1. gtk_moz_embed_open_stream (embed, "file:///", "text/html");
2. Destroy the component and create a new one
3. gtk_moz_embed_open_stream (embed, "file:///", "text/html"); again


Actual Results:  
Stuff crashes

Expected Results:  
That stuff doesn't crash
(Reporter)

Comment 1

12 years ago
I can also reproduce the same crash this way:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1229527376 (LWP 4098)]
0xb7085d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
(gdb) bt
#0  0xb7085d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
#1  0xb7085eac in nsFixedSizeAllocator::Alloc () from /usr/lib/firefox/libxpcom_core.so
#2  0xb5e70f24 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#3  0xb5e7253d in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#4  0xb5e69c17 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#5  0xb707e5be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#6  0xb70c24b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#7  0xb707bb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#8  0xb5c1d0ad in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#9  0xb58fca57 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#10 0xb707e5be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#11 0xb70c24b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#12 0xb707bb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#13 0xb707bbd8 in nsCreateInstanceByCID::operator() () from /usr/lib/firefox/libxpcom_core.so
#14 0xb707b735 in nsCOMPtr_base::assign_from_helper () from /usr/lib/firefox/libxpcom_core.so
#15 0xb592e600 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#16 0xb592ea62 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#17 0xb592ec5e in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#18 0xb5f78890 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#19 0xb5f7a5b4 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#20 0xb5f79ad8 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#21 0xb5f7a0ad in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#22 0xb5f6f0d2 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#23 0xb5f81625 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#24 0xb707c416 in nsGetInterface::operator() () from /usr/lib/firefox/libxpcom_core.so
#25 0xb707b735 in nsCOMPtr_base::assign_from_helper () from /usr/lib/firefox/libxpcom_core.so
#26 0xb5c2d68c in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#27 0xb5ac69db in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#28 0xb5abc8c7 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#29 0xb5f7c52b in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#30 0xb5f77ed6 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#31 0xb5f7dfee in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#32 0xb5297bb3 in NSGetModule () from /usr/lib/firefox/components/libwebbrwsr.so
#33 0xb7de2b9c in gtk_moz_embed_get_title () from /usr/lib/firefox/libgtkembedmoz.so
#34 0xb7de1a08 in gtk_moz_embed_new () from /usr/lib/firefox/libgtkembedmoz.so
#35 0xb726fb29 in g_cclosure_marshal_VOID__VOID () from /usr/lib/libgobject-2.0.so.0
#36 0xb7260fb9 in g_value_set_boxed () from /usr/lib/libgobject-2.0.so.0
#37 0xb726279b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#38 0xb727302a in g_signal_chain_from_overridden () from /usr/lib/libgobject-2.0.so.0
#39 0xb72740b7 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#40 0xb7274279 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#41 0xb786648a in gtk_widget_realize () from /usr/lib/libgtk-x11-2.0.so.0
#42 0xb7866a6e in gtk_widget_set_parent () from /usr/lib/libgtk-x11-2.0.so.0
#43 0xb767a64c in gtk_box_pack_start () from /usr/lib/libgtk-x11-2.0.so.0
---Type <return> to continue, or q <return> to quit---

This is the code doing it:
https://svn.tinymail.org/svn/tinymail/trunk/libtinymailui-mozembed/

I'm trying this with Ubuntu Dapper and Ubuntu Edgy.
(Reporter)

Comment 2

12 years ago
It looks like after doing gtk_moz_embed_push_startup, the problem doesn't happen anymore.
(Reporter)

Comment 3

12 years ago
However, the method in Comment #2 isn't documented on http://www.mozilla.org/unix/gtk-embedding.html#gtk_moz_embed_load_url

Comment 4

12 years ago
Maybe you should file a different bug for getting the documentation updated.
Severity: major → critical
Keywords: crash
Summary: Reproducable crash in gtk_moz_embed_get_title → Reproducable crash [@ gtk_moz_embed_get_title]

Comment 5

12 years ago
we should probably migrate that page to the wiki too.
A separate bug for the documentation issue would be helpful, especially if anyone can hint what this stuff means. :)

Comment 7

12 years ago
http://bugzilla.gnome.org/show_bug.cgi?id=380074 (Epiphany) shows the same stack trace. Confirming.
Status: UNCONFIRMED → NEW
Ever confirmed: true

Comment 8

12 years ago
reinout@gmail.com: please don't confirm bugs whose stack traces don't have symbols. doing so risks losing your privs as it is not a valid confirmation and means that proper triage won't happen.
(Assignee)

Updated

7 years ago
Crash Signature: [@ gtk_moz_embed_get_title]

Comment 9

7 years ago
This bug is still there. Happened to me today. As a workaround, I'm keeping my gtk_moz_embed around instead of destroying and re-creating it.

Comment 10

2 years ago
Do you still see this crash?
Flags: needinfo?(pvanhoof)
Flags: needinfo?(oscar.lazzarino)
Whiteboard: [closeme 2016-11-21]
There's nothing in our tree that matches "gtk_moz_embed",
so I don't think the STR is valid anymore.
https://dxr.mozilla.org/mozilla-central/search?tree=mozilla-central&q=gtk_moz_embed
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Flags: needinfo?(pvanhoof)
Flags: needinfo?(oscar.lazzarino)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.