360715 - Reproducable crash [@ gtk_moz_embed_get_title]

Status: RESOLVED WORKSFORME

(Core :: Widget: Gtk, defect)

Description

[Philip Van Hoof]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1228790096 (LWP 31980)]
0xb7138d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
(gdb) bt
#0  0xb7138d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
#1  0xb7138eac in nsFixedSizeAllocator::Alloc () from /usr/lib/firefox/libxpcom_core.so
#2  0xb4f22f24 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#3  0xb4f2453d in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#4  0xb4f1bc17 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#5  0xb71315be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#6  0xb71754b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#7  0xb712eb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#8  0xb489c0ad in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#9  0xb457ba57 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#10 0xb71315be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#11 0xb71754b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#12 0xb712eb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#13 0xb712ebd8 in nsCreateInstanceByCID::operator() () from /usr/lib/firefox/libxpcom_core.so
#14 0xb712e735 in nsCOMPtr_base::assign_from_helper () from /usr/lib/firefox/libxpcom_core.so
#15 0xb45ad600 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#16 0xb45ada62 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#17 0xb45adc5e in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#18 0xb502a890 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#19 0xb502c5b4 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#20 0xb4337b1b in NSGetModule () from /usr/lib/firefox/components/libwebbrwsr.so
#21 0xb4330943 in NSGetModule () from /usr/lib/firefox/components/libwebbrwsr.so
#22 0xb7e96ab4 in gtk_moz_embed_get_title () from /usr/lib/firefox/libgtkembedmoz.so
#23 0xb7e93729 in gtk_moz_embed_open_stream () from /usr/lib/firefox/libgtkembedmoz.so

Reproducible: Always

Steps to Reproduce:
1. gtk_moz_embed_open_stream (embed, "file:///", "text/html");
2. Destroy the component and create a new one
3. gtk_moz_embed_open_stream (embed, "file:///", "text/html"); again


Actual Results:  
Stuff crashes

Expected Results:  
That stuff doesn't crash

Comment 1

[Philip Van Hoof]

I can also reproduce the same crash this way:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1229527376 (LWP 4098)]
0xb7085d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
(gdb) bt
#0  0xb7085d90 in nsFixedSizeAllocator::FindBucket () from /usr/lib/firefox/libxpcom_core.so
#1  0xb7085eac in nsFixedSizeAllocator::Alloc () from /usr/lib/firefox/libxpcom_core.so
#2  0xb5e70f24 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#3  0xb5e7253d in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#4  0xb5e69c17 in NSGetModule () from /usr/lib/firefox/components/libgfx_gtk.so
#5  0xb707e5be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#6  0xb70c24b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#7  0xb707bb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#8  0xb5c1d0ad in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#9  0xb58fca57 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#10 0xb707e5be in nsTArray_base::EnsureCapacity () from /usr/lib/firefox/libxpcom_core.so
#11 0xb70c24b4 in nsCreateInstanceFromCategory::operator() () from /usr/lib/firefox/libxpcom_core.so
#12 0xb707bb97 in CallCreateInstance () from /usr/lib/firefox/libxpcom_core.so
#13 0xb707bbd8 in nsCreateInstanceByCID::operator() () from /usr/lib/firefox/libxpcom_core.so
#14 0xb707b735 in nsCOMPtr_base::assign_from_helper () from /usr/lib/firefox/libxpcom_core.so
#15 0xb592e600 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#16 0xb592ea62 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#17 0xb592ec5e in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#18 0xb5f78890 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#19 0xb5f7a5b4 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#20 0xb5f79ad8 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#21 0xb5f7a0ad in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#22 0xb5f6f0d2 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#23 0xb5f81625 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#24 0xb707c416 in nsGetInterface::operator() () from /usr/lib/firefox/libxpcom_core.so
#25 0xb707b735 in nsCOMPtr_base::assign_from_helper () from /usr/lib/firefox/libxpcom_core.so
#26 0xb5c2d68c in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#27 0xb5ac69db in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#28 0xb5abc8c7 in NSGetModule () from /usr/lib/firefox/components/libgklayout.so
#29 0xb5f7c52b in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#30 0xb5f77ed6 in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#31 0xb5f7dfee in NSGetModule () from /usr/lib/firefox/components/libdocshell.so
#32 0xb5297bb3 in NSGetModule () from /usr/lib/firefox/components/libwebbrwsr.so
#33 0xb7de2b9c in gtk_moz_embed_get_title () from /usr/lib/firefox/libgtkembedmoz.so
#34 0xb7de1a08 in gtk_moz_embed_new () from /usr/lib/firefox/libgtkembedmoz.so
#35 0xb726fb29 in g_cclosure_marshal_VOID__VOID () from /usr/lib/libgobject-2.0.so.0
#36 0xb7260fb9 in g_value_set_boxed () from /usr/lib/libgobject-2.0.so.0
#37 0xb726279b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#38 0xb727302a in g_signal_chain_from_overridden () from /usr/lib/libgobject-2.0.so.0
#39 0xb72740b7 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#40 0xb7274279 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#41 0xb786648a in gtk_widget_realize () from /usr/lib/libgtk-x11-2.0.so.0
#42 0xb7866a6e in gtk_widget_set_parent () from /usr/lib/libgtk-x11-2.0.so.0
#43 0xb767a64c in gtk_box_pack_start () from /usr/lib/libgtk-x11-2.0.so.0
---Type <return> to continue, or q <return> to quit---

This is the code doing it:
https://svn.tinymail.org/svn/tinymail/trunk/libtinymailui-mozembed/

I'm trying this with Ubuntu Dapper and Ubuntu Edgy.

Comment 2

[Philip Van Hoof]

It looks like after doing gtk_moz_embed_push_startup, the problem doesn't happen anymore.

Comment 3

[Philip Van Hoof]

However, the method in Comment #2 isn't documented on http://www.mozilla.org/unix/gtk-embedding.html#gtk_moz_embed_load_url

Comment 4

[Adam Guthrie]

Maybe you should file a different bug for getting the documentation updated.

Comment 5

[timeless]

we should probably migrate that page to the wiki too.

Comment 6

[Eric Shepherd [:sheppy]]

A separate bug for the documentation issue would be helpful, especially if anyone can hint what this stuff means. :)

Comment 7

[Reinout van Schouwen]

http://bugzilla.gnome.org/show_bug.cgi?id=380074 (Epiphany) shows the same stack trace. Confirming.

Comment 8

[timeless]

[e-mail]: please don't confirm bugs whose stack traces don't have symbols. doing so risks losing your privs as it is not a valid confirmation and means that proper triage won't happen.

Comment 9

[Oscar Lazzarino]

This bug is still there. Happened to me today. As a workaround, I'm keeping my gtk_moz_embed around instead of destroying and re-creating it.

Comment 10

[Wayne Mery (:wsmwk)]

Do you still see this crash?

Comment 11

[Wayne Mery (:wsmwk)]

FWIW nothing on the crash system in the last 6 months https://crash-stats.mozilla.com/signature/?signature=gtk_moz_embed_get_title&date=%3E%3D2016-04-30T13%3A00%3A57.000Z&date=%3C2016-10-31T13%3A00%3A57.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_sort=-date&page=1

Comment 12

[Mats Palmgren (inactive)]

There's nothing in our tree that matches "gtk_moz_embed",
so I don't think the STR is valid anymore.
https://dxr.mozilla.org/mozilla-central/search?tree=mozilla-central&q=gtk_moz_embed