397992 - Gtk-CRITICAL assertion `GTK_IS_WIDGET (widget)' failed at exit Firefox

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Ginn Chen]

Download latest Flash 9 plugin beta at labs.adobe.com
It is an Xembed plugin now.
Start Firefox from a console.
Go to www.youtube.com, click a movie, quit Firefox.

You may see following warning in console.

(Gecko:7667): Gtk-CRITICAL **: file gtkwidget.c: line 2166: assertion `GTK_IS_WIDGET (widget)' failed

Comment 1

[Ginn Chen]

I think the cause is,

mGtkSocket may be destroyed when nsWindow is destroyed.
Because gtk_container_destroy will destroy any GtkWidget inside.

Stack here:

=>[2] moz_container_forall(container = 0x13c380, include_internals = 0, callback = 0xfe9c7594 = &gtk_widget_destroy(), callback_data = (nil)), line 413 in "mozcontainer.c"
  [3] gtk_container_destroy(0x0, 0x3400, 0x2c37b8, 0xffbfcb60, 0x4aac8,
0x13c380), at 0xfe7f6da8 
  [4] g_closure_invoke(0x1, 0x0, 0x1, 0xffbfcb60, 0xffbfc9f4, 0x4aac8), at 0xfe4af544 
  [5] signal_emit_unlocked_R(0x0, 0x0, 0xfe4f0ef8, 0x7, 0xfe5ba408, 0xfe5ba3f8), at 0xfe4c8744 
  [6] g_signal_emit_valist(0x13c380, 0x7, 0xffbfcb78, 0xffbfcd90, 0x4b840, 0xfe4f0ef8), at 0xfe4c6ff4 
  [7] g_signal_emit(0x13c380, 0x7, 0x0, 0x13c380, 0x2c32ec, 0xac00), at 0xfe4c7338 
  [8] gtk_object_dispose(0x13c380, 0xb400, 0xeb1d0, 0xfeaba50c, 0x202168, 0x13c380), at 0xfe8b83e8 
  [9] g_object_run_dispose(0x13c380, 0x15000, 0xfe9c7594, 0xfe9cf338, 0x3e2f0, 0x3f4300), at 0xfe4b1e90 
  [10] gtk_container_destroy(0x0, 0x3e00, 0x2c37b8, 0xfeaba50c, 0xe2d3c, 0x149b48), at 0xfe7f6da8 
  [11] g_closure_invoke(0x0, 0x0, 0x1, 0xffbfd0f0, 0xffbfcf84, 0x4aac8), at 0xfe4af518 
  [12] signal_emit_unlocked_R(0x0, 0x1, 0xfe4f0ef8, 0x7, 0xfe5ba408, 0xfe5ba3f8), at 0xfe4c8744 
  [13] g_signal_emit_valist(0x149b48, 0x7, 0xffbfd108, 0xffbfd320, 0x4b840, 0xfe4f0ef8), at 0xfe4c6ff4 
  [14] g_signal_emit(0x149b48, 0x7, 0x0, 0x39a1c, 0x6, 0x149b4c), at 0xfe4c7338 
  [15] gtk_object_dispose(0x149b48, 0xb400, 0xeb1d0, 0xfeaba50c, 0x202168, 0x149b48), at 0xfe8b83e8 
  [16] g_object_run_dispose(0x149b48, 0x15000, 0x0, 0xfe9d4650, 0x3e2f0, 0x145a10), at 0xfe4b1e90 
  [17] nsWindow::Destroy(this = 0x56a8f0), line 481 in "nsWindow.cpp"
  [18] nsWindow::~nsWindow(this = 0x56a8f0), line 365 in "nsWindow.cpp"

But mGtkSocket still holds the pointer in this case.
So we will have a problem.

Stack:

  [1] g_logv(0xfea3b574, 0x8, 0xfea3b578, 0xffbfd298, 0xfeaba50c, 0x0), at 0xfe5472b8 
  [2] g_log(0xfea3b574, 0x8, 0xfea3b578, 0xfea3c754, 0x876, 0xfea3c760), at 0xfe547768 
=>[3] nsPluginNativeWindowGtk2::~nsPluginNativeWindowGtk2(this = 0x2493bb0), line 97 in "nsPluginNativeWindowGtk2.cpp"
  [4] __SLIP.DELETER__A(0x2493bb0, 0x1, 0xffbfd368, 0xb859, 0x1, 0xff262a00), at 0xf90221a0 
  [5] PLUG_DeletePluginNativeWindow(aPluginNativeWindow = 0x2493bb0), line 113 in "nsPluginNativeWindowGtk2.cpp"
  [6] nsPluginHostImpl::DeletePluginNativeWindow(this = 0xf301a0, aPluginNativeWindow = 0x2493bb0), line 6822 in "nsPluginHostImpl.cpp"
  [7] nsPluginInstanceOwner::~nsPluginInstanceOwner(this = 0x1f80c08), line 1692 in "nsObjectFrame.cpp"
  [8] __SLIP.DELETER__C(0x1f80c08, 0x1, 0xf88bd5ef, 0xff385c80, 0xc, 0xff262a0c), at 0xf79af7b0 
  [9] nsPluginInstanceOwner::Release(this = 0x1f80c08), line 1702 in "nsObjectFrame.cpp"
  [10] nsPluginInstancePeerImpl::~nsPluginInstancePeerImpl(this = 0x2493ef0), line 78 in "nsPluginInstancePeer.cpp"

Comment 2

[Ginn Chen]

Attachment: patch

clear mGtkSocket when the GtkWidget is destroyed.