41576 - mozilla crashes with segmentation fault when menu options are clicked

Status: VERIFIED DUPLICATE of bug 40045

(Core :: XUL, defect, P3)

Description

[Raghu Sakleshpur]

I'm using the latest build of mozilla. When I try to click on any of the top
browser menu options like File, Edit etc., the browser immediately crashes
with segmentation fault.
Debug information on terminal window:
MOZILLA_FIVE_HOME=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin
 
LD_LIBRARY_PATH=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin:/lib:/usr/lib:/net/tuffy/export/home/MOZILLA/dist/lib
     LIBRARY_PATH=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin
       SHLIB_PATH=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin
          LIBPATH=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin
       ADDON_PATH=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin
     
MOZ_PROGRAM=/net/tuffy/export/home/MOZILLA/mozilla-00-06-04/dist/bin/mozilla-bin
      MOZ_TOOLKIT=
        moz_debug=0
     moz_debugger=

Gdk-WARNING **: shmat failed!

Gdk-WARNING **: shmat failed!
WEBSHELL+ = 1
WEBSHELL+ = 2
CSSLoaderImpl::LoadAgentSheet: Load of URL
'file:///home/raghu/.mozilla/default/chrome/user.css' failed.  Error code: 16389
WEBSHELL+ = 3
WEBSHELL+ = 4
Setting content window
*** Pulling out the charset
in SetSecurityButton
Document: Done (0.6 secs)
*** check number of frames in content area 
Document about:blank loaded successfully
WEBSHELL+ = 5
WEBSHELL- = 4
WEBSHELL- = 3
Segmentation Fault - core dumped

Stack trace from core:
current thread: t@1
=>[1] 0x145b08(0x8349ac, 0x145b08, 0x8349ac, 0x4, 0xfcb7dd54, 0xfcb608b8), at
0x145b07
  [2] _13nsCOMPtr_base(0xffbed540, 0x2, 0x0, 0x0, 0x4, 0xfcb8424c), at
0xff2262bc
  [3] ActivateMenu__11nsMenuFramei(0x54845c, 0x1, 0x5484b4, 0xfcd2ba3c, 0x1,
0xffffffff), at 0xfcd2bbb0
  [4] OpenMenuInternal__11nsMenuFramei(0x54845c, 0x6a3b5c, 0x0, 0xffffffff,
0xfdd0668c, 0x0), at 0xfcd2c6e4
  [5]
AttributeChanged__11nsMenuFrameP14nsIPresContextP10nsIContentiP7nsIAtomi(0x54845c,
0x232358, 0x3d99d0, 0x0, 0x151c38, 0x3), at 0xfcd2bd50
  [6]
AttributeChanged__21nsCSSFrameConstructorP14nsIPresContextP10nsIContentiP7nsIAtomi(0x0,
0x232358, 0x3d99d0, 0x0, 0x151c38, 0xffbed928), at 0xfcc895ec
  [7]
AttributeChanged__12StyleSetImplP14nsIPresContextP10nsIContentiP7nsIAtomi(0x249098,
0x232358, 0x3d99d0, 0x0, 0x151c38, 0xffffffff), at 0xfcd89b54
  [8]
AttributeChanged__9PresShellP11nsIDocumentP10nsIContentiP7nsIAtomi(0x24c498,
0x17a898, 0x3d99d0, 0x0, 0x151c38, 0xffffffff), at 0xfcb81704
  [9] AttributeChanged__13nsXULDocumentP10nsIContentiP7nsIAtomi(0x0, 0x3d99d0,
0x0, 0x151c38, 0xffffffff, 0xfdd17b50), at 0xfdd17cf8
  [10] SetAttribute__12nsXULElementiP7nsIAtomRC8nsStringi(0x0, 0x0, 0x151c38,
0xffbedec8, 0x1, 0x0), at 0xfdd065bc
  [11] SetAttribute__12nsXULElementRC8nsStringT1(0x3d99d0, 0xffbedf60,
0xffbedec8, 0xfdd02584, 0xff3e0000, 0xfd2c1674), at 0xfdd026a0
  [12] OpenMenu__11nsMenuFramei(0x54845c, 0x1, 0x5484b4, 0xfcd2bdf8, 0x0,
0xfdd0668c), at 0xfcd2bec4
  [13] ToggleMenuState__11nsMenuFrame(0x54845c, 0xfcd2b740, 0xfcd30d48,
0x54840c, 0x2, 0xffbee450), at 0xfcd2b780
  [14]
HandleEvent__11nsMenuFrameP14nsIPresContextP10nsGUIEventP13nsEventStatus(0x54845c,
0x232358, 0xffbee660, 0xffbee450, 0xfcd2b168, 0xffbee450), at 0xfcd2b264
  [15]
HandleEventInternal__9PresShellP7nsEventP7nsIViewP13nsEventStatus(0x24c498,
0xffbee660, 0x149750, 0xffbee450, 0x24c4e8, 0xfcb90dd4), at 0xfcb82548
  [16] HandleEvent__9PresShellP7nsIViewP10nsGUIEventP13nsEventStatusRi(0x0,
0x149750, 0xffbee660, 0xffbee450, 0xffbee3a4, 0xfcb82164), at 0xfcb82340
  [17] HandleEvent__6nsViewP10nsGUIEventUiP13nsEventStatusRi(0x149750,
0xffbee660, 0x1c, 0xffbee450, 0xffbee3a4, 0xfc472da8), at 0xfc472f6c
  [18] DispatchEvent__14nsViewManager2P10nsGUIEventP13nsEventStatus(0x149690,
0xffbee660, 0xffbee450, 0xfc483b30, 0x0, 0x0), at 0xfc48413c
  [19] HandleEvent(0xffbee660, 0xfc47180c, 0x24c1f8, 0x0, 0x17460, 0x0), at
0xfc471858
  [20] DispatchEvent__8nsWidgetP10nsGUIEventR13nsEventStatus(0x24c1f8,
0xffbee660, 0xffbee53c, 0xfdbbcc24, 0xff3e0000, 0xfec30494), at 0xfdbbcc90
  [21] DispatchWindowEvent__8nsWidgetP10nsGUIEvent(0x24c1f8, 0xffbee660,
0xfdc2c404, 0x0, 0x696e00, 0x0), at 0xfdbbcba0
  [22] DispatchMouseEvent__8nsWidgetR12nsMouseEvent(0x24c1f8, 0xffbee660,
0xffbee660, 0x12e, 0x0, 0x0), at 0xfdbbcd40
  [23] OnButtonPressSignal__8nsWidgetP15_GdkEventButton(0x24c1f8, 0xdbca0,
0xfdbbdc0c, 0xfe292208, 0x0, 0xfd897958), at 0xfdbbde0c
  [24] HandleGDKEvent__8nsWindowP9_GdkEvent(0x24c1f8, 0xdbca0, 0x1, 0x4, 0x0,
0x6400068), at 0xfdbc2124
  [25] dispatch_superwin_event(0xdbca0, 0x24c1f8, 0xf07c0, 0xffbee8cc, 0x20,
0xcd1d8), at 0xfdbb6790
  [26] handle_gdk_event__FP9_GdkEventPv(0xdbca0, 0x0, 0xfdbb63f4, 0xcd1d8,
0xf07c0, 0x0), at 0xfdbb65c8
  [27] gdk_event_dispatch(0xdbca0, 0xffbeea10, 0x0, 0x0, 0x3, 0xffbee988), at
0xfd94d284
  [28] g_main_dispatch(0xfdb6c860, 0xfdb6c8f4, 0x43c, 0xfdb6c8f8, 0xa80,
0xffbeea10), at 0xfdb47498
  [29] g_main_iterate(0xfdb6c860, 0x494, 0xfdb6c8f4, 0x0, 0x4dc, 0x1), at
0xfdb47cc4
  [30] g_main_run(0x145a08, 0x145a08, 0x0, 0x0, 0xff0f1c78, 0x0), at 0xfdb47ed4
  [31] gtk_main(0x0, 0xef688, 0x1, 0xfdbae618, 0x0, 0x0), at 0xfda48db0
  [32] Run__10nsAppShell(0x35868, 0xfdbae520, 0x35868, 0xfec9d920, 0x0, 0xffe),
at 0xfdbae574
  [33] Run__17nsAppShellService(0xb4ee8, 0xfe223834, 0xb4ee8, 0xfd838944, 0x3f8,
0x1), at 0xfe223848
  [34] main1(0x0, 0xff2df2b0, 0x0, 0x2, 0x100d4, 0x0), at 0x16fa0
  [35] main(0x1, 0xffbeee0c, 0xffbeee14, 0x316b0, 0x0, 0x0), at 0x174a4

Comment 1

[leger]

Adding crash to keyword field.

Comment 2

[Andreas Franke (gone)]

Reassigning to [e-mail] because this is a dup of bug 40045 
("crash when click menus (when using native not gfx scrollbars)".
Symptoms and stack trace are the same; the only difference is that this
bug is reported on Sun/Solaris.
Rubber-stamping confirmed.

Comment 3

[John Morrison]

Yes, this is a dup -- happens on linux, solaris and win32 (and probably any
unix derivative).

*** This bug has been marked as a duplicate of 40045 ***

Comment 4

[John Morrison]

verified. Workaround is to use the gfx scrollbars.