Closed Bug 443637 Opened 16 years ago Closed 16 years ago

crashes on closing of a tab

Categories

(Core :: Disability Access APIs, defect)

x86
Linux
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 432467

People

(Reporter: mcepl, Unassigned)

Details

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9) Gecko/2008061721 Fedora/3.0-1.fc10 Firefox/3.0
Build Identifier: firefox-3.0-1.fc9.x86_64 xulrunner-1.9-1.fc9.x86_64 

Crash log is:

Program received signal SIGSEGV, Segmentation fault.
0x00000039517e3e80 in ReleaseObjects (aElement=<value optimized out>)
    at nsCOMArray.cpp:151
151         NS_IF_RELEASE(element);
#2  <signal handler called>
#3  0x00000039517e3e80 in ReleaseObjects (aElement=<value optimized out>)
    at nsCOMArray.cpp:151
#4  0x00000039517e68f0 in nsVoidArray::EnumerateForwards (this=<value optimized
out>, 
    aFunc=<value optimized out>, aData=<value optimized out>) at nsVoidArray.cpp:678
#5  0x00000039517e3e9c in nsCOMArray_base::Clear (this=<value optimized out>)
    at nsCOMArray.cpp:158
#6  0x0000003951786866 in nsDocAccessible::FlushPendingEvents (
    this=<value optimized out>) at ../../../dist/include/xpcom/nsCOMArray.h:217
#7  0x0000003951818ee2 in nsTimerImpl::Fire (this=<value optimized out>)
    at nsTimerImpl.cpp:400
#8  0x0000003951818f49 in nsTimerEvent::Run (this=<value optimized out>)
    at nsTimerImpl.cpp:490
#9  0x0000003951816a9e in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:510
#10 0x00000039517e82f6 in NS_ProcessNextEvent_P (thread=<value optimized out>, 
    mayWait=<value optimized out>) at nsThreadUtils.cpp:227
#11 0x000000395176010d in nsBaseAppShell::Run (this=<value optimized out>)
    at nsBaseAppShell.cpp:170
#12 0x00000039516235bd in nsAppStartup::Run (this=<value optimized out>)
    at nsAppStartup.cpp:181
#13 0x000000395101f73b in XRE_main (argc=<value optimized out>, 
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3154
#14 0x0000000000401665 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#15 0x0000003ce241e32a in __libc_start_main (main=<value optimized out>, 
    argc=<value optimized out>, ubp_av=<value optimized out>, 
    init=<value optimized out>, fini=<value optimized out>, 
    rtld_fini=<value optimized out>, stack_end=Could not find the frame base for
"__libc_start_main".
) at libc-start.c:220
#16 0x0000000000401159 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#17 0x00007fff0df62378 in ?? ()
#18 0x000000000000001c in ?? ()
#19 0x0000000000000001 in ?? ()
#20 0x00007fff0df62729 in ?? ()
#21 0x0000000000000000 in ?? ()

Another crash log:

Program received signal SIGABRT, Aborted.
0x0000003ce2432215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64        return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
#0  0x0000003ce2432215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x0000003ce2433d83 in abort () at abort.c:88
#2  0x0000003ce2472858 in __libc_message (do_abort=<value optimized out>,
    fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
#3  0x0000003ce2478158 in malloc_printerr (action=<value optimized out>,
    str=<value optimized out>, ptr=<value optimized out>) at malloc.c:5949
#4  0x0000003ce247a796 in __libc_free (mem=<value optimized out>) at malloc.c:3625
#5  0x000000000118af9e in nsAccessNode::Release (this=0x7023) at
nsAccessNode.cpp:120
#6  0x0000000001190e9c in nsDocAccessible::FlushPendingEvents (this=0x7f011c2028d0)
    at nsDocAccessible.cpp:1640
#7  0x000000000122350e in nsTimerImpl::Fire (this=0x7f0117c3a470)
    at nsTimerImpl.cpp:400
#8  0x0000000001223575 in nsTimerEvent::Run (this=<value optimized out>)
    at nsTimerImpl.cpp:490
#9  0x00000000012210ca in nsThread::ProcessNextEvent (this=0x2579060, mayWait=1,
    result=0x7fff2d2b4c9c) at nsThread.cpp:510
#10 0x00000000011f2922 in NS_ProcessNextEvent_P (thread=0x7023, mayWait=1)
    at nsThreadUtils.cpp:227
#11 0x000000000116a739 in nsBaseAppShell::Run (this=0x2659ac0)
    at nsBaseAppShell.cpp:170
#12 0x000000000102d97d in nsAppStartup::Run (this=0x7f0120647090)
    bat nsAppStartup.cpp:181
#13 0x0000000000a29afb in XRE_main (argc=<value optimized out>,
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3154
#14 0x0000000000401665 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#15 0x0000003ce241e32a in __libc_start_main (main=<value optimized out>,
    argc=<value optimized out>, ubp_av=<value optimized out>,


Comment #2 From Bill Nottingham (notting@redhat.com) 	on 2008-06-18 23:09 EST 	[reply] 	Private

Still happens with 3.0-1 & xulrunner-1.9-1.

General trigger is:

1) have more than one tab
2) have a logged-in gmail window in one of those tabs
3) close said tab


---------
safe-mode does not crash.

Disabling all add-ons (AdblockPlus, CustomizeGoogle) and plugins (flash,
standard totem set, gcj) by hand and doing it still crashes.
-----------------

Comment #6 From Christopher Aillon (caillon@redhat.com) 	on 2008-07-02 16:12 EST 	[reply] 	Private

Also, the trace indicates this is a11y related.  I'd wager that turning off a11y
gets it to not crash... 


Comment #7 From Bill Nottingham (notting@redhat.com) 	on 2008-07-03 10:59 EST 	[reply] 	Private

Haven't seen it since turning off a11y a while ago.

Reproducible: Sometimes

Steps to Reproduce:
1. Open a bunch of tabs
2. Start closing them

Actual Results:  
Crash

Expected Results:  
tabs closed without crash
forgot to mention that this is originally Fedora Bug
https://bugzilla.redhat.com/show_bug.cgi?id=451309
Component: General → Disability Access APIs
QA Contact: general → accessibility-apis
should be a dupe of bug 432467
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.