464637 - firefox crashed while dragging [@ nsRefPtr - leave_notify_event_cb]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect)

Description

[Aaron Whitehouse]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008101315 Ubuntu/8.10 (intrepid) Firefox/3.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008101315 Ubuntu/8.10 (intrepid) Firefox/3.0.3

From https://bugs.launchpad.net/ubuntu/+source/firefox-3.0/+bug/274863 with five duplicates:
"Binary package hint: firefox-3.0

Attempting to add a comment in launchpad to another bug, I clicked on the 'log in' button, whereupon Firefox froze, greyed out and then crashed.

ProblemType: Crash
Architecture: amd64
DistroRelease: Ubuntu 8.10
ExecutablePath: /usr/lib/firefox-3.0.3/firefox
NonfreeKernelModules: nvidia
Package: firefox-3.0 3.0.3+build1+nobinonly-0ubuntu1
ProcAttrCurrent: unconfined
ProcCmdline: /usr/lib/firefox-3.0.3/firefox
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_AU.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: firefox-3.0
StacktraceTop:
 ?? () from /usr/lib/xulrunner-1.9.0.3/libxul.so
 ?? () from /usr/lib/xulrunner-1.9.0.3/libxul.so
 ?? () from /usr/lib/libgtk-x11-2.0.so.0
 g_closure_invoke ()
 ?? () from /usr/lib/libgobject-2.0.so.0
Title: firefox crashed with SIGSEGV in g_closure_invoke()
Uname: Linux 2.6.27-4-generic x86_64
UserGroups: adm admin cdrom dialout fuse lpadmin plugdev sambashare"

Stacktrace available here:
http://launchpadlibrarian.net/17984130/ThreadStacktrace.txt

There is a lot of information in the five duplicates if more is necessary.

Reproducible: Couldn't Reproduce

Steps to Reproduce:
1.
2.
3.
Actual Results:  
FF greys and crashes.

Comment 1

[timeless]

http://launchpadlibrarian.net/17984123/Stacktrace.txt seems like a slightly less confusing url to start from.

for reference, you really should update summaries as bugs evolve (this includes the Ubuntu bug). e.g. "Apport retracing service" told you which functions actually crashed. and asac told you what you were doing.

http://mxr.mozilla.org/mozilla-central/source/xpcom/base/nsAutoPtr.h?mark=980-980#975

so we have a window pointer which isn't a valid nsWindow (and possibly not even related to nsISupports)....

#3  0x00007f3887f958ce in nsRefPtr (this=<value optimized out>, aRawPtr=0x2308bd0)
	window = {mRawPtr = 0x2308bd0}
#9  0x00007f388542ab33 in IA__g_signal_emit (instance=0x2308bd0, signal_id=36735952, detail=18253296)
#20 0x00007f388542ab33 in IA__g_signal_emit (instance=0x2308bd0, signal_id=36735952, detail=18253296)
#36 0x00007f3887917336 in nsInputStreamPump::OnInputStreamReady (this=0x34edf80, stream=0x2308bd0)
#39 0x00007f3888024d0e in NS_ProcessNextEvent_P (thread=0x2308bd0, mayWait=1) at nsThreadUtils.cpp:227
#54 0x00007f3888e8cda7 in js_Interpret (cx=0x371d250) at jsinterp.c:4857
	str = (JSString *) 0x2308bd0
#79 0x00007f3888024d0e in NS_ProcessNextEvent_P (thread=0x2308bd0, mayWait=1) at nsThreadUtils.cpp:227

I presume you're using a 32bit version of firefox?

Comment 2

[Karl Tomlinson (:karlt)]

This will be fixed in 1.9.0.11.