474303 - leave_notify_event_cb() tries to AddRef already released window

Status: VERIFIED FIXED

(Core :: Widget: Gtk, defect)

Description

[Martin Stránský [:stransky] (ni? me)]

Attachment: complete bactrace

Downstream bug: https://bugzilla.redhat.com/show_bug.cgi?id=480046

get_window_for_gdk_window() called from leave_notify_event_cb() returns reference to already released nsWindow structure:

(gdb) f 1
#1  0x02e3922c in leave_notify_event_cb (widget=0xb7a58e18, event=0xb1ff8ad0) at nsWindow.cpp:4614
4614	    nsRefPtr<nsWindow> window = get_window_for_gdk_window(event->window);

(gdb) p ((nsBaseWidget*)window.mRawPtr).mRefCnt
$4 = {mValue = 1515870810}

#1  0x02e3922c in leave_notify_event_cb (widget=0xb7a58e18, event=0xb1ff8ad0) at nsWindow.cpp:4614
4614	    nsRefPtr<nsWindow> window = get_window_for_gdk_window(event->window);
(gdb) l
4609	    GdkWindow* winAtPt = gdk_display_get_window_at_pointer(display, &x, &y);
4610	    if (winAtPt == event->window) {
4611	        return TRUE;
4612	    }
4613	
4614	    nsRefPtr<nsWindow> window = get_window_for_gdk_window(event->window);
4615	    if (!window)
4616	        return TRUE;
4617	
4618	    window->OnLeaveNotifyEvent(widget, event);

Comment 1

[Martin Stránský [:stransky] (ni? me)]

Testcase URL is at http://mattmccutchen.net/private/crash-firefox.git/?a=project_list
and it works even if you save it locally as complete web page. It usually crashes after some page reloads.

Comment 2

[Martin Stránský [:stransky] (ni? me)]

Complete firefox log is here:

http://people.redhat.com/stransky/log/log.tar.gz

Already destroyed nsWindow is:

(gdb) p window
$5 = {mRawPtr = 0xb2ff05e0}

Comment 3

[Martin Stránský [:stransky] (ni? me)]

The affected (already destroyed) nsWindow is a drawing area but its inner_window still gets leave_notify_event from GTK...maybe some wrong ref count of mDrawingarea

Comment 4

[Martin Stránský [:stransky] (ni? me)]

This bug happens when is destroyed but mDrawingarea->inner_window still has non NULL "nsWindow" pointer after mDrawingarea destruction...

In 1.9.1 it's fixed by patch for https://bugzilla.mozilla.org/show_bug.cgi?id=451341

by this:

--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -518,31 +518,41 @@ nsWindow::Destroy(void)
     // the surface after its X Window.
     mThebesSurface = nsnull;
 
     if (mDragMotionTimerID) {
         gtk_timeout_remove(mDragMotionTimerID);
         mDragMotionTimerID = 0;
     }
 
+    if (mDrawingarea) {
+        g_object_set_data(G_OBJECT(mDrawingarea->clip_window),
+                          "nsWindow", NULL);
+        g_object_set_data(G_OBJECT(mDrawingarea->inner_window),
+                          "nsWindow", NULL);
+
+        g_object_set_data(G_OBJECT(mDrawingarea->clip_window),
+                          "mozdrawingarea", NULL);
+        g_object_set_data(G_OBJECT(mDrawingarea->inner_window),
+                          "mozdrawingarea", NULL);
+
+        g_object_unref(mDrawingarea);
+        mDrawingarea = nsnull;
+    }
+
     if (mShell) {
         gtk_widget_destroy(mShell);
         mShell = nsnull;
         mContainer = nsnull;
     }
     else if (mContainer) {
         gtk_widget_destroy(GTK_WIDGET(mContainer));
         mContainer = nsnull;
     }
 
-    if (mDrawingarea) {
-        g_object_unref(mDrawingarea);
-        mDrawingarea = nsnull;
-    }
-

Comment 5

[Martin Stránský [:stransky] (ni? me)]

Attachment: testcase

There's a testcase there but unfortunately not very reliable. Works better when it's opened in new browser window, crashes in 50% cases.

Comment 6

[Martin Stránský [:stransky] (ni? me)]

Patch from https://bugzilla.mozilla.org/show_bug.cgi?id=451341#c24 fixes this one for me.

Comment 7

[Martin Stránský [:stransky] (ni? me)]

Can't reproduce with 1.8.

Comment 8

[Daniel Veditz [:dveditz]]

Marking fixed per comment 6 for verification.

Comment 9

[Al Billings [:abillings - ex-MoCo]]

I can't reproduce this on Ubuntu with 1.9.0.10 no matter how many times I try. I've opened it in new windows as well as tabs. No crashes at all.

Comment 10

[Martin Stránský [:stransky] (ni? me)]

Try to open the testcase from bookmarks or from history, it makes the crash more reproducible.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

I've tried this and still, no luck. If you can reproduce it on your system, can you try using last night's 1.9.0.11pre build and seeing if your crash goes away?

Comment 12

[Martin Stránský [:stransky] (ni? me)]

Yes, I can confirm the fix in 1.9.0.11pre from 2009-05-17-04-mozilla1.9.0.

Comment 13

[Al Billings [:abillings - ex-MoCo]]

Thanks, Martin. Marking verified for 1.9.0.11.