476702 - Firefox crashes if I try to drag text/graphics on page [libgobject-2.0.so.0.1800.4@0xbd10]

Status: RESOLVED WORKSFORME

(Core :: DOM: Copy & Paste and Drag & Drop, defect)

Description

[Alexander Borovsky]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3pre) Gecko/20090203 Shiretoko/3.1b3pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3pre) Gecko/20090203 Shiretoko/3.1b3pre

Firefox crashes very offen if I try drag some page elements.

Reproducible: Always

Steps to Reproduce:
1. Open any page
2. Select some text / graphics on page
3. Try to drag it, rearrange tabs

Actual Results:  
Crash

Expected Results:  
Drag complete sucessfully

http://crash-stats.mozilla.com/report/index/8cf48cc2-d90a-4302-94d1-824022090203
http://crash-stats.mozilla.com/report/index/1777bf33-43ab-41dd-be8f-ec7e72090203

Comment 1

[Tyler Downer [He/Him]]

Are you seeing Bug 476492?

Comment 2

[Alexander Borovsky]

OS/X doesn't crashed in my case. Crashes only firefox.

I think it's different problem: This crash occurs only in 3.1 branch starting FF3.1b1 and not reproducable on official FF3.0.*.

Comment 3

[Tyler Downer [He/Him]]

Can you give an example URL that you are seeing this in Safe Mode with?

Comment 4

[Alexander Borovsky]

I reproduced it on  http://www.mozilla.org/projects/shiretoko/ in safe mode 
(250cbe5c-f4e3-465d-b117-583462090206).

One time it reproduced from first time, in other case it reproduced in one minute.

But in any case I see following console diagnostic for each drag:
(firefox-bin:9048): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed

(firefox-bin:9048): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

Comment 5

[Tyler Downer [He/Him]]

What text are you dragging and where you are dragging it too?

Comment 6

[Alexander Borovsky]

In some cases I dragged globe, in some cases I selected some text and pictures and drag them over the page.

In any case crash occurs when I start dragging.

Comment 7

[cmtalbert]

No crash for me dragging images and text and rearranging tabs on these builds:
* Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3pre) Gecko/20090206 Shiretoko/3.1b3pre
* Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20090206 Minefield/3.2a1pre

Alexander: we need very specific steps if you want us to fix this bug.  Otherwise, we can't confirm it and if we can't confirm it, we can't fix it.  Thanks for helping us out. Tell us, what page you went to, what you clicked on to drag, where you drug it to - elsewhere on the HTML page? into the toolbar of firefox? onto your desktop?  We need all this information. Thanks.

Comment 8

[Tyler Downer [He/Him]]

A screencast of this bug in action would be cool, that way we can see every step of the bug, and try to repro it.

Comment 9

[Alexander Borovsky]

Attachment: Screencast with bug reproducing

Comment 10

[Alexander Borovsky]

GDB session for crash:

(gdb) info threads
  7 process 9914  0x4689ea3e in g_type_check_instance_is_a ()
   from /usr/lib/libgobject-2.0.so.0
  6 process 9918  0x463026ad in poll () from /lib/libc.so.6
  5 process 9919  0x463ce808 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
  4 process 9921  0x463ce808 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
  3 process 9923  0x463ce4f0 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
  2 process 9924  0x463ce4f0 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
* 1 process 9925  0x463ce4f0 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
(gdb) thread 7
[Switching to thread 7 (process 9914)]#0  0x4689ea3e in g_type_check_instance_is
_a () from /usr/lib/libgobject-2.0.so.0
(gdb) bt
#0  0x4689ea3e in g_type_check_instance_is_a ()
   from /usr/lib/libgobject-2.0.so.0
#1  0x46885d25 in g_object_ref () from /usr/lib/libgobject-2.0.so.0
#2  0x467cfb87 in g_list_foreach () from /lib/libglib-2.0.so.0
#3  0x46d0d0e5 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#4  0xb1bffbc0 in ?? ()
#5  0x46885cf0 in ?? () from /usr/lib/libgobject-2.0.so.0
#6  0x00000000 in ?? ()

Comment 11

[Tyler Downer [He/Him]]

Thanks for the screencast. This seems kinda temperamental. Can you do one more thing and create a new profile, http://support.mozilla.com/kb/profile has more info. Don't make any changes to it, and try to make it crash there. Thanks.

Comment 12

[Alexander Borovsky]

Some crashes before I created new profile (renamed ~/.mozilla).

Comment 13

[Wayne Mery (:wsmwk)]

Alexander, can you still reproduce using current version?

Comment 14

[Alexander Borovsky]

No, this bug is not reproduced