566857 - Firefox/Thunderbird crashes at exit [@ MOZ_gdk_display_close() ]

Status: RESOLVED INCOMPLETE

(Core :: Widget: Gtk, defect)

Description

[Martin Stránský [:stransky] (ni? me)]

Firefox/Thunderbird crashes at exit, Fedora 13/12, system cairo/pango.

cairo-1.8.8
pango-1.26.2

Backtrace from debug trunk build:

#7  0x00527d71 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#8  0x0052964a in abort () at abort.c:92
#9  0x00520de8 in __assert_fail (assertion=0x649e0f9 "hash_table->live_entries == 0", file=0x649e0a4 "cairo-hash.c", line=
    199, function=0x649e33b "_cairo_hash_table_destroy") at assert.c:81
#10 0x064502fb in _cairo_hash_table_destroy (hash_table=<value optimized out>) at cairo-hash.c:199
#11 0x06463047 in _cairo_scaled_font_map_destroy () at cairo-scaled-font.c:392
#12 0x0644b70d in _cairo_font_face_reset_static_data () at cairo-font-face.c:767
#13 0x0644b46c in cairo_debug_reset_static_data () at cairo-debug.c:64
#14 0x012822e4 in MOZ_gdk_display_close (display=0xb7653140) at nsAppRunner.cpp:2668
#15 0x01284dbb in XRE_main (argc=3, argv=0xbfac6384, aAppData=0xb760e380) at nsAppRunner.cpp:3659
#16 0x08049817 in main (argc=3, argv=0xbfac6384) at nsBrowserApp.cpp:158

We have many reports about it, I can reproduce it with 50% reliability.

Comment 1

[Felix Schwarz]

I'd like to add that 'many reports' means > 190 reported crashes at Fedora's bugzilla.

Comment 2

[Karl Tomlinson (:karlt)]

Comment 0 indicates that a cairo scaled font is leaking.
Bug 503924 and/or bug 508149 may be related.
That code is only run if
defined(DEBUG) || defined(NS_BUILD_REFCNT_LOGGING) || defined(NS_TRACE_MALLOC)
which is not usually release builds.

That's is quite unrelated to the stack at
https://bugzilla.redhat.com/attachment.cgi?id=375178

Is that the stack that is associated with recent reports?

Comment 3

[Karl Tomlinson (:karlt)]

> #5  0x00007f8b338fcec3 in g_utf8_prev_char () at gutf8.c:191
> No symbol table info available.
> #6  0x00007f8b338fcf5b in g_utf8_prev_char () at gutf8.c:191
> No symbol table info available.

I don't know where the line numbers come from when there is no symbol table.
However, I doubt these are the real functions, and getting the real function names (probably from libglib-2.0.so), might be helpful.

Comment 4

[Karl Tomlinson (:karlt)]

https://bugzilla.redhat.com/attachment.cgi?id=412845 is different again, involving inotify.

Comment 5

[Karl Tomlinson (:karlt)]

https://bugzilla.redhat.com/attachment.cgi?id=409043 is different again, XI_BadDevice during X_CloseDevice.

Comment 6

[Karl Tomlinson (:karlt)]

https://bugzilla.redhat.com/show_bug.cgi?id=581114 is bug 504115.

Comment 7

[Karl Tomlinson (:karlt)]

Bug 504115 looks like the most common recently reported crash.  See bug 504115 comment 7 for how to fix it in gtkimcontextxim.c.  That might be easier than getting Adobe to add gtk_im_context_set_client_window(context, NULL) calls.

Comment 8

[Felix Schwarz]

Karl: (In reply to comment #7)
> Bug 504115 looks like the most common recently reported crash.

This bug seems to be private, I guess that was a conscious decision and not just an oversight?

Comment 9

[Martin Stránský [:stransky] (ni? me)]

Unfortunately the bug I referenced at Red Hat bugzilla is composed from various crash reports and the dupes are not always correct. I hope Bug 562570 is going to be solved soon and we can provide crash reports directly to mozilla.

Comment 10

[Karl Tomlinson (:karlt)]

(In reply to comment #8)
> This bug seems to be private, I guess that was a conscious decision and not
> just an oversight?

Sorry, not an oversight.

The good news though is that out-of-process plugins will workaround the shutdown crash.  That feature is expected in Firefox 3.6.4.

Comment 11

[Karl Tomlinson (:karlt)]

(In reply to comment #5)
> https://bugzilla.redhat.com/attachment.cgi?id=409043 is different again,
> XI_BadDevice during X_CloseDevice.

That is a GDK or inputproto bug.  A workaround was applied in bug 576933.

I'll mark this bug as incomplete because it is not clear which crash this bug is tracking.  Better to file individual bugs for different crashes.