Trunk crash [@ libgklayout.so](SEGV) upon leaving a java-enabled page (was: Segmentation fault (libgklayout.so), debugfriendly build?)

VERIFIED DUPLICATE of bug 74531

Status

Core Graveyard
Java: OJI
VERIFIED DUPLICATE of bug 74531
17 years ago
5 years ago

People

(Reporter: db, Assigned: James.Melvin)

Tracking

({crash, topcrash})

Trunk
x86
Linux
crash, topcrash

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: important to mozilla0.9?, crash signature, URL)

(Reporter)

Description

17 years ago
I can not use mozilla for a longer period of time, since it usually crashes
after maybe 15 minutes of use. The sad thing is that it doesn't happen in the
same place, it just happens after some use.

I got the data below from the debugger but I guess it's useless. I've sent data
like this before and then other people have recreated the seg. fault on their
build of mozilla and gotten the correct backtrace. If you would provide a
nightly build of mozilla with a build that gives correct backtrace and debug
info out I would run it (as usual, size doesn't matter) and then be able to give
better reports back. This is what i got with mozilla 2001040605:

So this bug is more a request for a debugfriendly nightly build then a bug
report since I guess it's useless as bugreport, or isn't it?

Program received signal SIGSEGV, Segmentation fault.
0x40f978ed in NSGetModule () from /home/dennis/bin/mozilla/components/libgklayout.so
(gdb) backtrace
#0  0x40f978ed in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#1  0x40f97ae9 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#2  0x40f94191 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#3  0x40f7873f in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#4  0x40f760c6 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#5  0x40f947cc in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#6  0x40f8fbd8 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#7  0x40f6c64f in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#8  0x40f8fbd8 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#9  0x40f6c64f in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#10 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#11 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#12 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#13 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#14 0x40fb42f9 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#15 0x40f7e33c in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#16 0x40f9c41b in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#17 0x40f9c069 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#18 0x400c826f in nsCOMPtr_base::~nsCOMPtr_base () from
/home/dennis/bin/mozilla/./libxpcom.so
#19 0x40bccbe4 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgkcontent.so
#20 0x40bcc8dd in NSGetModule () from
/home/dennis/bin/mozilla/components/libgkcontent.so
#21 0x400c82bf in nsCOMPtr_base::assign_with_AddRef () from
/home/dennis/bin/mozilla/./libxpcom.so
#22 0x40a04085 in NSGetModule () from
/home/dennis/bin/mozilla/components/libdocshell.so
#23 0x40a0f145 in NSGetModule () from
/home/dennis/bin/mozilla/components/libdocshell.so
#24 0x40fb85a8 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#25 0x40f7873f in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#26 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#27 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#28 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#29 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#30 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#31 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#32 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#33 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#34 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#35 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#36 0x40f8fbd8 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#37 0x40f6c64f in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#38 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#39 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#40 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#41 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#42 0x40fb42f9 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#43 0x40f7e33c in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#44 0x40f9c41b in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#45 0x40f9c069 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#46 0x400c826f in nsCOMPtr_base::~nsCOMPtr_base () from
/home/dennis/bin/mozilla/./libxpcom.so
#47 0x40bccbe4 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgkcontent.so
#48 0x40bcc8dd in NSGetModule () from
/home/dennis/bin/mozilla/components/libgkcontent.so
#49 0x400c82bf in nsCOMPtr_base::assign_with_AddRef () from
/home/dennis/bin/mozilla/./libxpcom.so
#50 0x40a04085 in NSGetModule () from
/home/dennis/bin/mozilla/components/libdocshell.so
#51 0x40a0f145 in NSGetModule () from
/home/dennis/bin/mozilla/components/libdocshell.so
#52 0x40fb85a8 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#53 0x40f7873f in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#54 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#55 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#56 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#57 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#58 0x41044c90 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#59 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#60 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#61 0x41044c90 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#62 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#63 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#64 0x41044c90 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#65 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#66 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#67 0x41044c90 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#68 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#69 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#70 0x41044c90 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#71 0x4105f628 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#72 0x40f760bf in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#73 0x40fb42f9 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#74 0x40f7e33c in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#75 0x40f9c41b in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#76 0x40f9c069 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgklayout.so
#77 0x400c826f in nsCOMPtr_base::~nsCOMPtr_base () from
/home/dennis/bin/mozilla/./libxpcom.so
#78 0x40bccbe4 in NSGetModule () from
/home/dennis/bin/mozilla/components/libgkcontent.so
#79 0x40bcc8dd in NSGetModule () from
/home/dennis/bin/mozilla/components/libgkcontent.so
#80 0x400c82bf in nsCOMPtr_base::assign_with_AddRef () from
/home/dennis/bin/mozilla/./libxpcom.so
#81 0x40a04085 in NSGetModule () from
/home/dennis/bin/mozilla/components/libdocshell.so
#82 0x40a0f145 in NSGetModule () from
/home/dennis/bin/mozilla/components/libdocshell.so
#83 0x4047c5ba in nsJSUtils::mCachedSecurityManager () from
/home/dennis/bin/mozilla/components/libnsappshell.so
#84 0x4048489f in nsJSUtils::mCachedSecurityManager () from
/home/dennis/bin/mozilla/components/libnsappshell.so
#85 0x40482c77 in nsJSUtils::mCachedSecurityManager () from
/home/dennis/bin/mozilla/components/libnsappshell.so
#86 0x40482e49 in nsJSUtils::mCachedSecurityManager () from
/home/dennis/bin/mozilla/components/libnsappshell.so
#87 0x404d9d6a in NSGetModule () from
/home/dennis/bin/mozilla/components/libwidget_gtk.so
#88 0x404de6c0 in NSGetModule () from
/home/dennis/bin/mozilla/components/libwidget_gtk.so
#89 0x405a6f3f in gtk_marshal_BOOL__POINTER () from /usr/lib/libgtk-1.2.so.0
#90 0x405d9318 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0
#91 0x405d86df in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#92 0x405d65f7 in gtk_signal_emit () from /usr/lib/libgtk-1.2.so.0
#93 0x4060f59c in gtk_widget_event () from /usr/lib/libgtk-1.2.so.0
#94 0x405a5d05 in gtk_main_do_event () from /usr/lib/libgtk-1.2.so.0
#95 0x404d4a6f in NSGetModule () from
/home/dennis/bin/mozilla/components/libwidget_gtk.so
#96 0x40659ab4 in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#97 0x40686bf6 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#98 0x40687213 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#99 0x406873dc in g_main_run () from /usr/lib/libglib-1.2.so.0
#100 0x405a576c in gtk_main () from /usr/lib/libgtk-1.2.so.0
#101 0x404ccd4c in NSGetModule () from
/home/dennis/bin/mozilla/components/libwidget_gtk.so
#102 0x4048113a in nsJSUtils::mCachedSecurityManager () from
/home/dennis/bin/mozilla/components/libnsappshell.so
#103 0x804d694 in JS_PushArguments ()
#104 0x804df25 in JS_PushArguments ()
#105 0x4025eb5c in __libc_start_main (main=0x804ddf8 <JS_PushArguments+13088>,
argc=1, ubp_av=0xbffff884, init=0x804a4e8 <_init>, fini=0x804f8b0 <_fini>,
rtld_fini=0x4000d634 <_dl_fini>, stack_end=0xbffff87c) at
../sysdeps/generic/libc-start.c:129

Comment 1

17 years ago
over to layout.  I recommend using the linux sea.tar builds.  They have a
Talkback Component which sends useful information including (usually) a stack
trace that I can access and put in bug reports.  
Status: UNCONFIRMED → NEW
Ever confirmed: true
(Reporter)

Comment 2

17 years ago
One way to trigger this is to go to

www.datorbutiken.com

press the swedish flag and then go to

www.inetdata.se

But it seems that it only crashes if the java-plugin is installed. I've been
using the plugin from netscape 6. Maybe someone can confirm this? Without the
java plugin it seems to not crash as much at all.

Comment 3

17 years ago
updating Component
Assignee: asa → edburns
Component: Browser-General → OJI
QA Contact: doronr → shrir

Comment 4

17 years ago
This doesn't crash today's trunk build on Solaris with JDK1.3.0_01.  Xiaobin,
can you try this on a non-debug linux trunk build with jdk1.3.0_01?

Thanks,

Ed
Assignee: edburns → xiaobin.lu

Comment 5

17 years ago
Actually, it does crash on Solaris, but only on leaving the page.

Comment 6

17 years ago
Here's a stack trace:

#0  0xfb9a725c in nsPluginInstanceOwner::~nsPluginInstanceOwner (
    this=0x838810, __in_chrg=3) at nsObjectFrame.cpp:1496
#1  0xfb9a7818 in nsPluginInstanceOwner::Release (this=0x838810)
    at nsObjectFrame.cpp:1573
#2  0xfb9a2198 in nsObjectFrame::~nsObjectFrame (this=0x91d848, __in_chrg=3)
    at nsObjectFrame.cpp:261
#3  0xfb95fecc in nsFrame::Destroy (this=0x91d848, aPresContext=0x919a48)
    at nsFrame.cpp:427
#4  0xfb958928 in nsContainerFrame::Destroy (this=0x91d848, 
    aPresContext=0x919a48) at nsContainerFrame.cpp:98
#5  0xfb9a2ef8 in nsObjectFrame::Destroy (this=0x91d848, aPresContext=0x919a48)
    at nsObjectFrame.cpp:465
#6  0xfb99770c in nsLineBox::DeleteLineList (aPresContext=0x919a48, 
    aLine=0x91d9ec) at nsLineBox.cpp:251
#7  0xfb941b6c in nsBlockFrame::Destroy (this=0x91d4ac, aPresContext=0x919a48)
    at nsBlockFrame.cpp:1240
#8  0xfb99770c in nsLineBox::DeleteLineList (aPresContext=0x919a48, 
    aLine=0x91d4f8) at nsLineBox.cpp:251
#9  0xfb941b6c in nsBlockFrame::Destroy (this=0x91d424, aPresContext=0x919a48)
    at nsBlockFrame.cpp:1240
#10 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x91d420, 
    aPresContext=0x919a48) at nsFrameList.cpp:41
#11 0xfb958918 in nsContainerFrame::Destroy (this=0x91d3ec, 
    aPresContext=0x919a48) at nsContainerFrame.cpp:95
#12 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x91d3e4, 
    aPresContext=0x919a48) at nsFrameList.cpp:41
#13 0xfb958918 in nsContainerFrame::Destroy (this=0x91d3b0, 
    aPresContext=0x919a48) at nsContainerFrame.cpp:95
#14 0xfb9e82bc in ViewportFrame::Destroy (this=0x91d3b0, aPresContext=0x919a48)
    at nsViewportFrame.cpp:141
#15 0xfb9700b8 in FrameManager::Destroy (this=0x8c6b78)
    at nsFrameManager.cpp:421
#16 0xfb9b1088 in PresShell::~PresShell (this=0x8c6358, __in_chrg=3)
    at nsPresShell.cpp:1409
#17 0xfb9b0b24 in PresShell::Release (this=0x8c6358) at nsPresShell.cpp:1318
#18 0xfdf5a160 in ?? () at ../../../dist/include/nsIDOMXULElement.h:47
   from /multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/./libjsdom.so
#19 0xfc89bc38 in DocumentViewerImpl::~DocumentViewerImpl (this=0x9093f0, 
    __in_chrg=3) at nsDocumentViewer.cpp:564
#20 0xfc89b700 in DocumentViewerImpl::Release (this=0x9093f0)
    at nsDocumentViewer.cpp:543
#21 0xfdf53400 in ?? () at ../../../dist/include/nsIDOMXULElement.h:47
   from /multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/./libjsdom.so
#22 0xfceeae74 in ?? () at ../../dist/include/nsCOMPtr.h:972
   from
/multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/components/libdocshell.so
#23 0xfcef8788 in ?? () at ../../dist/include/nsCOMPtr.h:649
   from
/multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/components/libdocshell.so
#24 0xfcec0058 in nsDocShell::Destroy (this=0x749108) at nsDocShell.cpp:1749
#25 0xfcedbbd8 in nsWebShell::Destroy (this=0x749108) at nsWebShell.cpp:1429
#26 0xfb9f03dc in nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame (
    this=0x8358d0, __in_chrg=3) at nsFrameFrame.cpp:503
#27 0xfb95fecc in nsFrame::Destroy (this=0x8358d0, aPresContext=0x8a9998)
    at nsFrame.cpp:427
#28 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x835850, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
---Type <return> to continue, or q <return> to quit---
#29 0xfb958918 in nsContainerFrame::Destroy (this=0x83581c, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#30 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x83564c, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
#31 0xfb958918 in nsContainerFrame::Destroy (this=0x835618, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#32 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x8354f4, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
#33 0xfb958918 in nsContainerFrame::Destroy (this=0x8354c0, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#34 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x8353d8, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
#35 0xfb958918 in nsContainerFrame::Destroy (this=0x8353a4, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#36 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x8352a0, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
#37 0xfb958918 in nsContainerFrame::Destroy (this=0x83526c, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#38 0xfb99770c in nsLineBox::DeleteLineList (aPresContext=0x8a9998, 
    aLine=0x835318) at nsLineBox.cpp:251
#39 0xfb941b6c in nsBlockFrame::Destroy (this=0x8351e4, aPresContext=0x8a9998)
    at nsBlockFrame.cpp:1240
#40 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x8351e0, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
#41 0xfb958918 in nsContainerFrame::Destroy (this=0x8351ac, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#42 0xfbb3d1f8 in nsFrameList::DestroyFrames (this=0x8351a4, 
    aPresContext=0x8a9998) at nsFrameList.cpp:41
#43 0xfb958918 in nsContainerFrame::Destroy (this=0x835170, 
    aPresContext=0x8a9998) at nsContainerFrame.cpp:95
#44 0xfb9e82bc in ViewportFrame::Destroy (this=0x835170, aPresContext=0x8a9998)
    at nsViewportFrame.cpp:141
#45 0xfb9700b8 in FrameManager::Destroy (this=0x7d5d20)
    at nsFrameManager.cpp:421
#46 0xfb9b1088 in PresShell::~PresShell (this=0x7d5940, __in_chrg=3)
    at nsPresShell.cpp:1409
#47 0xfb9b0b24 in PresShell::Release (this=0x7d5940) at nsPresShell.cpp:1318
#48 0xfdf5a160 in ?? () at ../../../dist/include/nsIDOMXULElement.h:47
   from /multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/./libjsdom.so
#49 0xfc89bc38 in DocumentViewerImpl::~DocumentViewerImpl (this=0x8a6e88, 
    __in_chrg=3) at nsDocumentViewer.cpp:564
#50 0xfc89b700 in DocumentViewerImpl::Release (this=0x8a6e88)
    at nsDocumentViewer.cpp:543
#51 0xfdf53400 in ?? () at ../../../dist/include/nsIDOMXULElement.h:47
   from /multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/./libjsdom.so
#52 0xfceeae74 in ?? () at ../../dist/include/nsCOMPtr.h:972
   from
/multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/components/libdocshell.so
#53 0xfcef8788 in ?? () at ../../dist/include/nsCOMPtr.h:649
   from
/multipak/disk3/edburns/Projects/trunk/mozilla/dist/bin/components/libdocshell.so
#54 0xfcec83c8 in nsDocShell::SetupNewViewer (this=0x5cc4c0, 
    aNewViewer=0xbc8258) at nsDocShell.cpp:3010
#55 0xfced49d4 in nsWebShell::SetupNewViewer (this=0x5cc4c0, aViewer=0xbc8258)
    at nsWebShell.cpp:350
#56 0xfcec5478 in nsDocShell::Embed (this=0x5cc4c0, aContentViewer=0xbc8258, 
    aCommand=0xfcf10018 "", aExtraInfo=0x0) at nsDocShell.cpp:2579
---Type <return> to continue, or q <return> to quit---
#57 0xfced4c40 in nsWebShell::Embed (this=0x5cc4c0, aContentViewer=0xbc8258, 
    aCommand=0xfcf10018 "", aExtraInfo=0x0) at nsWebShell.cpp:378
#58 0xfcec6af0 in nsDocShell::CreateContentViewer (this=0x5cc4c0, 
    aContentType=0xffbee908 "text/html", request=0x666fa0, 
    aContentHandler=0xffbee988) at nsDocShell.cpp:2855
#59 0xfcedd1bc in nsDSURIContentListener::DoContent (this=0x5c7610, 
    aContentType=0xffbee908 "text/html", aCommand=2, 
    aWindowTarget=0xff257880 "", request=0x666fa0, aContentHandler=0xffbee988, 
    aAbortProcess=0xffbee948) at nsDSURIContentListener.cpp:104
#60 0xfd024b00 in nsDocumentOpenInfo::DispatchContent (this=0xc01490, 
    request=0x666fa0, aCtxt=0x0) at nsURILoader.cpp:372
#61 0xfd0240f4 in nsDocumentOpenInfo::OnStartRequest (this=0xc01490, 
    request=0x666fa0, aCtxt=0x0) at nsURILoader.cpp:241
#62 0xfd3c53e0 in nsHTTPFinalListener::OnStartRequest (this=0xad4870, 
    aRequest=0x666fa0, aContext=0x0) at nsHTTPResponseListener.cpp:1093
#63 0xfd353630 in nsStreamListenerTee::OnStartRequest (this=0x950188, 
    request=0x666fa0, context=0x0) at nsStreamListenerTee.cpp:12
#64 0xfd3c4bb0 in nsHTTPServerListener::FinishedResponseHeaders (this=0x8acab0)
    at nsHTTPResponseListener.cpp:1025
#65 0xfd3c2014 in nsHTTPServerListener::OnDataAvailable (this=0x8acab0, 
    request=0xbdfc40, context=0x666fa0, i_pStream=0xbab108, i_SourceOffset=0, 
    i_Length=3245) at nsHTTPResponseListener.cpp:415
#66 0xfd3311c4 in nsOnDataAvailableEvent::HandleEvent (this=0x8ad4c0)
    at nsStreamListenerProxy.cpp:173
#67 0xfd330010 in nsARequestObserverEvent::HandlePLEvent (plev=0x8ad4c0)
    at nsRequestObserverProxy.cpp:63
#68 0xff16f3f8 in PL_HandleEvent (self=0x8ad4c0) at plevent.c:588
#69 0xff16f11c in PL_ProcessPendingEvents (self=0x52b40) at plevent.c:518
#70 0xff172078 in nsEventQueueImpl::ProcessPendingEvents (this=0x73d38)
    at nsEventQueue.cpp:361
#71 0xfdc3f7a4 in event_processor_callback (data=0x73d38, source=5, 
    condition=GDK_INPUT_READ) at nsAppShell.cpp:168
#72 0xfdc3f16c in our_gdk_io_invoke (source=0x21c980, condition=G_IO_IN, 
    data=0x21cf00) at nsAppShell.cpp:61
#73 0xfd975a10 in g_io_unix_dispatch (source_data=0x222648, 
    current_time=0xffbef268, user_data=0x21cf00) at giounix.c:135
#74 0xfd9776ec in g_main_dispatch (current_time=0xffbef268) at gmain.c:656
#75 0xfd977f74 in g_main_iterate (block=-40252156, dispatch=1) at gmain.c:874
#76 0xfd978188 in g_main_run (loop=0x21ced0) at gmain.c:932
#77 0xfdac9b54 in gtk_main () at gtkmain.c:476
#78 0xfdc40134 in nsAppShell::Run (this=0x76738) at nsAppShell.cpp:360
#79 0xfe8c3e58 in nsAppShellService::Run (this=0x95f88)
    at nsAppShellService.cpp:407
#80 0x22df0 in main1 (argc=1, argv=0xffbef6f4, nativeApp=0x0)
    at nsAppRunner.cpp:1030
#81 0x24148 in main (argc=1, argv=0xffbef6f4) at nsAppRunner.cpp:1325

Comment 7

17 years ago
I'm finding that it's segfaulting when NS_RELEASING the nsIPluginInstance that
is the java plugin.  This is here:

nsObjectFrame.cpp:1492

  if (nsnull != mInstance)
  {
    if (mPluginHost)
      mPluginHost->StopPluginInstance(mInstance);
    NS_RELEASE(mInstance);
  }

This translates to the release method in 

/net/jano/export/disk02/deployment/ws/ladybird/ext/plugin/oji-plugin/src/motif/navig5/JavaPluginInstance5.cpp

I believe.  I'm re-assinging this to Jim so his team can look at it.

Ed
Assignee: xiaobin.lu → James.Melvin

Comment 8

17 years ago
*** Bug 75515 has been marked as a duplicate of this bug. ***

Comment 9

17 years ago
It turns out that in the case of a page with more than one applet, only the
NS_RELEASE(mInstance) call on the last applet will crash.

Comment 10

17 years ago
This seems to be happening for everyone on *ix Systems when exiting a page with
a Java Plugin, interpreting what I read in bug 75515.
Should we nominate this for 0.9?

Comment 11

17 years ago
change subject to be more accurate.
Summary: Segmentation fault (libgklayout.so), debugfriendly build? → Crash (SEGV) upon leaving a java-enabled page (was: Segmentation fault (libgklayout.so), debugfriendly build?)

Comment 12

17 years ago
*** Bug 75862 has been marked as a duplicate of this bug. ***

Comment 13

17 years ago
Jim, can you please have someone from your team investigate this bug?

Thanks,

Ed

Comment 14

17 years ago
*** Bug 73541 has been marked as a duplicate of this bug. ***

Comment 15

17 years ago
*** Bug 75565 has been marked as a duplicate of this bug. ***

Comment 16

17 years ago
There are at least four, and probably more bugs that are marked as dup of this 
bug.  This bug is real important.

Ed

Comment 17

17 years ago
Hmm, I think nominationg for 0.9 is a bit late late now, so I'll nominate for 0.9.1
Keywords: mozilla0.9.1

Comment 18

17 years ago
*** Bug 76324 has been marked as a duplicate of this bug. ***

Comment 19

17 years ago
Adding crash, topcrash keywords, Trunk and [@ libgklayout.so] to summary.  This 
crash has been on the Talkback topcrash list under that stack signature for a 
few days now.

The libgklayout.so crash is very easily reproducible, just go to this url:
http://www.elendor.net

Here are a few Talkback entries for that crash:

libgklayout.so + 0x5991d (0x4048891d) ecd5fd41
         line 
        Build: 2001041106 CrashDate: 2001-04-12 UptimeMinutes: 87  Total: 425 
        OS: Linux 2.4.1
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29004983
         StackTrace: 
http://climate/reports/stackcommentemail.cfm?dynamicBBID=29004983
     (29004983) URL: www.elendor.net
     (29004983) Comments: switched from www.elendor.net to cnn.com... This has 
been happening for several days and involves going to any java applet holding 
page and then leaving it. The applets run fine

libgklayout.so + 0x599cd (0x4103c9cd) 95475b04
         line 
        Build: 2001041208 CrashDate: 2001-04-12 UptimeMinutes: 1  Total: 48 
        OS: Linux 2.2.14-5.0smp
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29021948
         StackTrace: 
http://climate/reports/stackcommentemail.cfm?dynamicBBID=29021948
     (29021948) URL: clicked roofing materials link
     (29021948) Comments:  http://www.reroofingshowroom.com/

Keywords: crash, topcrash
Summary: Crash (SEGV) upon leaving a java-enabled page (was: Segmentation fault (libgklayout.so), debugfriendly build?) → Trunk crash [@ libgklayout.so](SEGV) upon leaving a java-enabled page (was: Segmentation fault (libgklayout.so), debugfriendly build?)

Updated

17 years ago
Depends on: 76435

Comment 20

17 years ago
This is happening on Solaris with today's trunk.

Comment 21

17 years ago
*** Bug 76494 has been marked as a duplicate of this bug. ***

Comment 22

17 years ago
This problem happened on trunk build on Unix, but not on OEM build. Based on the
crash stack, the problem of TalkBack reports, going to "http://www.elendor.net"
then hit Back button and crashed, has the identical stack (see below). Also the
crash happens as long as you are leaving an applet page (to a non-applet page or
another applet page or any page), and you don't have to click Back button, you
may change the URL and return to crash it. I have not tried on Waterfall yet,
since my build still has compiling problems, and I tried to launch George's
build without success.

Here is the top of the crash stack:
0xfb9a7eb8 in nsPluginInstanceOwner::~nsPluginInstanceOwner (this=0x753668, 
    __in_chrg=3) at nsObjectFrame.cpp:1506
1506        NS_RELEASE(mInstance);
(gdb) where
#0  0xfb9a7eb8 in nsPluginInstanceOwner::~nsPluginInstanceOwner (
    this=0x753668, __in_chrg=3) at nsObjectFrame.cpp:1506
#1  0xfb9a8474 in nsPluginInstanceOwner::Release (this=0x753668)
    at nsObjectFrame.cpp:1583
#2  0xfb9a2df4 in nsObjectFrame::~nsObjectFrame (this=0x7ca4dc, __in_chrg=3)
    at nsObjectFrame.cpp:267
#3  0xfb960a98 in nsFrame::Destroy (this=0x7ca4dc, aPresContext=0x725cc0)
    at nsFrame.cpp:427
#4  0xfb9594f4 in nsContainerFrame::Destroy (this=0x7ca4dc, 
    aPresContext=0x725cc0) at nsContainerFrame.cpp:98
#5  0xfb9a3b54 in nsObjectFrame::Destroy (this=0x7ca4dc, aPresContext=0x725cc0)
    at nsObjectFrame.cpp:471
#6  0xfb998368 in nsLineBox::DeleteLineList (aPresContext=0x725cc0, 
    aLine=0x7cab80) at nsLineBox.cpp:251
#7  0xfb942738 in nsBlockFrame::Destroy (this=0x7ca378, aPresContext=0x725cc0)
    at nsBlockFrame.cpp:1240
#8  0xfbb3dd6c in nsFrameList::DestroyFrames (this=0x7ca350, 
    aPresContext=0x725cc0) at nsFrameList.cpp:41
 #9  0xfb9594e4 in nsContainerFrame::Destroy (this=0x7ca31c, 
    aPresContext=0x725cc0) at nsContainerFrame.cpp:95
#10 0xfbb3dd6c in nsFrameList::DestroyFrames (this=0x80afa0, 
    aPresContext=0x725cc0) at nsFrameList.cpp:41
What's the diagnosis?  Memory corruption?  Ref-count underflow (one too many
RELEASES on what mInstance pointed to)?

/be
Whiteboard: important to mozilla0.9?

Comment 24

17 years ago
Based on the preliminary trace, in both a crashing case and a non-crash case,
the destructor was invoked twice, and in both times the pointer of minstance
seemed valid (not null nor strange value), but it crashed in the second time of
calling the release in the crashing case. It seems a memory corruption, but need
further investigation. 

Comment 25

17 years ago
I can't reproduce this, so i play the bad guy. If it still crashes for you, then
I was wrong.

*** This bug has been marked as a duplicate of 74531 ***
Status: NEW → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → DUPLICATE

Comment 26

17 years ago
jens-uwe, why did you think this is a duplicate of 74531? The crash stacks were
different, and the craching ways are different.

Comment 27

17 years ago
joe:
oooops. I just read the first stack trace and it was the same, the other stack
traces look completly different...
Anyway, I tried both URLs mentioned in the header and it did not crash here.

Comment 28

17 years ago
Is your build a trunk build? When was it checked out? Several people have
already reproduced the crash. Reopen the bug.
Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---

Comment 29

17 years ago
This bug is blocked by bug 76435 which states that there is no way to debug OJI
bugs on linux. I am just curious as to why this is so and if anything can be
done to aid the process along.

Comment 30

17 years ago
On a second look, I do agree that this bug should be a duplicate of 74531. I
overlooked the trace stack at the beginning, and it is similar to that of 74531.
Sorry, Jens-Uwe.
On the other hand, I believe the crash that Ed and I and some other people saw
was a different problem, and a more serious one since it crashes when leaving
from any applet page. 
Therefore, I am going to re-make this one a duplicate of 74531, and open a new
bug for the crash on the release of instance owner, and I'll post the new bug
number here after I open it.

Comment 31

17 years ago
Re-mark this bug as duplicate of 74531.

*** This bug has been marked as a duplicate of 74531 ***
Status: REOPENED → RESOLVED
Last Resolved: 17 years ago17 years ago
Resolution: --- → DUPLICATE

Comment 32

17 years ago
*** Bug 76936 has been marked as a duplicate of this bug. ***

Comment 33

17 years ago
The new bug for crashing at leaving an applet page is: 76936.

Comment 34

17 years ago
ver
Status: RESOLVED → VERIFIED

Updated

8 years ago
Component: Java: OJI → Java: OJI
Product: Core → Core Graveyard
Crash Signature: [@ libgklayout.so]
You need to log in before you can comment on or make changes to this bug.