Closed Bug 775143 Opened 12 years ago Closed 12 years ago

crash in uGlobalMenu::OnOpen when activating HUD in Ubuntu with Firebug


(Firefox :: Extension Compatibility, defect)

14 Branch
Not set





(Reporter: scoobidiver, Unassigned)



(Keywords: crash, topcrash)

Crash Data

It's #2 top browser crasher in 14.0.1 on Linux and first appeared in 13.0.1 and 14.0.1 on July 12.

Signature 	uGlobalMenu::OnOpen More Reports Search
UUID	c8bba6db-a6eb-43d6-b736-f55602120718
Date Processed	2012-07-18 15:23:27
Uptime	1975
Last Crash	42.1 minutes before submission
Install Age	32.9 minutes since version was first installed.
Install Time	2012-07-18 14:49:44
Product	Firefox
Version	14.0.1
Build ID	20120713224758
Release Channel	release
OS	Linux
OS Version	0.0.0 Linux 3.2.0-26-generic-pae #41-Ubuntu SMP Thu Jun 14 16:45:14 UTC 2012 i686
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	SIGSEGV
Crash Address	0x36
User Comments	hit alt-tab, alt was held too long and opened the heads-up display
App Notes 	
OpenGL: Tungsten Graphics, Inc -- Mesa DRI Intel(R) Sandybridge Mobile x86/MMX/SSE2 -- 3.0 Mesa 8.0.2 -- texture_from_pixmap
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	uGlobalMenu::OnOpen 	nsIContent.h:379
1 	uGlobalMenu::MenuEventCallback 	uGlobalMenu.cpp:134
2 	_dbusmenu_menuitem_marshal_BOOLEAN__STRING_VARIANT_UINT 	menuitem-marshal.c:205
3 	g_closure_invoke 	gclosure.c:777
4 	signal_emit_unlocked_R 	gsignal.c:3547
5 	g_signal_emit_valist 	gsignal.c:3306
6 	g_signal_emit 	gsignal.c:3352
7 	dbusmenu_menuitem_handle_event 	menuitem.c:1755
8 	event_local_handler 	server.c:1642
9 	g_timeout_dispatch 	gmain.c:3882
10 	g_main_context_dispatch 	gmain.c:2539
11 	g_main_context_iterate 	gmain.c:3146
12 	g_main_context_iteration 	gmain.c:3207
13 	nsAppShell::ProcessNextNativeEvent 	nsAppShell.cpp:162
14 	nsBaseAppShell::DoProcessNextNativeEvent 	nsBaseAppShell.cpp:171
15 	nsBaseAppShell::OnProcessNextEvent 	nsBaseAppShell.cpp:306
16 	nsThread::ProcessNextEvent 	nsThread.cpp:618
17 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:245
18 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:114
19 	MessageLoop::RunInternal
20 	MessageLoop::Run
21 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:189
22 	nsAppStartup::Run 	nsAppStartup.cpp:295
23 	XREMain::XRE_mainRun 	nsAppRunner.cpp:3780
24 	XREMain::XRE_main 	nsAppRunner.cpp:3857
25 	XRE_main 	nsAppRunner.cpp:3933
26 	firefox 	main 	nsBrowserApp.cpp:190 

More reports at:
I can reproduce this too actually. It's been reported a few times to our bug tracker too, and seems to require Firebug to be installed to trigger it. It happens only when opening the "Firebug UI Location" submenu.

The crash occurs when calling nsINode::OwnerDoc() on the menupopup associated with this menu, because mNodeInfo is null. Why would this happen?? :/

(Note, I'm the developer of the addon which seems to cause this crash)
So, the issue is actually a long-standing dormant bug in our addon that has surfaced now because of this change in Firebug:

For anyone who isn't familiar, we ship an addon in Ubuntu to put the Firefox menubar in the Unity panel, and this works in a similar fashion to the Mac native menu. What this means is that the "state" property for a menupopup doesn't work because it depends on there being a frame (it always returns "closed").

We have some workarounds in our addon to make other menus that depend on this feature work correctly (eg, the Edit menu). What happens now in the Firebug case is that a submenu opening causes the Firebug top-level menu to remove all of its children (including the submenu that the popupshowing event is currently being dispatched to), because the 'if (popup.state == "open")' check fails in Firebug.GlobalUI.onMenuShowing(). This triggers a use-after-free in our addon.

The actual crash is easily fixable, but the Firebug menu is still broken (basically, a submenu disappears as it is opening).

I thought I could fix this by providing my own binding for menupopups which derives from chrome://global/content/bindings/popup.xml#popup, and then implementing the "state" property in my derived binding.

However, whilst this works correctly for most menupopups, it doesn't work for the Firebug menus. The menupopups for Firebug never actually get a binding attached, despite us doing the same dance as in our addon. I'm not entirely sure why this is, but I guess it is because Firebug creates the menupopup with document.createElement("menupopup"), so the popup is wrapped by xpconnect before it is inserted in to the document (and obviously, the binding will never be attached by the frame constructor, because it never gets a frame).

I could probably manually attach the binding from our addon, but nsIXBLService has been removed in Firefox 15 which makes that quite difficult (the removal of that also means we can no longer do this:, although that is a separate issue).

I'm pretty stuck with how to proceed here to fix our addon :(
Component: General → Extension Compatibility
Product: Core → Firefox
Summary: crash in uGlobalMenu::OnOpen when activating HUD in Ubuntu → crash in uGlobalMenu::OnOpen when activating HUD in Ubuntu with Firebug
There are no crashes in 15.0.1 and above.
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.