85703 - Crashes on popup windows

Status: RESOLVED FIXED

(Core Graveyard :: Embedding: GTK Widget, defect)

Description

[Marco Pesenti Gritti]

I get these two urls crashes with gtkmozembed (tested with
TestGtkEmbed and galeon):

http://www.nirvana.freeuk.com/
http://dictionaries.travlang.com/EnglishFinnish/

They works in mozilla browser.

Here is a gdb trace (the same for both urls):

#0  0x410d68f4 in nsDocShell::ForceUpdate ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libdocshell.so
#1  0x410dfff8 in nsDocShell::SetHasFocus ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libdocshell.so
#2  0x411558f6 in GlobalWindowImpl::Blur ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libjsdom.so
#3  0x400d696a in XPTC_InvokeByIndex () at eval.c:41
#4  0x4074833c in XPCWrappedNative::CallMethod ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libxpconnect.so
#5  0x4074d3e9 in XPC_WN_CallMethod ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libxpconnect.so
#6  0x406931e7 in js_Invoke ()
   from /home/mpeseng/cvs/mozilla/dist/bin/libmozjs.so
#7  0x4069a9bf in js_Interpret ()
   from /home/mpeseng/cvs/mozilla/dist/bin/libmozjs.so
#8  0x40693647 in js_Execute ()
   from /home/mpeseng/cvs/mozilla/dist/bin/libmozjs.so
#9  0x406771a1 in JS_EvaluateUCScriptForPrincipals ()
   from /home/mpeseng/cvs/mozilla/dist/bin/libmozjs.so
#10 0x4114d58d in nsJSContext::EvaluateString ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libjsdom.so
#11 0x40e8dbca in nsScriptLoader::EvaluateScript ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
---Type <return> to continue, or q <return> to quit---
#12 0x40e8d800 in nsScriptLoader::ProcessRequest ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
#13 0x40e8d569 in nsScriptLoader::ProcessScriptElement ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
#14 0x40d40fb8 in nsHTMLScriptElement::SetDocument ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
#15 0x40d1c686 in nsGenericHTMLContainerElement::AppendChildTo ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
#16 0x40d5d527 in HTMLContentSink::ProcessSCRIPTTag ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
#17 0x40d59480 in HTMLContentSink::AddLeaf ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libgkcontent.so
#18 0x40c58dbc in CNavDTD::AddLeaf ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#19 0x40c58ecc in CNavDTD::AddHeadLeaf ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#20 0x40c55c4f in CNavDTD::HandleStartToken ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#21 0x40c54534 in CNavDTD::HandleToken ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#22 0x40c536bd in CNavDTD::BuildModel ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#23 0x40c67658 in nsParser::BuildModel ()
---Type <return> to continue, or q <return> to quit---
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#24 0x40c6747b in nsParser::ResumeParse ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#25 0x40c67ea2 in nsParser::OnDataAvailable ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libhtmlpars.so
#26 0x40c9d76f in nsDocumentOpenInfo::OnDataAvailable ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/liburiloader.so
#27 0x40791eea in nsStreamListenerTee::OnDataAvailable ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libnecko.so
#28 0x407b435e in nsHttpChannel::OnDataAvailable ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libnecko.so
#29 0x4078274d in nsOnDataAvailableEvent::HandleEvent ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libnecko.so
#30 0x407820af in nsARequestObserverEvent::HandlePLEvent ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libnecko.so
#31 0x400c23d7 in PL_HandleEvent () at eval.c:41
#32 0x400c22e5 in PL_ProcessPendingEvents () at eval.c:41
#33 0x400c3447 in nsEventQueueImpl::ProcessPendingEvents () at eval.c:41
#34 0x40fa89e6 in event_processor_callback ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libwidget_gtk.so
#35 0x40fa8735 in our_gdk_io_invoke ()
   from /home/mpeseng/cvs/mozilla/dist/bin/components/libwidget_gtk.so
#36 0x402e7a7a in g_io_unix_dispatch (source_data=0x8147f08, 
---Type <return> to continue, or q <return> to quit---
    current_time=0xbffff7e0, user_data=0x8107660) at giounix.c:137
#37 0x402e9055 in g_main_dispatch (dispatch_time=0xbffff7e0) at gmain.c:656
#38 0x402e9659 in g_main_iterate (block=1, dispatch=1) at gmain.c:877
#39 0x402e97e8 in g_main_run (loop=0x8257e18) at gmain.c:935
#40 0x401fe65b in gtk_main () at gtkmain.c:524
#41 0x08049eb9 in main () at eval.c:41
#42 0x40432177 in __libc_start_main (main=0x8049d60 <main>, argc=1, 
    ubp_av=0xbffff8d4, init=0x80496e8 <_init>, fini=0x804bc30 <_fini>, 
    rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbffff8cc)

Comment 1

[Christopher Blizzard (:blizzard)]

Attachment: don't crash in docshell set focus

Comment 2

[Christopher Blizzard (:blizzard)]

If you call the docshell's setfocus method before the presshell is created it
will crash.  This is a simple null check.

Also, don't assert if the SetFocus() method fails.  The error to that is coming
from mDocShellAsWin->SetFocus() is actually also because the presshell hasn't
been created yet either. :)

Adam, can you review this simple null check and assertion change?

Comment 3

[Adam Lock]

Looks good. r=adamlock

Comment 4

[Adam Lock]

*** Bug 85736 has been marked as a duplicate of this bug. ***

Comment 5

[tor]

sr=tor

Comment 6

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 7

[Jay Patel [:jay]]

I can confirm this crash with this mornings build on Linux (2001061406).  Adding
smoketest keyword, since this is a regression and smoketest blocker.

Comment 8

[Jay Patel [:jay]]

forgot to write in that i added a regression keyword and changed severity to
blocker.

Comment 9

[Jay Patel [:jay]]

Here is the Talkback info on my crash this morning:

Incident ID 31719271
Stack Signature 0x632f6d6f 955b9ee5
Bug ID
Trigger Time 2001-06-14 09:16:01
User Comments crashes when a popup windows opens on loading a site.
Build ID 2001061406
Product ID MozillaTrunk
Platform ID LinuxIntel
Stack Trace
0x632f6d6f
nsHttpTransaction::Cancel()
nsHttpChannel::ProcessRedirection()
nsHttpChannel::ProcessResponse()
nsHttpChannel::OnStartRequest()
nsOnStartRequestEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xe52a (0x4033e52a)
libglib-1.2.so.0 + 0xfbe6 (0x4033fbe6)
libglib-1.2.so.0 + 0x101a1 (0x403401a1)
libglib-1.2.so.0 + 0x10341 (0x40340341)
libgtk-1.2.so.0 + 0x8c209 (0x40267209)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x181eb (0x404371eb)

I hope this is related to the crash originally reported, if not please let me
know so I can log a new bug.

Comment 10

[Christopher Blizzard (:blizzard)]

That is not the same crash as this one.  That is bug #85823.

Comment 11

[Christopher Blizzard (:blizzard)]

Checked in.

/cvsroot/mozilla/docshell/base/nsDocShell.cpp,v  <--  nsDocShell.cpp
new revision: 1.319; previous revision: 1.318
done
Checking in embedding/browser/webBrowser/nsWebBrowser.cpp;
/cvsroot/mozilla/embedding/browser/webBrowser/nsWebBrowser.cpp,v  <-- 
nsWebBrowser.cpp
new revision: 1.87; previous revision: 1.86

Comment 12

[Asa Dotzler [:asa]]

actually I think jpatels crash is bug 85822

Comment 13

[Jay Patel [:jay]]

sorry for the confusion, thanks for pointing me in the right direction.