Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050613 Firefox/1.0+ ID:2005061303 Install GM 0.3.4 Select the tools menu and move over the GM menu enteries using either the mouse or keyboard Firefox crashes The stack in bug 273981 looks simular. TB ID's TB6635514E TB6633224Y

Talkback stack data: Stack Signature nsMenuFrame::IsDisabled 6fa23437 Product ID FirefoxTrunk Build ID 2005061219 Trigger Time 2005-06-13 09:39:20.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module firefox.exe + (00268651) URL visited move over tools menu User Comments Since Last Crash 5124 sec Total Uptime 12480 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1315 Stack Trace nsMenuFrame::IsDisabled [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1315] nsMenuFrame::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 499] PresShell::HandleEventInternal [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6409] PresShell::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6189] nsViewManager::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2502] nsViewManager::DispatchEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2224] HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1173] nsWindow::DispatchMouseEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 5801] ChildWindow::DispatchMouseEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6047] nsWindow::WindowProc [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1351] USER32.dll + 0x8734 (0x77d48734) USER32.dll + 0x8816 (0x77d48816) USER32.dll + 0x89cd (0x77d489cd) USER32.dll + 0x8a10 (0x77d48a10) nsAppShell::Run [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159] nsAppStartup::Run [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 145] main [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61] kernel32.dll + 0x16d4f (0x7c816d4f)

The crash doesn't happen in 2005-06-03 trunk build, but it happens in 2005-06-04 build. This crash happens because of the "Hide empty menus from xul.css" patch of bug 295711. I'll attach a testcase that is derived from the GM tools menu. It has included the css rule patch from xul.css, so this can be tested in older builds. This testcase crashes even in Mozilla1.0

Open the menu, then hover over the menuitem to trigger the crash.

display:none menus don't have frames, a simple null-check is probably sufficient, but I'm not sure about this code.

Null check on what? The crash is in a nsMenuFrame member method (not class-static), and the caller null-checks before making the call (that is, nsMenuFrame::HandleEvent is only called on non-null menu frames). So we're most likely either making the call on a deleted object or somehow deleting the object in the middle of the call. Either way, a null-check won't help. In general, changing anything in menus from the layout side (and that includes xul.css!) is very very regression prone; at this point I'd rather we hold such changes until Gecko alpha milestones when we have the time needed to sort out the regressions.

Boris, the DOMI-as-extension change is very important for application update and other situations: would changing display: none to visibility: collapse be sufficient?

Sufficient for what purpose?

To prevent crashes and other misbehavior in layout while still hiding <menu>s without a <menupopup>.

My question was what you mean by "hiding". If you mean "make the user not be able to click on them in Windows/Linux", then probably yes. If you mean "don't show it on Mac", then I don't know.

I've already dealt with the mac menus with code in widget/src/mac, AFAICT this bug is present for gecko-drawn menus only.

Ah, if we're not worrying about mac, then visibility:collapse might work, yes.

We should test that this actually prevents the crash (which I have not reproduced).

Comment on attachment 186340 [details] [diff] [review] Use visibility instead of display r=me

Comment on attachment 186340 [details] [diff] [review] Use visibility instead of display r=bzbarsky, if this gets tested and a followup filed as needed to sort out the real underlying problem

Applying attachment 186340 [details] [diff] [review] to a local vs7 build prevents the crash. The last of the 3 GM menu options disapears when moving the mouse over it rather than a crash occuring. Thanks for the quick fix.

> The last of the 3 GM menu options disapears Hmm... why is that happening?

To add to my rather vague comment before. Load firefox go to tools menu there is a "manage user scripts" disabled sub menu. Moving the mouse over this menu disapears. Close firefox and reopen the sub menu is back and mouse over makes it disapear again for the browser session.

*** Bug 273981 has been marked as a duplicate of this bug. ***

Fixed for 1.8b3 (toolkit and xpfe versions).

Err... except the behavior described in comment 17 sounds very very wrong. Do we have a bug filed on that? It should be blocking 1.8b3, if so. If we don't have a bug, could someone who can clearly describe the steps to reproduce and resulting behavior plees file it?

Well, this is perfectly logical: with menu:empty {visibility:collapse;} the menu gets hidden when all the childnodes in the menu get removed. So that last patch does exactly what it promises to do. Like bug 295711, comment 5 said, maybe it is better to just disable the a menu that is empty, so just do for menu:empty the same as is done here: http://lxr.mozilla.org/seamonkey/source/toolkit/themes/winstripe/global/menu.css#60

There is a crucial difference between removing all the <menuitem>s from the <menupopup> (which is IMO a UI error, there should at least be a disabled item with label "(Empty)" like the bookmarks UI does), and removing the <menupopup> from the <menu>, which should act as if the menu doesn't even exist.

My point is that mousing over a menuitem as in comment 17 should not cause it to disappear.

(In reply to comment #19) > Fixed for 1.8b3 (toolkit and xpfe versions). Still crashes on Linux : Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050617 Firefox/1.0+ Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050618 Firefox/1.0+ Loaded the testcase and crashes when hovering the menuitem. [root@zeus /opt/MozillaFirefox]$strace ./firefox execve("./firefox", ["./firefox"], [/* 28 vars */]) = 0 brk(0) = 0x8321000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=111100, ...}) = 0 old_mmap(NULL, 111100, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fb8000 close(3) = 0 open("/lib/libtermcap.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\33"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=12924, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fb7000 old_mmap(0xa21000, 14632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xa21000 old_mmap(0xa24000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0xa24000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0\254\204"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=16244, ...}) = 0 old_mmap(0x84a000, 12404, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x84a000 old_mmap(0x84c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x84c000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\n\317p"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1489572, ...}) = 0 old_mmap(0x6f8000, 1219548, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x6f8000 old_mmap(0x81c000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x124000) = 0x81c000 old_mmap(0x820000, 7132, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x820000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fb6000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7fb66c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0x84c000, 4096, PROT_READ) = 0 mprotect(0x81c000, 8192, PROT_READ) = 0 mprotect(0x6f0000, 4096, PROT_READ) = 0 munmap(0xb7fb8000, 111100) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/dev/tty", O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3 close(3) = 0 brk(0) = 0x8321000 brk(0x8342000) = 0x8342000 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=48558080, ...}) = 0 mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7db6000 close(3) = 0 getuid32() = 0 getgid32() = 0 geteuid32() = 0 getegid32() = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 time(NULL) = 1119088478 open("/etc/mtab", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=709, ...}) = 0 mmap2(NULL, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7d96000 read(3, "/dev/hda17 / reiserfs rw 0 0\n/de"..., 131072) = 709 close(3) = 0 munmap(0xb7d96000, 131072) = 0 open("/proc/meminfo", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7db5000 read(3, "MemTotal: 1035464 kB\nMemFre"..., 1024) = 670 close(3) = 0 munmap(0xb7db5000, 4096) = 0 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigaction(SIGQUIT, {SIG_IGN}, {SIG_DFL}, 8) = 0 uname({sys="Linux", node="zeus.softexpert.lan", ...}) = 0 stat64("/opt/MozillaFirefox", {st_mode=S_IFDIR|0777, st_size=1120, ...}) = 0 stat64(".", {st_mode=S_IFDIR|0777, st_size=1120, ...}) = 0 getpid() = 16395 open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=22294, ...}) = 0 mmap2(NULL, 22294, PROT_READ, MAP_SHARED, 3, 0) = 0xb7db0000 close(3) = 0 getppid() = 16394 getpgrp() = 16394 rt_sigaction(SIGCHLD, {0x807871f, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("./firefox", O_RDONLY|O_LARGEFILE) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfdd2c68) = -1 ENOTTY (Inappropriate ioctl for device) _llseek(3, 0, [0], SEEK_CUR) = 0 read(3, "#!/bin/sh\n#\n# ***** BEGIN LICENS"..., 80) = 80 _llseek(3, 0, [0], SEEK_SET) = 0 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0 dup2(3, 255) = 255 close(3) = 0 fcntl64(255, F_SETFD, FD_CLOEXEC) = 0 fcntl64(255, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE) fstat64(255, {st_mode=S_IFREG|0755, st_size=5129, ...}) = 0 _llseek(255, 0, [0], SEEK_CUR) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "#!/bin/sh\n#\n# ***** BEGIN LICENS"..., 5129) = 5129 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 pipe([3, 4]) = 0 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 _llseek(255, -1680, [3449], SEEK_CUR) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7fb6708) = 16396 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 16396 waitpid(-1, 0xbfdd22dc, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigaction(SIGCHLD, {0x807871f, [], 0}, {0x807871f, [], 0}, 8) = 0 close(4) = 0 read(3, ".\n", 128) = 2 read(3, "", 128) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x80760d4, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x80760d4, [], 0}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "progbase=`basename \"$progname\"`\n"..., 5129) = 1680 pipe([3, 4]) = 0 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 _llseek(255, -1648, [3481], SEEK_CUR) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7fb6708) = 16397 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x807871f, [], 0}, {0x807871f, [], 0}, 8) = 0 close(4) = 0 read(3, "firefox\n", 128) = 8 read(3, "", 128) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x80760d4, [], 0}, {SIG_DFL}, 8) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 16397 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, 0xbfdd22dc, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigaction(SIGINT, {SIG_DFL}, {0x80760d4, [], 0}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "run_moz=\"$curdir/run-mozilla.sh\""..., 5129) = 1648 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 access("./run-mozilla.sh", X_OK) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("./init.d/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 3 fstat64(3, {st_mode=S_IFDIR|0755, st_size=72, ...}) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7d8f000 getdents64(3, /* 3 entries */, 131072) = 80 getdents64(3, /* 0 entries */, 131072) = 0 munmap(0xb7d8f000, 135168) = 0 close(3) = 0 open("/root/.mozilla/firefox/init.d/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = -1 ENOENT (No such file or directory) rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 access("./init.d/S*", X_OK) = -1 ENOENT (No such file or directory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 access("/root/.mozilla/firefox/init.d/S*", X_OK) = -1 ENOENT (No such file or directory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 _llseek(255, -91, [5038], SEEK_CUR) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7fb6708) = 16398 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x80760d4, [], 0}, {SIG_DFL}, 8) = 0 waitpid(-1, ./run-mozilla.sh: line 131: 16403 Segmentation fault "$prog" ${1+"$@"} [{WIFEXITED(s) && WEXITSTATUS(s) == 139}], 0) = 16398 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, 0xbfdd265c, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigaction(SIGINT, {SIG_DFL}, {0x80760d4, [], 0}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "exitcode=$?\n\n## Stop addon scrip"..., 5129) = 91 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/root/.mozilla/firefox/init.d/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = -1 ENOENT (No such file or directory) open("./init.d/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 3 fstat64(3, {st_mode=S_IFDIR|0755, st_size=72, ...}) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7d8f000 getdents64(3, /* 3 entries */, 131072) = 80 getdents64(3, /* 0 entries */, 131072) = 0 munmap(0xb7d8f000, 135168) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 access("/root/.mozilla/firefox/init.d/K*", X_OK) = -1 ENOENT (No such file or directory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 access("./init.d/K*", X_OK) = -1 ENOENT (No such file or directory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 exit_group(139) = ? [root@zeus /opt/MozillaFirefox]$

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050618 Firefox/1.0+ ID:2005061804 Still crashes for me too. TB6778055G [@ nsMenuFrame::BuildAcceleratorText]

Reopening per comments

If you really want to remove a menu or menuitem from the screen then only display: none; works, as keyboard navigation works off the frames... visibility: collapse; also doesn't remove margins in those themes that use them.

Can it be that the people who are still crashing with current trunk builds, still have menu:empty { display:none } in their xul cache? Steve and Marian, when you put add the property nglayout.debug.disable_xul_cache to about:config and set it to true (boolean), and then do a restart, do you still crash when moving over the GM Tools menu?

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050620 Firefox/1.0+ ID:2005062002 -- New Profile. For me, nglayout.debug.disable_xul_cache = false, testcase = crash, TB6843982X nglayout.debug.disable_xul_cache = true, testcase still = crash, TB6843993M

We're doing a synchronous re-framing while we have the old frames for that content still on the call stack: http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCSSFrameConstructor.cpp&rev=1.1105&root=/cvsroot&mark=10331,10427-10447#10410 the frame has been destroyed after the |SetAttr| here: http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/xul/base/src/nsMenuFrame.cpp&rev=1.292&root=/cvsroot&mark=573#561 A bit of ad-hoc tracing for the testcase: [0x87b3370] PresShell::HandleEventInternal L11: mCurrentEventFrame=0x8723ce4 aView=0x8638468 ++++++++++++++++++++++++++++++++++++++++ Menu(menu)(0)@0x8723ce4 {0,0,4995,315} [state=805000b0] [content=0x87ce6f8] [sc=0x8723c34]< Text(label)(-1)[value=Hovering over this should not crash Mozilla]@0x8723dec {300,30,4080,255} [state=000000a0] [content=0x8636c20] Box(hbox)(-1)@0x8723ec0 next=0x8724088 {4410,157,345,0} [state=80c000a0] [content=0x87d1fc8] [sc=0x8723e68]< Area(label)(0)@0x8724034 {105,0,210,0} [state=00d00000] sc=0x8723f2c(i=0,b=0)< > > Box(hbox)(-1)@0x8724088 {4845,105,120,105} [state=804000a0] [content=0x8638778] [sc=0x8723f84]< ImageBox(image)(0)@0x87241a4 {0,0,60,105} [state=000000a0] [content=0x86387f8] > > ---------------------------------------- [0x8723ce4] nsMenuFrame::HandleEvent ENTER [0x8723ce4] nsMenuFrame::HandleEvent NS_MOUSE_MOVE [0x8723ce4] nsMenuFrame::HandleEvent NS_MOUSE_MOVE 1 [0x8723ce4] nsMenuFrame::HandleEvent NS_MOUSE_MOVE mMenuParent=0x87dfd20->SetCurrentMenuItem(this=0x8723ce4) [0x87dfcb4] nsMenuPopupFrame::SetCurrentMenuItem mCurrentMenu=(nil) mTimerMenu=(nil) aMenuItem=0x8723d50 [0x87dfcb4] nsMenuPopupFrame::SetCurrentMenuItem 4 [0x87dfcb4] nsMenuPopupFrame::SetCurrentMenuItem 5 [0x8723ce4] nsMenuFrame::SelectMenu doc=0x87ad6f8 [0x87ce6f8] nsXULElement::SetAttr ENTER [0x87ce6f8] nsXULElement::SetAttrAndNotify [0x87ce6f8] nsXULElement::SetAttrAndNotify before binding->AttributeChanged [0x8638778] nsXULElement::SetAttr ENTER [0x8638778] nsXULElement::SetAttrAndNotify [0x8638778] nsXULElement::SetAttrAndNotify doc->AttributeChanged before doc=0x87ad6f8 0x87ad6f8 [0x8638778] nsXULElement::SetAttrAndNotify doc->AttributeChanged after doc=0x87ad6f8 0x87ad6f8 [0x8638778] nsXULElement::SetAttr EXIT [0x87ce6f8] nsXULElement::SetAttrAndNotify after binding->AttributeChanged [0x87ce6f8] nsXULElement::SetAttrAndNotify doc->AttributeChanged before doc=0x87ad6f8 0x87ad6f8 nsCSSFrameConstructor::AttributeChanged before ProcessOneRestyle menuactive aContent=0x87ce6f8 doc=0x87ad6f8 [0x8723dec] nsFrame::Destroy content=0x8636c20 view=(nil) shell=0x87b3370 [0x8724034] nsFrame::Destroy content=0x87d2028 view=(nil) shell=0x87b3370 [0x8723ec0] nsFrame::Destroy content=0x87d1fc8 view=(nil) shell=0x87b3370 [0x87241a4] nsFrame::Destroy content=0x86387f8 view=(nil) shell=0x87b3370 [0x8724088] nsFrame::Destroy content=0x8638778 view=(nil) shell=0x87b3370 [0x8723ce4] nsFrame::Destroy content=0x87ce6f8 view=(nil) shell=0x87b3370 nsCSSFrameConstructor::AttributeChanged after ProcessOneRestyle menuactive aContent=0x87ce6f8 doc=0x87ad6f8 [0x87ce6f8] nsXULElement::SetAttrAndNotify doc->AttributeChanged after doc=0x87ad6f8 0x87ad6f8 [0x87ce6f8] nsXULElement::SetAttr EXIT nsMenuFrame::SelectMenu mContent=0xdddddddd <<< crash I couldn't find a solution without regressing the bugs Boris was fixing, bug 262031, bug 279308 etc.

Benjamin, any chance of coming up with an approach here that doesn't require a (much needed) full rewrite of how XUL menus work?

Changing the _moz-menuactive attribute don't have side effects any more.

closing down for 1.8b3, let's try and get this in for 1.8b4

Neil, what changed about this code since I fixed bug 262031? At the time, _moz_menuactive did something nontrivial when it was changed, but I can't recall where that code was...

Ah, well I was just going by the comment in nsPopupSetFrame::ActivatePopup ;-)

So perhaps changing the _moz-menuactive attribute has never had side effects...

The point is, does this patch regress bug 262031? That bug is why I added the menuactive check. If removing it doesn't break those testcases, then it's all good by me.

Comment on attachment 187944 [details] [diff] [review] Proposed patch Sigh... bsmedberg, perhaps some script to remove those empty menus on startup?

What is different about the GM tools menus than any other of our menus? Are they dynamically removing <menupopup> elements or somesuch?

(In reply to comment #39) > What is different about the GM tools menus than any other of our menus? Are they > dynamically removing <menupopup> elements or somesuch? Yes, I think so. At least, that's what I got by trying to make a minimized testcase.

*** Bug 299777 has been marked as a duplicate of this bug. ***

after reconsidering the general user impact, removing blocker status.

No crash here when hovering over the expanded menu item now that the popup rewrite has landed. FIXED