Closed
Bug 56086
Opened 24 years ago
Closed 24 years ago
Crash in gtk/nsWindow::UpdateIdle, mashing back & fwd btns. M09 topcrash [@ 0x00000000 - nsAppShell::Run()]
Categories
(SeaMonkey :: General, defect, P1)
Tracking
(Not tracked)
mozilla0.9.1
People
(Reporter: brodms, Assigned: dr)
References
Details
(Keywords: crash, helpwanted, topcrash)
Crash Data
Attachments
(1 file)
(deleted),
patch
|
Details | Diff | Splinter Review |
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.14-SMP i686; en-US; m18) Gecko/20001007 BuildID: 2000100721 Rapid clicking of the Forward and/or Back buttons can cause a crash. It appears that hitting one of these buttons while the last page requested is still being pulled out of cache is the direct cause of the crash. I also tried using the keyboard controls(Alt+Left and Alt+Right) and was also able to cause this crash. Reproducible: Sometimes Steps to Reproduce: 1.Start the browser and load a series of large pages. 2.Now rapidly navigate through them using the Forward and Back buttons, or using the keyboard controls. Actual Results: The browser crashed. Expected Results: Merrily loaded the pages requested. Here are several Talkbacks: TB18903607H: This crash using keyboard navigation. TB18867835K, TB18717846H: This crash using the Forward and Back buttons. I tried and failed to reproduce this on Win98, but I only have 32MB of RAM on that machine, so I really can't do anything "rapidly".
Reporter | ||
Comment 1•24 years ago
|
||
Shortening lengthy summary.
Summary: Rapidly, repeatedly hitting Forward and Back buttons crashes browser. → Rapidly hitting Forward & Back buttons crashes browser.
Comment 3•24 years ago
|
||
May be a Linux-specific bug. WFM Win2k.
Comment 4•24 years ago
|
||
I'm confirming, but there must be a duplicate somewhere, because I've seen this behavior consistently for over a year with moz/linux. I never bothered to file it because I've seen it so consistently and for so long that I figured it must be in the system, somewhere. I'll attempt to do another search for it, but in the meantime this is important.If I can't find a dup, I'll add more observations here later.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Comment 5•24 years ago
|
||
I've been looking for something that this duplicates, but I can't find anything, and all the IRC channels are useless at this hour of the morning. Anyway, I'll add my observations: *This has occured for at least 14 months in the Linux builds. *The crash occurs after you stop hitting the buttons, not while you are still hitting the buttons (somehow, this keeps moz alive.) *I believe that this is SMP only- I don't have an SMP machine to test it on to be sure, but at least one friend (via IRC) reports stability under the same conditions. Anyway, those are my two cents.
Reporter | ||
Comment 7•24 years ago
|
||
I'm on a non-SMP Linux machine, and I've been observing this behavior for at least a month (probably longer). I held off on reporting it for the same reason: I figured it was already in Bugzilla somewhere. But i can't imagine it being in any component other than History or possibly Keyboard Nav, and I've rifled through all of those.
Comment 8•24 years ago
|
||
History and Keybd Nav are relatively new components. A truly old bug of tis nature would be in XP Apps or Browser-General. What's SMP?
Comment 9•24 years ago
|
||
SMP == Symmetric Multi-Processing. Two chips in one machine :) Tends to magnify the effect of any threading bugs (which made moz unusable on SMP for quite some time.) However, if this is verified from elsewhere it seems that isn't the problem.
Comment 10•24 years ago
|
||
nav triage teaM: beta stopper. we have to fix crashers.
Keywords: nsbeta1
Priority: P3 → P1
Comment 11•24 years ago
|
||
Bug 59831 might be a duplicate of this.
Comment 12•24 years ago
|
||
I've just had a very similar-seeming crash for build 2000123121 on Solaris (on a single-processor machine). I pressed back once, got the start of rendering of the page it was backing to, pressed back again immediately and got and immediate SEGV. Time between the two presses of back was ~1s. Sorry, no stack trace available, because Sun Workshop debugger crashes when loading the core-file.
Comment 13•24 years ago
|
||
*** Bug 59831 has been marked as a duplicate of this bug. ***
Updated•24 years ago
|
Target Milestone: --- → mozilla0.9
Comment 15•24 years ago
|
||
I couldn't reproduce this on my RH 6.2 (no SMP) 266 MHZ 96MB machine. It doesn't crash on NT either. Has anyone encountered this recently? A stack trace would be more useful.
Reporter | ||
Comment 16•24 years ago
|
||
I can still reproduce this without much difficulty on my SuSE 6.4 machine, a P3-733 w/ 256MB of RAM. I'll supply a Talkback ID once I can get Talkback to start working again.
Comment 17•24 years ago
|
||
Ditto on the reproduceability of this with the latest builds. Is there a talkback build for Linux right now? I haven't seen one marked like that in the ftp for a while- am I missing something? I've been out of the QA loop here for quite some time :| If someone will point me to it, I'll take a stab at it...
Comment 18•24 years ago
|
||
I would love to look in to this, if I had a reproducible case or a stack trace. Claudius can you try to reproduce this? The crash may be occuring upon hitting back and forward. But unless I see a stack trace, I wouldn't know exactly whare it is crashing.
Status: NEW → ASSIGNED
Reporter | ||
Comment 19•24 years ago
|
||
OK, I got a Talkback build and reproduced the crash on Linux. Talkback ID is: TB26074452Z
Comment 20•24 years ago
|
||
cc'ing pavlov, akkana and mcafee, if they are aware of something similar. The crash seems to happen as below on linux/solaris when rapidly clicking back forward buttons or using keyboard shortcuts. From the talkback report ID: TB26074452Z, here's how the stack trace looks like. I couldn't reproduce it. But will definitely try again. 0x08dc44d1 libglib-1.2.so.0 + 0x11cbf (0x409cecbf) libglib-1.2.so.0 + 0x10bd6 (0x409cdbd6) libglib-1.2.so.0 + 0x11203 (0x409ce203) libglib-1.2.so.0 + 0x113cc (0x409ce3cc) libgtk-1.2.so.0 + 0x9300c (0x408ed00c) nsAppShell::Run() nsAppShellService::Run() main1() main() libc.so.6 + 0x18a5e (0x40247a5e)
Comment 21•24 years ago
|
||
What version of gtk is on the machine that crashes?
Reporter | ||
Comment 22•24 years ago
|
||
The machine that crashes is running GTK 1.2.
Comment 23•24 years ago
|
||
my stock rh62 machine has gtk 1.2.6, presumeably that is the version radha has.
Reporter | ||
Comment 24•24 years ago
|
||
To be more precise, this machine is running GTK 1.2.7.
Comment 25•24 years ago
|
||
Giving to the toolkit team. I could not reproduce it in my machine. Stack has no SH code in it.
Assignee: radha → trudelle
Status: ASSIGNED → NEW
Component: History: Session → XP Toolkit/Widgets
Assignee | ||
Comment 27•24 years ago
|
||
I can't reproduce this on my machine (running RH7, gtk+-1.2.8). I have a feeling this may have been a bug in 1.2.7, or may have been fixed by some other checkin (or I just can't click fast enough). Can anybody still repro this with the latest mozilla builds? If so, what versions of gtk+, etc. do you have?
Assignee | ||
Comment 28•24 years ago
|
||
updating qa to john the toolkit master morrison, accepting...
Status: NEW → ASSIGNED
QA Contact: claudius → jrgm
Comment 29•24 years ago
|
||
Yeah, I can crash rh6.1 with > glib-config --version 1.2.5 > gtk-config --version 1.2.5 > I clicked about 10 links in a row, then proceeded to cycle up and down the list getting mozilla churning pretty hard, and eventually it crashed with a stack similar to the one above.
Assignee | ||
Comment 30•24 years ago
|
||
I can't, for the life of me, reproduce this bug, either on my machine (Redhat 7) or kandrot's (SuSE). We both use gtk+ 1.2.8, so I'm tempted to say it's a gtk bug, but there's still the possibility that it's a timing bug. Both my machine and kandrot's are fast (700MHz)... jrgm, or brodms, or anybody who sees this bug: Would it be possible for you to temporarily upgrade your gtk+ version to 1.2.8, since you're experiencing the bug currently, and see if upgrading fixes it?
Reporter | ||
Comment 31•24 years ago
|
||
I will upgrade to GTK 1.2.8 this weekend...
Comment 32•24 years ago
|
||
I can't duplicate the bug with gtk 1.2.9 + 2001022808, and I've seen it (with prior versions of gtk) since literally the dawn of time. Probably is a gtk bug, then.
Assignee | ||
Comment 33•24 years ago
|
||
Okay, sounds good to me. Thanks for all your help! I'll resolve this as INVALID, since it's not our fault, and see if I can get our "official gtk version," if there is such a thing, bumped up to 1.2.8.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → INVALID
Comment 34•24 years ago
|
||
*** Bug 71754 has been marked as a duplicate of this bug. ***
Comment 35•24 years ago
|
||
guys, guys,... what are we saying here? are we saying the equivelent of, "oh, we crash only on win95 so lets not support that platform????" we need a bit of digging deeper. this is a listing of all the 'new' user comments of m0.8 talkback data center around hitting the back button... its about the 4th ranked crasher on the 0.8 milestone. looks like its happening on NT 4 and 5 as well but at a lower frequency and there could be multiple things going to cause the crashes.. Crash Analysis M08 Build - Related to back back related user comments ====== 180 - 0x00000000 40413ba6 BBID: 27437231 sec. http://abc.net.au/news/ Hit back button running on Windows NT 5.0 build 2195 src_file line 0x00000000 b582554e BBID: 27100526 sec. http://pages.ebay.com/search/items/search.html started browser. went to www.ebay.com. clicked search link. it took me to http://pages.ebay.com/search/items/search.html. page loaded. text disappeared. hit back. access violation. running on Windows NT 5.0 build 2195 src_file line - 0x000a000e bbf969aa BBID: 27399893 sec. http://www.dealtime.de/ bookmark window: dragged last (or 2nd from end) bookmark at window top (window scrolled authomatically backwards) and dropped bookmark: boom running on Windows NT 5.0 build 2195 src_file line - 0x285ef9b1 f24deba2 BBID: 27457418 sec. http://www.linuxtoday.com Looking at linuxtoday.com.Clicked a new.Then back and once the page started to show drag & drop the URL to the bookmarks sidebar into the personal toolbar folder.and ... that's all. running on Windows 95 4.0 build 67306684 src_file line - 0x85fc488d 68911668 BBID: 26800842 sec. www.jabber.com Opened up the page. The page has a flash animation on it. Went back one to the About screen. Then tried to go forward one. Boom. running on Windows 95 4.0 build 67109975 src_file line - 0xffffffff e20458a5 BBID: 26990693 sec. www.email.cz PI pressed back I was asked to confirm form data resubmission but before I preswsed back for three items (using an arrow) and than I canaceled the resubmission. It crashed Mozilla. running on Windows NT 4.0 build 1381 src_file line - JS_GetPrivate 3d26a039 BBID: 27095897 1859 sec. hit the back button running on Windows NT 5.0 build 2195 src_file d:/builds/0.8/mozilla/js/src/jsapi.c line 1859 - KERNEL32.DLL + 0xb9a6 (0xbff7b9a6) 41ee399f BBID: 27485256 sec. I pushed "back" button when there was no connection to Internet running on Windows 98 4.10 build 67766446 src_file line - MSVCRT.dll + 0xd157 (0x7800d157) 438e00dc BBID: 27350397 sec. www.slashdot.org Pressing the back button running on Windows NT 4.0 build 1381 src_file line - gklayout.dll + 0x1d311 (0x602fd311) cdf45b3c BBID: 27475804 sec. crash hitting back button. running on Windows NT 4.0 build 1381 src_file line - gklayout.dll + 0x1d311 (0x602fd311) dc56f1c9 BBID: 27471174 sec. Clicking the "back" button. running on Windows NT 5.0 build 2195 src_file line - gklayout.dll + 0x1d311 (0x602fd311) fd79750e BBID: 27451767 sec. http://freshmeat.net going back on real networks website... running on Windows NT 4.0 build 1381 src_file line - js_MarkGCThing 9303e52f BBID: 27570241 788 sec. www.kmeleon.org Went back from the results of the poll running on Windows 98 4.10 build 67766222 src_file d:/builds/seamonkey/mozilla/js/src/jsgc.c line 788 - js_MarkGCThing 9d684a24 BBID: 27087093 787 sec. http://www.tivo.com Hit the back arrow to return to another page from the TiVo page with flash animation. running on Windows NT 5.0 build 2195 src_file d:/builds/0.8/mozilla/js/src/jsgc.c line 787 - 0x00000000 106cc52d BBID: 26854241 sec. www.soureforge.net pressing the back button from quanta.sourceforge.net running on Linux 2.4.2 src_file line - 0x00000000 1acbbeaa BBID: 27046596 sec. back button from a .txt page to an html one in Navigator running on Linux 2.4.1 src_file line - 0x00000000 20e4ef56 BBID: 27194517 sec. google.com Hitting the back button of a search. running on Linux 2.2.5-15 src_file line - 0x00000000 23760159 BBID: 27478561 sec. www.uswestdex.com hit the back browser button several times in rapid succession the browser just disappeared. running on Linux 2.2.14 src_file line - 0x00000000 37a7322b BBID: 26868721 sec. Crashed going backwards in session history. running on Linux 2.2.17-14 src_file line - 0x00000000 450e352b BBID: 26927337 sec. http://www.videolan.org clicking the back button running on Linux 2.2.19pre14ext3 src_file line - 0x00000000 450e352b BBID: 26932965 sec. http://www.debian.org clicking the back button running on Linux 2.2.19pre14ext3 src_file line - 0x00000000 450e352b BBID: 27271231 sec. http://www.theregister.co.uk hitting the back button running on Linux 2.2.19pre14ext3 src_file line - 0x00000000 46e7139b BBID: 27479277 sec. internal bugzilla URL Looking at our internal bugzilla site... hit the back button after an updating bug. running on Linux 2.2.14-5.0 src_file line - 0x00000000 57131f8d BBID: 26961269 sec. using the back button running on Linux 2.2.14-5.0 src_file line - 0x00000000 5842f7b4 BBID: 27125813 sec. http://sourceforge.net/ backing out of project documentation page running on Linux 2.4.2 src_file line - 0x00000000 6e0e5358 BBID: 26905967 sec. http://www.autoweb.com/buy.htm Pressed the back button while the page was loading and it puked. running on Linux 2.2.17-21mdk src_file line - 0x00000000 7376c723 BBID: 27067826 sec. rapidly hitting the back button running on Linux 2.2.17 src_file line - 0x00000000 83b498b0 BBID: 27286119 sec. www.heise.de clicking back-Button twice in a short period of time running on Linux 2.2.14 src_file line - 0x00000000 9748fd05 BBID: 26925015 sec. http://www.ashford.com Hit the back button. running on Linux 2.2.17-21mdk src_file line - 0x00000000 aa6dd355 BBID: 26798488 sec. http://www.suzukicycles.com looking at the GZ250 and clicking the back button running on Linux 2.2.19pre9ext3 src_file line - - 0x00000000 ba4f8b23 BBID: 27643556 sec. back on suse portal running on Linux 2.2.16 src_file line - 0x00000000 c7254653 BBID: 27517524 sec. Mozilla sometimes(NOT ALWAYS) crashing when pressing back button.... This bug has been here very long infact this bug exist both in netscape 4 and mozilla....If you going back in the history cache by clicking the Back button iconthe browser will sometimes crash :-/ running on Linux 2.4.2 src_file line - 0x00000000 d7d8a14a BBID: 27605557 sec. Just using the back button... running on Linux 2.2.16-22 src_file line - 0x00000000 e703a581 BBID: 26985481 sec. Pressing the back button multiple times very quickly. running on Linux 2.2.18 src_file line - 0x00000010 d56be25e BBID: 27538994 sec. www.twoview.co.uk Hit the back buton running on Linux 2.2.18 src_file line - 0x00000011 83df530c BBID: 26991582 sec. www.ebay.com I had hit the back button several times and then it crashed. running on Linux 2.2.16-22 src_file line - 0x00000020 5a1823e5 BBID: 27468991 sec. 7 I pressed the back button while it was rendering a page after I pressed the back button again. OK that's a bad explanation... I pressed back twice in a row and it crashed after the second one. running on Linux 2.2.13 src_file line - 0x000000e8 9c53460a BBID: 26879294 sec. I closed mozilla 0.8 (installed from binaries for linux i386) when the talkback window appeared. running on Linux 2.2.18 src_file line - 0x00420005 71b022e2 BBID: 26825828 sec. Running for a long time (3 days?). Played with some forms onhttp://www.dabs.com/ a bit and hit "back" several times quickly. Boom :) running on Linux 2.2.17-21mdk src_file line - 0x0066006f dbe5c47b BBID: 26914748 sec. http://www.avsforum.com (unknown subpage URL) Hit back button. running on Linux 2.4.2 src_file line - 0x006d006f ceeac9d4 BBID: 26789210 sec. netscape.com multiple clicking on back button without waiting for the page to load and display. running on Linux 2.4.1 src_file line - 0x087d5ad1 8de7e14d BBID: 27045613 sec. I was starting a download and at the same time I pressed the back button. running on Linux 2.4.1 src_file line - 0x08820556 9e8a28d2 BBID: 27290290 sec. http://www.unibank.dk I don't know what was the cause of the crash. I was pressingback when it happened. running on Linux 2.2.16-3 src_file line - 0x088f6d5c 957aba2e BBID: 27091229 sec. www.openmotif.org Pressing the back button while two downloads were active running on Linux 2.2.17-8 src_file line - 0x0918526e d28d54ae BBID: 27060275 sec. unknown Going back to a previously viewed page. running on Linux 2.4.2 src_file line - 0x0921d09a 29034a10 BBID: 27016232 sec. http://www.slashdot.org/ Setting the background colour to white. running on Linux 2.2.5-15 src_file line - 0x11d1ad6a 56e7d1b0 BBID: 27135286 sec. www.mozillazine.org I was pressing the back button (going back to www.mozilla.org) running on Linux 2.2.16-storm src_file line - 0x40367470 eec7e192 BBID: 27000381 sec. http://bugzilla.mozilla.org Pressed the 'back' button twice... running on Linux 2.2.17-0.24mdk src_file line - 0x40b00061 cffe47e4 BBID: 26813289 sec. clicking on the "back" button several times in a row running on Linux 2.2.18 src_file line - 0x40ea48c5 caea6f0a BBID: 27069090 sec. monster.com hit back button expected it to ask if I wanted to repost form data. running on Linux 2.4.1 src_file line - 0x40ed72c2 8f47de5b BBID: 26775771 sec. (internal web site) hit back button going through some pages generated from cgi-binscripts running on Linux 2.2.16-3 src_file line - 0x74163a83 fc0bc409 BBID: 26944028 sec. changing the default background colors in Preferences. running on Linux 2.2.18 src_file line - libc.so.6 + 0x52502 (0x4028d502) 6ad9d819 BBID: 27297719 sec. http://www.compaq.it/presario/prodotti/portatili/14_xl453/caratteristiche.html I pressed the "back" button running on Linux 2.2.15-4mdk src_file line - libc.so.6 + 0x76917 (0x402aa917) 5ef14161 BBID: 26743599 sec. www.zive.cz I pressed the 'back' button to get out of the list of comments under the article. running on Linux 2.4.1-ac12 src_file line - libc.so.6 + 0x79618 (0x402ad618) 1590429a BBID: 27413715 sec. http://www.vivo.com/ I clicked on the back button 4 or 5 times rapidly. running on Linux 2.2.17 src_file line - libc.so.6 + 0xa6af4 (0x402d2af4) 414b13fe BBID: 26998647 sec. seems like a feedback agent failure - the browser seems to have started up okbut i'm getting the feedback agent anyway. running on Linux 2.2.16-3 src_file line - libc.so.6 + 0xb2c82 (0x402dcc82) d5f1d816 BBID: 27124458 sec. http://www.cam.ac.uk/societies/boatclub/ I think I clicked "back".(from inside some frames thing for which the URL seems to be hidden) running on Linux 2.2.16-4.cl.ext3 src_file line - libc.so.6 + 0xb2c82 (0x402dfc82) eb44f290 BBID: 26832204 sec. http://www.gmu.edu/departments/economics/bcaplan/anarfaq.htm Hit the 'back' button running on Linux 2.2.14-5.0smp src_file line - libc.so.6 + 0xdea32 (0x40312a32) 3e1af77d BBID: 26936545 sec. www.worldonline.dk preesed the back button running on Linux 2.2.16-22 src_file line - libjavaplugin_oji.so + 0x1b416 (0x40f3d416) fed3aa4a BBID: 27701830 sec. http://www.echl.com this time I was going _back_ to that page... this is really annoying. running on Linux 2.2.17-21mdk src_file line - nsCachedNetData::Release 3a830548 BBID: 27660458 280 sec. hit back button. running on Windows NT 4.0 build 1381 src_file d:/builds/seamonkey/mozilla/netwerk/cache/mgr/nsCachedNetData.cpp line 280 - nsCachedNetData::Release 72ce5225 BBID: 27046673 279 sec. www.dagbladet.no pressed `back' stack trace:NECKO! 6065ce8a()XPCOM! 60ca7630()NECKO! 606723e2()NECKO! 6064cc30()NECKO! 6064cb76()778b0c24() running on Windows NT 5.0 build 2195 src_file d:/builds/0.8/mozilla/netwerk/cache/mgr/nsCachedNetData.cpp line 279 - nsCachedNetData::Release 942e6766 BBID: 27156536 280 sec. http://sinfest.net/d/20010228.html used back context menu to go from here to /20010301.html and kaboom! this was first session with todays trunk build don't know if this is common..... running on Windows NT 5.0 build 2195 src_file d:/builds/seamonkey/mozilla/netwerk/cache/mgr/nsCachedNetData.cpp line 280 - nsCachedNetData::Release() 65c9d6c3 BBID: 27614351 sec. Hit the back button running on Linux 2.2.17-21mdk src_file line - nsCachedNetData::Release() 72cb148b BBID: 27144294 sec. clicked the "back" button running on Linux 2.2.17-21mdk src_file line - nsCachedNetData::Release() 9a4d1ef3 BBID: 27325423 sec. hitting back button running on Linux 2.2.16-22 src_file line - nsEventStateManager::UpdateCursor f07682c2 BBID: 27293569 1427 sec. Slashdot going back several pages in history running on Windows 98 4.10 build 67766446 src_file d:/builds/0.8/mozilla/layout/events/src/nsEventStateManager.cpp line 1427 - nsGenericDOMDataNode::IsOnlyWhitespace() 7f799368 BBID: 27478253 sec. http://www.ibm.com/ using the back button to get back to google. A bunch of javascriptwindows had just popped up from ibm's site. running on Linux 2.4.1 src_file line - nsHTTPPipelinedRequest::OnStopRequest() 719aafca BBID: 27660320 sec. http://www.avweb.com back one page running on Linux 2.4.1 src_file line - nsHTTPPipelinedRequest::WriteRequest() 48ae0d42 BBID: 27587200 sec. http://freshmeat.net/projects/lyx i go back from the lyx homepage to the freshmeat lyx project page and crash ! running on Linux 2.4.2 src_file line - nsSupportsArray::Clear 26cd3ae5 BBID: 26803835 320 sec. Hit back button. (can't remember URL) running on Windows NT 4.0 build 1381 src_file d:/builds/0.8/mozilla/xpcom/ds/nsSupportsArray.cpp line 320 - nsWindow::UpdateIdle() 593da47a BBID: 27310397 sec. Dilbert cartoon page (I don't know the URL; my browser has just crashed :) I was hitting the back-button repeatedly. I've noticed that the Dilbertcartoon page doesn't want to go to the page that I was viewing beforeit (don't know why yet) and I was just being obnoxious about it...Despite this little thing running on Linux 2.2.12-32 src_file line - nsWindow::UpdateIdle() d367fe61 BBID: 26830914 sec. hitting the back button in my browser running on Linux 2.2.17 src_file line
Comment 36•24 years ago
|
||
jpatel, can you dig out some of the NT stack traces when the talkback server comes back up?
Summary: Rapidly hitting Forward & Back buttons crashes browser. → M08 Rapidly Forward&Back crashes browser.[@ 0x00000000 - nsAppShell::Run]
Assignee | ||
Comment 37•24 years ago
|
||
I figured out what was going on with Linux, but I haven't got any clue for the Windows problems. I think they're probably unrelated, given that upgrading GTK solved the problem on Linux. You might try hunting around for talkback crashes relating to forward or back buttons located in /widget/src/windows... That'd be my best guess. Reassigning to choffman.
Assignee: dr → chofmann
Status: REOPENED → NEW
OS: Linux → Windows NT
Comment 38•24 years ago
|
||
I agree with Dan, from the talkback data, it looks like this particular crash (0x00000000) might be a little different than the windows crashes. Talkback is having problems, so I haven't had a chance to look for a windows stack trace, but I will post it here as soon as i can so that we can look at it before deciding whether to log a new bug for the windows crash or not.
Comment 39•24 years ago
|
||
Okay, I just reproduced this three times on a 800MHz Redhat7.0 glib/gtk 1.2.8 This is a linux-only bug (it's deep into gtk/glib), and a separate bug should be filed for windows crashing on this user action. There may be nothing that can be done, or perhaps there is a way to defend against it, or gee, find the bug in glib and fix it :-] Dan, if you need help to reproduce the crash, I'll come show you how to get medieval on the browser buttons.
Assignee: chofmann → dr
Keywords: mozilla1.0
OS: Windows NT → Linux
Whiteboard: nsbeta1+ → linux crash in glib/gtk
Status: NEW → ASSIGNED
Keywords: helpwanted
Summary: M08 Rapidly Forward&Back crashes browser.[@ 0x00000000 - nsAppShell::Run] → Rapidly hitting forward & back crashes in gtk/glib code
Whiteboard: linux crash in glib/gtk
Assignee | ||
Comment 40•24 years ago
|
||
Man! Ok, accepting... If we're crashing in gtk/glib code and it's not their fault, then there are a few possibilities. We're very likely passing null to something, but what could be uninitialized? Could be the content area maybe? Hmm... Reopening 71754 for chofmann's windows bug also...
Comment 41•24 years ago
|
||
*** Bug 71754 has been marked as a duplicate of this bug. ***
Comment 42•24 years ago
|
||
If you don't want to own this bug, then find the right owner.
Keywords: topcrash
Summary: Rapidly hitting forward & back crashes in gtk/glib code → Rapidly hitting forward & back crashes in gtk/glib code [@ 0x00000000 - nsAppShell::Run]
Comment 43•24 years ago
|
||
Crashes in gtk code will happen. Yeah it's not our code, but the reality of software is we need to do our best to avoid crashing in other libraries as well as our own.
Assignee | ||
Comment 44•24 years ago
|
||
Yeah, apologies for all the confusion. If I had taken a second to read the other bug, I would have noticed that it was also linux-only all along. Sorry about that. This isn't a toolkit bug, so setting to Browser-General. John Morrison gave some good advice, and I'm still on this.
Component: XP Toolkit/Widgets → Browser-General
Keywords: qawanted
Comment 45•24 years ago
|
||
I know little to nothing about the priorities of the folks who are responsible for this bug, but given that much of the linux world will be (most likely) upgrading to newer versions of GTK in the reasonably near future (debian unstable already has 'safe' gtk packages, and RH 7.1 will cover most corporate installations) this probably shouldn't be "critical" anymore. It would still be ideal to fix the problem eventually but I'm sure there must be other problems that moz's time can be spent on.
Assignee | ||
Comment 46•24 years ago
|
||
liv: we realized the problem unfortunately still exists with the newer versions of gtk. it seems like fixing this bug will be a matter of compiling moz against a debug build of gtk/glib :(
Comment 47•24 years ago
|
||
I'm going to guess that this is probably not a gtk bug but is actually something that we are doing that's bad. I need a better stack trace here since I've never seen this. Brendan, weren't you saying that you saw something similar to this in a recent build?
Comment 48•24 years ago
|
||
Adding M08 to summary for tracking, since this crash was reported after looking at M08 talkback data.
Summary: Rapidly hitting forward & back crashes in gtk/glib code [@ 0x00000000 - nsAppShell::Run] → Rapidly hitting forward & back crashes in gtk/glib code M08 crash [@ 0x00000000 - nsAppShell::Run]
Comment 49•24 years ago
|
||
Yes, I recently saw a crash jumping through 0 from nsWindow::UpdateIdle. Of course, due to crappy gnome-terminal vs. gdb vs. ??? clipboard behavior, I couldn't copy the stack. It was shallow. /be
Comment 50•24 years ago
|
||
Adding nscatfood nomination from dup bug 71754 and moving over the crash car.
Keywords: nsCatFood
Comment 51•24 years ago
|
||
Dan: how recent a version of gtk was this seen on? I've been able to reliably reproduce this bug for nearly 22 months now (since June-ish 1999) and am now completely unable to reproduce the behavior with a Gnome pre-1.4 gtk (1.2.9). Are you sure the new manifestation has the same roots as the old?
Comment 52•24 years ago
|
||
This was reproduced on glib/gtk 1.2.8, Redhat7.0 on a 800MHz/128MB pc, as noted earlier. I apologize for not having upgraded. ;-]
Assignee | ||
Comment 54•24 years ago
|
||
->moz0.9.1, per triage
Target Milestone: mozilla0.9 → mozilla0.9.1
Assignee | ||
Comment 55•24 years ago
|
||
re: email from choffman about topcrashers I'm slightly doomed with embedding 0.9 work right now, plus I've been wrestling with gdb in a feeble attempt to get it to tell me anything. If you want me to bother pavlov to look at this in purify on solaris, I have to bounce that off of trudelle -- please ask him. Otherwise, this is P1 for 0.9.1.
Comment 56•24 years ago
|
||
cc'ing arik, who may be able to get to this sooner.
Assignee | ||
Comment 57•24 years ago
|
||
Finally got a workable gdb arrangement, no thanks to 57051. Anyway, with a debug gtk and glib build, I get the following stack trace: #0 0x00000000 in ?? () #1 0x4086eb25 in nsWindow::UpdateIdle (data=0x0) at nsWindow.cpp:617 #2 0x40a25214 in g_idle_dispatch (source_data=0x4086eabc, dispatch_time=0xbffff510, user_data=0x0) at gmain.c:1367 #3 0x40a24271 in g_main_dispatch (dispatch_time=0xbffff510) at gmain.c:656 #4 0x40a2487d in g_main_iterate (block=1, dispatch=1) at gmain.c:877 #5 0x40a24a0c in g_main_run (loop=0x81f8298) at gmain.c:935 #6 0x4093e83f in gtk_main () at gtkmain.c:524 #7 0x40854af5 in nsAppShell::Run (this=0x80a9818) at nsAppShell.cpp:360 #8 0x407eba09 in nsAppShellService::Run (this=0x80b3520) at nsAppShellService.cpp:407 #9 0x08054007 in main1 (argc=1, argv=0xbffff784, nativeApp=0x0) at nsAppRunner.cpp:1005 #10 0x08054ccf in main (argc=1, argv=0xbffff784) at nsAppRunner.cpp:1306 #11 0x402f4f31 in __libc_start_main (main=0x8054acc <main>, argc=1, ubp_av=0xbffff784, init=0x804f060 <_init>, fini=0x805e444 <_fini>, rtld_fini=0x4000e274 <_dl_fini>, stack_end=0xbffff77c) at ../sysdeps/generic/libc-start.c:129 The source at nsWindow.cpp#617 is window->Update(): gboolean nsWindow::UpdateIdle (gpointer data) { GSList *old_queue = update_queue; GSList *tmp_list = old_queue; update_idle = 0; update_queue = nsnull; while (tmp_list) { nsWindow *window = (nsWindow *)tmp_list->data; window->mIsUpdating = PR_FALSE; window->Update(); tmp_list = tmp_list->next; } g_slist_free (old_queue); return PR_FALSE; } The fact that we set mIsUpdating to false immediately before we go and update seems strange to me. The data argument passed here is null, but I think that's a red herring (iirc, that's just the way all gtk signals/slots with function pointers work). Hmm...
Assignee | ||
Comment 58•24 years ago
|
||
brendan: So I can confirm your experience jumping through 0 in UpdateIdle. |this| is non-null, |window| is non-null and |data| is null but uninteresting, but gdb gives me a whole bunch of member variables of |window| that are null and interesting. The ones that look awfully suspicious are: (nsBaseWidget) - mClientData - mContext - mAppShell - mToolkit - mChildren (nsWidget) - mWidget (!!!) - mParent (nsWindow) - mShell - mSuperWin There are others, but these strike more fear into my heart, especially mWidget. Thing is, the obvious assumption would be "gee, I ought to be croaking on a line where I'm trying to dereference a null pointer," but the line in question, |window->Update()|, and the entire function body around it, is clean of such problems as far as I can tell. The |Update| function's first lines are |if (!mSuperWin); return NS_OK;|, which seem a little odd, but should return happily. The only weirdness, as far as I can see, is that we set our updating flag to false right as we go update. blizzard, brendan, any idea?
Assignee | ||
Comment 59•24 years ago
|
||
Fixing summary, keywords (this isn't a topcrash, btw, the talkback info chofmann posted is mostly win32).
Severity: critical → major
Keywords: topcrash
Summary: Rapidly hitting forward & back crashes in gtk/glib code M08 crash [@ 0x00000000 - nsAppShell::Run] → Crash in gtk/nsWindow::UpdateIdle, mashing back & fwd btns.
Assignee | ||
Comment 60•24 years ago
|
||
It's probably entirely uninteresting, but with this patch, my stack trace decides to leave off UpdateIdle and instead claims to die in g_idle_dispatch. This all makes very minimal sense to me. cvs server: Diffing . Index: nsWindow.cpp =================================================================== RCS file: /cvsroot/mozilla/widget/src/gtk/nsWindow.cpp,v retrieving revision 1.328 diff -u -r1.328 nsWindow.cpp --- nsWindow.cpp 2001/04/17 23:41:32 1.328 +++ nsWindow.cpp 2001/05/01 01:44:35 @@ -613,8 +613,9 @@ { nsWindow *window = (nsWindow *)tmp_list->data; - window->mIsUpdating = PR_FALSE; + window->mIsUpdating = PR_TRUE; window->Update(); + window->mIsUpdating = PR_FALSE; tmp_list = tmp_list->next; }
Comment 61•24 years ago
|
||
*** Bug 73418 has been marked as a duplicate of this bug. ***
Assignee | ||
Comment 62•24 years ago
|
||
Here's another patch (suggested by pavlov) which also *doesn't* work: Index: nsWindow.cpp =================================================================== RCS file: /cvsroot/mozilla/widget/src/gtk/nsWindow.cpp,v retrieving revision 1.328 diff -u -r1.328 nsWindow.cpp --- nsWindow.cpp 2001/04/17 23:41:32 1.328 +++ nsWindow.cpp 2001/05/03 01:18:15 @@ -216,6 +216,9 @@ UnqueueDraw(); } +static GSList *update_queue = NULL; +static guint update_idle = 0; + NS_IMETHODIMP nsWindow::Destroy(void) { // remove our pointer from the object so that we event handlers don't send us events @@ -228,6 +231,11 @@ if (mMozArea) gtk_object_remove_data(GTK_OBJECT(mMozArea), "nsWindow"); + // remove our idle function + gboolean rv(g_idle_remove_by_data(NULL)); + if (TRUE == rv) + update_idle = 0; + return nsWidget::Destroy(); } @@ -596,9 +604,6 @@ // all the updates in one shot. Actually, this queue should // be at most per-toplevel. FIXME. // - -static GSList *update_queue = NULL; -static guint update_idle = 0; gboolean nsWindow::UpdateIdle (gpointer data)
Assignee | ||
Comment 63•24 years ago
|
||
arik: my eyes, they are bleary. can you see anything funky in this code, besides that the code is funky? :)
Comment 64•24 years ago
|
||
This is a topcrash for M09, added topcrash keyword. Added M09 topcrash [@ 0x00000000 - nsAppShell::Run()] to summary for tracking Here are some URLs & Comments that might help repro this crash: (30146226) URL: http://freshmeat.net/daily/2001/05/08/ (30146226) Comments: Just hit back button. (30141334) URL: http://shrimpwars.be (30141334) Comments: Quickly clicking the "Back" button. (30128515) URL: thespark.com (30128515) Comments: I hit the "back" button several times while taking the IQ test; it went back a few times and then it crashed. Here is a recent stack trace: Incident ID 30146226 0x00000000 libglib-1.2.so.0 + 0x10f49 (0x407e6f49) libglib-1.2.so.0 + 0xff96 (0x407e5f96) libglib-1.2.so.0 + 0x10561 (0x407e6561) libglib-1.2.so.0 + 0x10701 (0x407e6701) libgtk-1.2.so.0 + 0x8c569 (0x4070b569) nsAppShell::Run() nsAppShellService::Run() main1() main() libc.so.6 + 0x189cb (0x401ea9cb)
Keywords: topcrash
Summary: Crash in gtk/nsWindow::UpdateIdle, mashing back & fwd btns. → Crash in gtk/nsWindow::UpdateIdle, mashing back & fwd btns. M09 topcrash [@ 0x00000000 - nsAppShell::Run()]
Assignee | ||
Comment 65•24 years ago
|
||
Jan: Yes, nothing's different about the stack trace. We die in nsWindow::UpdateIdle for no reason I can make out... I'm starting to wonder if it isn't a glib threadsafety issue... The only thing I can think to do, my previous patches having failed, is to bandaid the |window->mIsUpdating = PR_FALSE; window->Update();| with an |if (window)|, but my debugger tells me that |window| is non-null. Something else I might try out of desperation is replacing the (nsWindow *) cast with an NS cast macro, or to see if some non-nsWindow is being inserted somewhere as data to that queue, but I'm sure we'd have already run into that if it were the problem.
Comment 66•24 years ago
|
||
i just filed bug 79937 which is a crash in ::UpdateIdle do to a pure virtual method invocation. Although i considered it an xlib bug.
Updated•24 years ago
|
Severity: major → critical
Assignee | ||
Comment 67•24 years ago
|
||
Comment 68•24 years ago
|
||
i think this is a dupe of bug 80345 which contains a simple fix. *** This bug has been marked as a duplicate of 80345 ***
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → DUPLICATE
Assignee | ||
Comment 69•24 years ago
|
||
Sweet jesus, thank you so much... timeless: you should apply the same technique to xlib to fix your bug.
Status: RESOLVED → VERIFIED
Comment 70•24 years ago
|
||
sorry i didn't end up being helpfull ;-) will try better next time...
Comment 71•23 years ago
|
||
Mass removing self from CC list.
Comment 72•23 years ago
|
||
Now I feel sumb because I have to add back. Sorry for the spam.
Updated•20 years ago
|
Product: Browser → Seamonkey
Comment 73•19 years ago
|
||
it sounds like this one has been fixed, or the code has morfed to the point that this bug is no longer valuable. I might be worthwhile to set up reporting, analysis, and tracking of bug related to forward and back button activity since that has been a source of exposure to crash regressions in the past. closing this one and opening https://bugzilla.mozilla.org/show_bug.cgi?id=330085
Updated•13 years ago
|
Crash Signature: [@ 0x00000000 - nsAppShell::Run()]
You need to log in
before you can comment on or make changes to this bug.
Description
•