MASTER Firefox Crashed [@nsTextControlFrame::SetValue] ] [@nsTextControlFrame::SetProperty]

[siucdude]

Binary package hint: firefox

this is new since 2.02 version

ProblemType: Crash
Architecture: i386
CrashCounter: 1
Date: Thu Mar 1 19:30:40 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/lib/firefox/firefox-bin
Package: firefox 2.0.0.2+1-0ubuntu1
ProcCmdline: /usr/lib/firefox/firefox-bin
ProcCwd: /home/siucdude
ProcEnviron:
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games
 LANG=en_US.UTF-8
Signal: 11
SourcePackage: firefox
StacktraceTop:
 __kernel_vsyscall ()
 raise () from /lib/tls/i686/cmov/libpthread.so.0
 ?? ()
 ?? ()
 ?? ()
Uname: Linux siucdude-laptop 2.6.20-9-generic #2 SMP Mon Feb 26 03:01:44 UTC 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev scanner video

From the retraced stacktrace:
#0 __kernel_vsyscall ()
#1 raise () from /lib/tls/i686/cmov/libpthread.so.0
#2 nsProfileLock::FatalSignalHandler (signo=11)
#3 <signal handler called>
#4 nsTextControlFrame::SetValue (this=0xa2c5b5c,
#5 nsTextControlFrame::SetProperty (this=0xa2c5b5c,
#6 nsHTMLInputElement::SetValueInternal (this=0xa6d44c0,
#7 nsHTMLInputElement::SetValue (this=0xa6d44c0,
#8 XPTC_InvokeByIndex () at xptcinvoke_gcc_x86_unix.cpp:50
#9 XPCWrappedNative::CallMethod (ccx=@0xbfcd87e8,
#10 XPC_WN_GetterSetter (cx=0xa0e56f0, obj=0xa97d210, argc=1,
#11 js_Invoke (cx=0xa0e56f0, argc=1, flags=2) at jsinterp.c:1396
#12 js_InternalInvoke (cx=0xa0e56f0, obj=0xa97d210,
#13 js_InternalGetOrSet (cx=0xa0e56f0, obj=0xa97d210,
#14 js_SetProperty (cx=0xa0e56f0, obj=0xa97d210, id=135312344,
#15 js_Interpret (cx=0xa0e56f0,
#16 js_Invoke (cx=0xa0e56f0, argc=1, flags=2) at jsinterp.c:1415
#17 js_InternalInvoke (cx=0xa0e56f0, obj=0xa97d218,
...

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Retrace done.

Marked as mt-confirm for further analysis.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Related to upstream's https://bugzilla.mozilla.org/show_bug.cgi?id=357030

[Borsboom (borsboom)]

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.5pre) Gecko/20070603 BonEcho/2.0.0.5pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.5pre) Gecko/20070603 BonEcho/2.0.0.5pre

Firefox intermittently crashes with a SIGSEGV on opening a popup window with window.open javascript code.

Reproducible: Sometimes

Steps to Reproduce:
1. clicking the 'tekstlink' link in the middle of the given URL
2.
3.
Actual Results:
a crash with SIGSEGV

Expected Results:
appearance of a new popup window

Have tried a clean install and a new profile, but this does not resolve the issue.

The same crash can be intermittently evoked when clicking 'Internetbankieren' in the blue bar on the page http://www.rabobank.nl/particulieren/

OS:
Linux nb_knorkaan 2.6.20.11 #1 SMP PREEMPT Thu May 3 20:52:41 CEST 2007 i686 GNU/Linux

[Borsboom (borsboom)]

Created attachment 267134
stack backtrace

[Borsboom (borsboom)]

A critical element in the crash seems to be GetFormControlFrame in nsHTMLInputElement::SetValueInternal returning a non-NULL value when clicking the link described above. In that case, the crash happens. When GetFormControlFrame returns NULL, the window pops up as expected.

[Ria-klaassen (ria-klaassen)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.5pre) Gecko/20070604 BonEcho/2.0.0.5pre
WFM.

[Adam Guthrie (ispiked)]

Stack is similar to the one in bug 301270. It would be great if you could attach a minimized testcase including steps on what to do to crash.

[Borsboom (borsboom)]

Created attachment 267169
testcase using window.open

this minimal testcase crashes my firefox when repeatedly clicking the link and closing the popup window

[Borsboom (borsboom)]

bug 357030 also has a similar stack trace

[Vladimir-sukhoy (vladimir-sukhoy)]

Works for me, Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.4) Gecko/2007051502 Firefox/2.0.0.4

It does seem odd that timer routines are in the stack frame.. Maybe some extension is to blame...

[Borsboom (borsboom)]

a method that seems to trigger the bug in 100% of the cases for me:

* run firefox in gdb
* set a breakpoint on nsAppShell::Spindown
* run the test testcase which should trigger the breakpoint
* continue execution which leads to a SIGSEGV with the same stack backtrace

I have no idea why, but this bug seems to be introduced by the commit from bug 368501. When I undo this commit in the current cvs 1.8 branch, the testcase above does not crash firefox anymore.

[Olli-pettay (olli-pettay)]

Works for me, 1.8 branch/Linux (x86/Fedora7 and x86_64/Fedora5)

[Hilario J. Montoliu (hjmf) (hmontoliu)]

A workaround suggested by upstream is to use a clean profile to get rid of this issue.

Any feedback on this will be appreciated.

[Adam Guthrie (ispiked)]

It sounds like this crash might be caused by an extension people are using. For those of you who are seeing this, are you using any extensions with Firefox, and if so, does it happen when you run Firefox in safe mode [0]; i.e. with extensions and themes disabled?

[0] http://kb.mozillazine.org/Safe_mode

[Alexander Sack (asac)]

On Thu, Jun 07, 2007 at 06:45:19PM -0000, Adam Guthrie wrote:
> It sounds like this crash might be caused by an extension people are
> using. For those of you who are seeing this, are you using any
> extensions with Firefox, and if so, does it happen when you run Firefox
> in safe mode [0]; i.e. with extensions and themes disabled?
>
> [0] http://kb.mozillazine.org/Safe_mode
>

Actually, we definitly would need someone that can reproduce to tell
us how to reproduce. Only then we can tackle this crash which appears
to happen not only to a few users.

So a simple testcase is most appreciated. If you see this crash,
please track it down for us.

 - Alexander

[Hilario J. Montoliu (hjmf) (hmontoliu)]

At ubuntu's bug tracker we have received 6 crashes with this stacktrace [1]. Btw I cannot reproduce the test case proposed in comment #5.

[1] https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/89090

[Martijn-martijn (martijn-martijn)]

I added a testcase (with enhanced privileges) in bug 373586 that crashes with this stacktrace.

[Dveditz (dveditz)]

How would a bug that was post-1.8 branch be relevant to this bug? or to flip it around, why isn't that test case here rather than added to a fixed bug?

[Dveditz (dveditz)]

Don't see how we can block on an unconfirmed bug. Renominate if there's more progress here.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Possible test case (from dup bug #123795) [1]:

Go to the page [2] ; As soon as you can see the image (K-EUROPAHAV.jpg), click on it repeatedly. I notice high CPU usage for a couple of seconds then itcrashes.

(not yet tested)

[1] https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/123795
[2] http://hd.se/inrikes/2007/07/03/algblomning-paa-gaang-i/

[Johnathon (kirrus)]

We've found that in our instance (using scalix webmail, http://scalix.com), clearing Cookies and Authenticated sessions has solved this issue for now. (I've already moved the user onto a clean Firefox profile, that worked for a time, and then FF started crashing with the same error again.)

Will post if we get more errors with this one...

[Alexander Sack (asac)]

we still see dupes coming in from 2.0.0.4/1.5.0.12 ... so confirming as a first step.

[Alexander Sack (asac)]

note: the attached testcase doesn't crash for me.

[Martijn-martijn (martijn-martijn)]

A patch was checked in in bug 386254, that fixed a crash with a similar stacktrace.
This was checked in on the 1.8.1.5 and 1.8.0.13 branch, so hopefully that fixes it.

[Alexander Sack (asac)]

we should search for dupes against the firefox-3.0 package.

[Alexander Sack (asac)]

according to upstream a similar backtrace was fixed.

[Alexander Sack (asac)]

*** This bug has been marked as a duplicate of bug 386254 ***

[Alexander Sack (asac)]

ok, appears to be really fixed upstream.