firefox crashed with SIGSEGV in [@nsDocAccessible::FlushPendingEvents] [@ReleaseObjects]

[Andrew Conkling]

Binary package hint: firefox-3.0

Another attempt (after bug #204077) to get a useful backtrace on this report. At this point, I can reproduce it by having two tabs open--Gmail and a blank tab--and closing Gmail's tab.

I have every debug package I know of installed, so I don't really know why this stacktrace wasn't useful before. Please advise if this one is also not useful.

ProblemType: Crash
Architecture: i386
Date: Sun Mar 30 15:47:22 2008
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/lib/firefox-3.0b4/firefox
NonfreeKernelModules: fglrx
Package: firefox-3.0 3.0~b4+nobinonly-0ubuntu1
PackageArchitecture: i386
ProcCmdline: /usr/lib/firefox-3.0b4/firefox
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/zsh
Signal: 11
SourcePackage: firefox-3.0
StacktraceTop:
 ReleaseObjects (aElement=0x9ede090) at nsCOMArray.cpp:151
 nsVoidArray::EnumerateForwards (this=0x9a5827c,
 nsCOMArray_base::Clear (this=0x9a5827c)
 nsDocAccessible::FlushPendingEvents (this=0x9a581e0)
 nsDocAccessible::FlushEventsCallback (aTimer=0x9e09368,
Title: firefox crashed with SIGSEGV in ReleaseObjects()
Uname: Linux 2.6.24-12-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy fuse lpadmin netdev plugdev powerdev sambashare scanner vboxusers video

[Apport retracing service (apport)]

StacktraceTop:ReleaseObjects (aElement=0x9ede090) at nsCOMArray.cpp:151
nsVoidArray::EnumerateForwards (this=0x9a5827c,
nsCOMArray_base::Clear (this=0x9a5827c) at nsCOMArray.cpp:158
nsDocAccessible::FlushPendingEvents (this=0x9a581e0)
nsDocAccessible::FlushEventsCallback (aTimer=0x9e09368,

[Alexander Sack (asac)]

need more dupes.

[Andrew Conkling (andrewski)]

On Fri, May 9, 2008 at 4:46 PM, Alexander Sack <email address hidden> wrote:

> need more dupes.
>

What?

[Luke Faraone (lfaraone)]

I'm able to reproduce this bug.

[over 5000 (over5000-deactivatedaccount)]

I'm experiencing the same problem.

During the FF3 beta time, I was using nightly builds (auto-updated from the mozilla public ftp server), in hope to see this fixed some time, but it won't work.
Neither any of the betas, nor the release version or the 3.0.1pre builds solve this problem. So it's probably an upstream problem.

[Carey Underwood (cwillu)]

Workaround: instead of closing the tab, type in a different address and hit enter, and _then_ close the tab.

[eugrus (eugrus)]

cwillu, we see :)

[ollie (ollie-ollie)]

I'm pretty sure this is now fixed since today's (June 13th) hardy-proposed update of Firefox (to 3.0.1+build1+nobinonly-0ubuntu0.8.04.1) and Xulrunner (to 1.9.0.1+build1+nobinonly+0ubuntu0.8.04.1).

The symptoms are no longer reproducible on my system, closing Google Mail/Docs tabs no longer cause Firefox to crash with a Segmentation Fault. Will check for the related crashes using random self-refreshing ajax sites during normal use in the course of the next few days and general stability while keeping a GMail tab open and periodically refreshing. Would someone else affected please upgrade (from hardy-proposed) and confirm?

[antage (antage)]

> Would someone else affected please upgrade (from hardy-proposed) and confirm?
I confirm. FF 3.0.1 from hardy-proposed is free of this bug.

[Andrew Conkling (andrewski)]

As reported on bug 240786 and in the forums, and confirmed by me, Firefox 3.0.1 in hardy-proposed fixes this issue.

[Pedro (pedro-zampa)]

I have a similar crash of firefox and intrepid (all the system) when trying to download the zipped file ("Download all attachments" link) of the attachments in gmail.