MASTER firefox-bin crashed with crux theme [@moz_gtk_widget_paint] at #10

[Bryan Quigley]

Binary package hint: firefox

I was attempting to download the torrent of fluxbuntu.org and Firefox crashed. It crashed with Both Firefox2 and Firefox 3 alpha. It works fine in Epiphany. This is on Gutsy.

Torrent off of this page: http://modzer0.cs.uaf.edu/~hardwarehank/fluxbuntu/rev2/

I'll provide more when I'm willing to crash Firefox again.

It appears the Crux theme might be the cause as it only happens with it turned on.

Steps to reproduce.
1. Change to theme Crux.
2. Open Firefox.
3. Go to site. (Above)
4. Try to download torrent.

ProblemType: Crash
Architecture: i386
Date: Sun Jul 29 00:10:17 2007
Disassembly: 0xffffe410:
DistroRelease: Ubuntu 7.10
ExecutablePath: /usr/lib/firefox/firefox-bin
NonfreeKernelModules: cdrom
Package: firefox 2.0.0.5+2-0ubuntu2
PackageArchitecture: i386
ProcCmdline: /usr/lib/firefox/firefox-bin
ProcCwd: /home/bryan
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: firefox
Stacktrace: #0 0xffffe410 in ?? ()
StacktraceTop: ?? ()
ThreadStacktrace:

Title: firefox-bin crashed with SIGSEGV
Uname: Linux moe 2.6.22-8-generic #1 SMP Thu Jul 12 15:59:45 GMT 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin mythtv netdev plugdev powerdev scanner video

Extracted from symbolized stacktrace:
(file: http://launchpadlibrarian.net/8611030/gdb-firefox.log)
...
#9 g_free () from /usr/lib/libglib-2.0.so.0
#10 moz_gtk_widget_paint (widget=MOZ_GTK_DROPDOWN,
#11 nsNativeThemeGTK::DrawWidgetBackground (this=0x8488d58,
#12 nsCSSRendering::PaintBackgroundWithSC (
#13 nsCSSRendering::PaintBackground (aPresContext=0x8e80128,
#14 nsFrame::PaintSelf (this=0x8ed35f4, aPresContext=0x8e80128,
#15 nsBoxFrame::Paint (this=0x8ed35f4, aPresContext=0x8e80128,
#16 nsBoxFrame::PaintChild (this=0x8edd104,
...

[Bryan Quigley (bryanquigley)]

Binary package hint: firefox

I was attempting to download the torrent of fluxbuntu.org and Firefox crashed. It crashed with Both Firefox2 and Firefox 3 alpha. It works fine in Epiphany. This is on Gutsy.

Torrent off of this page: http://modzer0.cs.uaf.edu/~hardwarehank/fluxbuntu/rev2/

I'll provide more when I'm willing to crash Firefox again.

ProblemType: Crash
Architecture: i386
Date: Sun Jul 29 00:10:17 2007
Disassembly: 0xffffe410:
DistroRelease: Ubuntu 7.10
ExecutablePath: /usr/lib/firefox/firefox-bin
NonfreeKernelModules: cdrom
Package: firefox 2.0.0.5+2-0ubuntu2
PackageArchitecture: i386
ProcCmdline: /usr/lib/firefox/firefox-bin
ProcCwd: /home/bryan
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: firefox
Stacktrace: #0 0xffffe410 in ?? ()
StacktraceTop: ?? ()
ThreadStacktrace:

Title: firefox-bin crashed with SIGSEGV
Uname: Linux moe 2.6.22-8-generic #1 SMP Thu Jul 12 15:59:45 GMT 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin mythtv netdev plugdev powerdev scanner video

[Apport retracing service (apport)]

StacktraceTop:?? ()

[Bryan Quigley (bryanquigley)]

It appears the Crux theme might be the cause as it only happens with it turned on.

Steps to reproduce.
1. Change to theme Crux.
2. Open Firefox.
3. Go to site. (Above)
4. Try to download torrent.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Thank you gQuigs for your report,

Unfortunately this report lacks information we need to investigate it further. Of course this is not your fault, but the coredump attached to your report doesn't provide useful information for us.

Could you please try to obtain a backtrace by following the instructions on [1] and upload it to [2].

Thanks in advance.

H. Montoliu

[1] https://wiki.ubuntu.com/MozillaTeam/Bugs
[2] https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/129007/+addcomment

[Bryan Quigley (bryanquigley)]

Not sure if I did this right... This was with Firefox 2.

[Timeless-bemail (timeless-bemail)]

UUID 66f1830f-3b7d-11dc-a9e1-001a4bd43ed6
Time 2007-07-26 06:37:49.840000-07:00
Build ID 2007072604
OS Linux
OS Version 0.0.0 Linux 2.6.22-8-generic #1 SMP Thu Jul 12 15:59:45 GMT 2007 i686 GNU/Linux
CPU x86
CPU Info GenuineIntel family 2 model 2 stepping 4
Crash Reason SIGABRT
Crash Address 0xffffe410
Stack of Crashing Thread

frame signature
0 @0xffffe410
1 libc-2.6.so@0x2c1f0
2 libc-2.6.so@0x61e2b
3 libc-2.6.so@0x6d8fa
4 libglib-2.0.so.0.1307.0@0x36960
5 moz_gtk_option_menu_get_metrics
6 moz_gtk_widget_paint
7 ThemeRenderer::NativeDraw(_XDisplay*, unsigned long, Visual*, short, short, XRectangle*, unsigned int)
8 NativeRendering(void*, _XDisplay*, unsigned long, Visual*, short, short, XRectangle*, unsigned int)
9 cairo_draw_with_xlib

[c7d2f5c8667d26fffd5e7772d632c76d (c7d2f5c8667d26fffd5e7772d632c76d-deactivatedaccount)]

565 GtkBorder *tmp_indicator_spacing;
566
567 gtk_widget_style_get(gOptionMenuWidget,
[...]
570 "indicator_spacing", &tmp_indicator_spacing,
[...]
585 g_free(tmp_indicator_spacing);

You have to use gtk_border_free() to free a GtkBorder* obtained with gtk_widget_style_get, not g_free().

[c7d2f5c8667d26fffd5e7772d632c76d (c7d2f5c8667d26fffd5e7772d632c76d-deactivatedaccount)]

And similarly you need to use gtk_requisition_free to free the GtkRequisition* tmp_indicator_size.

[Timeless-bemail (timeless-bemail)]

Created attachment 274406
like this?

[Timeless-bemail (timeless-bemail)]

Created attachment 274408
more like this?

[c7d2f5c8667d26fffd5e7772d632c76d (c7d2f5c8667d26fffd5e7772d632c76d-deactivatedaccount)]

Comment on attachment 274408
more like this?

You need to null-check, since neither they don't accept null, in contrast to g_free.

[Timeless-bemail (timeless-bemail)]

Created attachment 274410
details...

[c7d2f5c8667d26fffd5e7772d632c76d (c7d2f5c8667d26fffd5e7772d632c76d-deactivatedaccount)]

Comment on attachment 274410
details...

You mixed them up, used gtk_border_free in the if() of the GtkRequisition, and likewise for the other one too ;)

[Timeless-bemail (timeless-bemail)]

Created attachment 274430
ok, patching whlie sleepy is bad?

[Timeless-bemail (timeless-bemail)]

Comment on attachment 274430
ok, patching whlie sleepy is bad?

roc: could you please approve this for 1.9?

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Thank you gQuigs, this crash may be related to bug 127383.

What are those unreadable symbols on stacks 6-8 from your gdb.log?

[Bryan Quigley (bryanquigley)]

I have no idea. How would I find out?

[Hilario J. Montoliu (hjmf) (hmontoliu)]

For all the subscribers of this report:

Could you (if possible all of you) confirm what theme were you using when firefox crashed? We already know that some of you were using the crux theme. But we need a confirmation.

Thank you in advance.

H. Montoliu

[Jörgen Lidholm (jorgen-lidholm)]

I was not using crux, I don't remember which theme I was using, but I will track this down later.

[erekose (erekose)]

This happens to me when using the crux theme, the default human theme works fine

[Jörgen Lidholm (jorgen-lidholm)]

I've now tested with several different themes and the following causes firefox when the download dialog opens:
Gray
Neutrino
Redmond
ThinIce

And to clarify, it is enough to change the controls. Buttons and frame has nothing to do with this bug.

regards,
Jörgen

[c7d2f5c8667d26fffd5e7772d632c76d (c7d2f5c8667d26fffd5e7772d632c76d-deactivatedaccount)]

*** Bug 394876 has been marked as a duplicate of this bug. ***

[Roc-ocallahan (roc-ocallahan)]

I'd like to but I technically I can't.

[Roc-ocallahan (roc-ocallahan)]

Comment on attachment 274430
ok, patching whlie sleepy is bad?

okay, now I can.

[Frédéric Crozat (fcrozat)]

attachment 274430 is buggy :
-there is a typo in gtk_requistion_free(tmp_indicator_size); and from checking gtk code, I'm not sure there is a need to use gtk_requisition_free, since it is just a call to g_free. Anyway, it is not needed to check for null when calling gtk_requisition_free
-gtk_requisition_free on gtk+ 2.11.x is calling g_slide_free which does accept NULL as a parameter (it just doesn't do anything).

[c7d2f5c8667d26fffd5e7772d632c76d (c7d2f5c8667d26fffd5e7772d632c76d-deactivatedaccount)]

You're right, I read the gslice macros wrongly and thought they didn't accept NULL on free.

gtk_requisition_free is the right function to call, NOT g_free.

[Frédéric Crozat (fcrozat)]

Created attachment 279879
better patch

[Alexander Sack (asac)]

there is a patch available in upstream bug, which we definitly want before beta.

[Alexander Sack (asac)]

taking.

[turox (tuxturox)]

so i changed the theme, bevore i uesed the crux theme on ubuntu and xubuntu, and now after changing the theme firefox works fine without any crashes.

[Alexander Sack (asac)]

firefox (2.0.0.6+2-0ubuntu4) gutsy; urgency=low

  * patch shaping: rename patches and include there bugzilla id
    where available; document bzXXX-dont-reset-user-prefs-on-upgrade and
    force-no-pragma-visibility-for-gcc-4.2_4.3 patches.
  * debian/patches/bz389801-theme-crash-with-GtkOptionMenu-indicator_size-and-indicator_spacing.patch:
    prefetch latest patch from bugzilla 389801 to fix top-crasher
    (LP: #129007).
  * debian/firefox-gnome-support.install: properly install gnome support files
    previously missing in firefox-gnome-support package (LP: #131743).

 -- Alexander Sack <email address hidden> Wed, 19 Sep 2007 18:16:37 +0200

[Alexander Sack (asac)]

thunderbird (2.0.0.6-0ubuntu3) gutsy; urgency=low

  * debian/patches/bz389801-theme-crash-with-GtkOptionMenu-indicator_size-and-indicator_spacing.patch,
    series: prefetch latest patch from bugzilla 389801 to theme dependent
    top-crash. (LP: #129007)
  * debian/thunderbird.desktop: add finish and swedish translations to
    .desktop file (LP: #126112).

 -- Alexander Sack <email address hidden> Wed, 19 Sep 2007 18:21:22 +0200

[Reed Loden (reed)]

Comment on attachment 279879
better patch

Requesting review on this patch... the patch says it's for gfx/src/gtk/gtk2drawing.c, but that file doesn't exist on trunk, as it seems it was moved to widget/src/gtk2/gtk2drawing.c.

[Reed Loden (reed)]

According to https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/129007, this is a top-crasher for Ubuntu.

[Reed Loden (reed)]

Checking in widget/src/gtk2/gtk2drawing.c;
/cvsroot/mozilla/widget/src/gtk2/gtk2drawing.c,v <-- gtk2drawing.c
new revision: 1.32; previous revision: 1.31
done

[Dveditz (dveditz)]

Comment on attachment 279879
better patch

approved for 1.8.1.8 and 1.8.0.14, a=dveditz for release-drivers

[Reed Loden (reed)]

MOZILLA_1_8_BRANCH:

Checking in gfx/src/gtk/gtk2drawing.c;
/cvsroot/mozilla/gfx/src/gtk/Attic/gtk2drawing.c,v <-- gtk2drawing.c
new revision: 1.15.8.3; previous revision: 1.15.8.2
done

MOZILLA_1_8_0_BRANCH:

Checking in gfx/src/gtk/gtk2drawing.c;
/cvsroot/mozilla/gfx/src/gtk/Attic/gtk2drawing.c,v <-- gtk2drawing.c
new revision: 1.15.8.2.4.1; previous revision: 1.15.8.2
done