Ubuntu
firefox package

  1. Bug #85627
  2. Comment #0

Comment 0 for bug 85627

Revision history for this message
In , L. David Baron (dbaron) wrote :

One of the Linux topcrashes in Firefox 1.5.0.2 is a null pointer dereference in IM_get_input_context, which unconditionally dereferences owningWindow, which is null when we crash.

The top of the stack is pretty constant between incidents although the source of the document viewer destruction varies (direct or in fastback cache):

IM_get_input_context() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4793]
nsWindow::IMELoseFocus() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4387]
nsWindow::IMEDestroyContext() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 4358]
nsWindow::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 404]
nsView::~nsView() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsView.cpp, line 267]
nsIView::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsView.cpp, line 304]
nsFrame::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp, line 669]
nsContainerFrame::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 169]
nsFrameManager::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsFrameManager.cpp, line 298]
PresShell::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 1957]
DocumentViewerImpl::Destroy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 712]