| 2011-05-17 13:23:45 |
Chris Coulson |
bug |
|
|
added bug |
| 2011-05-17 13:23:50 |
Chris Coulson |
globalmenu-extension: status |
New |
Triaged |
|
| 2011-05-17 13:23:52 |
Chris Coulson |
globalmenu-extension: importance |
Undecided |
High |
|
| 2011-05-17 13:23:55 |
Chris Coulson |
globalmenu-extension: assignee |
|
Chris Coulson (chrisccoulson) |
|
| 2011-05-17 13:24:09 |
Chris Coulson |
bug task added |
|
firefox (Ubuntu) |
|
| 2011-05-17 15:07:17 |
Launchpad Janitor |
branch linked |
|
lp:globalmenu-extension |
|
| 2011-05-17 15:07:19 |
Chris Coulson |
globalmenu-extension: status |
Triaged |
Fix Committed |
|
| 2011-05-17 15:43:45 |
Launchpad Janitor |
branch linked |
|
lp:globalmenu-extension/1.0 |
|
| 2011-05-17 16:14:09 |
Chris Coulson |
nominated for series |
|
globalmenu-extension/1.0 |
|
| 2011-05-17 16:14:09 |
Chris Coulson |
bug task added |
|
globalmenu-extension/1.0 |
|
| 2011-05-17 16:14:15 |
Chris Coulson |
globalmenu-extension/1.0: milestone |
|
1.0.5 |
|
| 2011-05-17 16:14:18 |
Chris Coulson |
globalmenu-extension/1.0: importance |
Undecided |
High |
|
| 2011-05-17 16:14:20 |
Chris Coulson |
globalmenu-extension/1.0: status |
New |
Fix Committed |
|
| 2011-05-17 16:14:22 |
Chris Coulson |
globalmenu-extension/1.0: assignee |
|
Chris Coulson (chrisccoulson) |
|
| 2011-05-17 16:15:25 |
Chris Coulson |
bug task added |
|
thunderbird (Ubuntu) |
|
| 2011-05-17 16:15:34 |
Chris Coulson |
nominated for series |
|
Ubuntu Natty |
|
| 2011-05-17 16:15:34 |
Chris Coulson |
bug task added |
|
firefox (Ubuntu Natty) |
|
| 2011-05-17 16:15:34 |
Chris Coulson |
bug task added |
|
thunderbird (Ubuntu Natty) |
|
| 2011-05-17 16:15:44 |
Chris Coulson |
firefox (Ubuntu): assignee |
|
Chris Coulson (chrisccoulson) |
|
| 2011-05-17 16:15:46 |
Chris Coulson |
firefox (Ubuntu Natty): assignee |
|
Chris Coulson (chrisccoulson) |
|
| 2011-05-17 16:15:48 |
Chris Coulson |
thunderbird (Ubuntu): assignee |
|
Chris Coulson (chrisccoulson) |
|
| 2011-05-17 16:15:49 |
Chris Coulson |
thunderbird (Ubuntu Natty): assignee |
|
Chris Coulson (chrisccoulson) |
|
| 2011-05-17 16:15:52 |
Chris Coulson |
firefox (Ubuntu): importance |
Undecided |
Medium |
|
| 2011-05-17 16:15:54 |
Chris Coulson |
firefox (Ubuntu Natty): importance |
Undecided |
Medium |
|
| 2011-05-17 16:15:56 |
Chris Coulson |
thunderbird (Ubuntu): importance |
Undecided |
Medium |
|
| 2011-05-17 16:15:58 |
Chris Coulson |
thunderbird (Ubuntu Natty): importance |
Undecided |
Medium |
|
| 2011-05-17 16:16:01 |
Chris Coulson |
firefox (Ubuntu): status |
New |
Triaged |
|
| 2011-05-17 16:16:03 |
Chris Coulson |
firefox (Ubuntu Natty): status |
New |
Triaged |
|
| 2011-05-17 16:16:05 |
Chris Coulson |
thunderbird (Ubuntu): status |
New |
Triaged |
|
| 2011-05-17 16:16:07 |
Chris Coulson |
thunderbird (Ubuntu Natty): status |
New |
Triaged |
|
| 2011-05-17 16:35:40 |
Chris Coulson |
description |
There's lots of crash reports like this:
https://crash-stats.mozilla.com/report/list?product=Firefox&platform=linux&query_search=signature&query_type=contains&query=uGlobalMenu&reason_type=contains&date=05%2F17%2F2011%2003%3A58%3A09&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=uGlobalMenuBar%3A%3AShouldParentStayVisible
This is crashing where we iterate over the menubar's parent nodes to figure out which node we should hide. The issue here is that we hold a ref on the menubar, but each node doesn't hold a ref to its parent (else there would be reference cycles). The code sort-of makes an assumption that the pointer returned from GetParent() isn't dangling, but it looks like it's hitting a case where it is.
I'm not sure what condition would cause this yet. One possibility is that the window is being closed (and the document being destroyed) in between calling RegisterWindow and getting a response back from the panel service (which is when this code path gets triggered). In this condition though, it would be unsafe to access any uGlobalMenuBar functions for the particular menubar, as the menuservice would have already destroyed it |
*** TEST CASE FOR SRU ***
This one is pretty difficult to reproduce, and it doesn't help that we have no way of contacting the people who reported the crash reports to Mozilla's crash system. However, I have a test case which I think triggers the same bug
Preparation:
- Install indicator-appmenu-dbgsym
Test:
1) Attach gdb to unity-panel-service
2) Start Firefox or Thunderbird
3) In gdb, add a breakpoint on register_windows in indicator-appmenu.c
4) In Firefox, open a new window (or compose an e-mail in Thunderbird)
5) As soon as the new window appears, close it
6) gdb should have stopped on register_windows. Type cont so that Firefox (or Thunderbird) gets the reply
Result:
- With the old version, Firefox (or Thunderbird) will crash occasionally. It won't happen everytime (it might take several attempts to make it crash), and the trace may not look exactly the same as the ones linked from this bug, but I'm pretty sure it's the same issue (having uGlobalMenuBar::SetXULMenuVisibility in the trace is key). The issue is that all the members of the uGlobalMenuBar instance are invalid (as it was destroyed when the window was closed), so it could crash anywhere inside uGlobalMenuBar::SetXULMenuVisibility really.
- With the new version, they won't ever crash
***
There's lots of crash reports like this:
https://crash-stats.mozilla.com/report/list?product=Firefox&platform=linux&query_search=signature&query_type=contains&query=uGlobalMenu&reason_type=contains&date=05%2F17%2F2011%2003%3A58%3A09&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=uGlobalMenuBar%3A%3AShouldParentStayVisible
This is crashing where we iterate over the menubar's parent nodes to figure out which node we should hide. The issue here is that we hold a ref on the menubar, but each node doesn't hold a ref to its parent (else there would be reference cycles). The code sort-of makes an assumption that the pointer returned from GetParent() isn't dangling, but it looks like it's hitting a case where it is.
I'm not sure what condition would cause this yet. One possibility is that the window is being closed (and the document being destroyed) in between calling RegisterWindow and getting a response back from the panel service (which is when this code path gets triggered). In this condition though, it would be unsafe to access any uGlobalMenuBar functions for the particular menubar, as the menuservice would have already destroyed it |
|
| 2011-05-17 16:52:27 |
Launchpad Janitor |
branch linked |
|
lp:firefox/4.0 |
|
| 2011-05-17 16:52:43 |
Chris Coulson |
firefox (Ubuntu): status |
Triaged |
Fix Committed |
|
| 2011-05-17 16:56:14 |
Launchpad Janitor |
branch linked |
|
lp:~mozillateam/firefox/firefox-4.0.natty |
|
| 2011-05-18 05:11:37 |
Martin Pitt |
firefox (Ubuntu Natty): status |
Triaged |
Fix Committed |
|
| 2011-05-18 05:11:39 |
Martin Pitt |
bug |
|
|
added subscriber Ubuntu Stable Release Updates Team |
| 2011-05-18 05:11:40 |
Martin Pitt |
bug |
|
|
added subscriber SRU Verification |
| 2011-05-18 05:11:42 |
Martin Pitt |
tags |
|
verification-needed |
|
| 2011-05-18 06:18:11 |
Launchpad Janitor |
branch linked |
|
lp:ubuntu/natty-proposed/firefox |
|
| 2011-05-20 22:45:12 |
Launchpad Janitor |
firefox (Ubuntu): status |
Fix Committed |
Fix Released |
|
| 2011-05-20 23:15:36 |
Launchpad Janitor |
branch linked |
|
lp:ubuntu/firefox |
|
| 2011-05-26 13:24:41 |
Launchpad Janitor |
firefox (Ubuntu Natty): status |
Fix Committed |
Fix Released |
|
| 2011-05-26 14:43:03 |
Adam Porter |
bug |
|
|
added subscriber Adam Porter |
| 2011-06-05 12:46:07 |
Chris Coulson |
globalmenu-extension: status |
Fix Committed |
Fix Released |
|
| 2011-06-05 12:46:09 |
Chris Coulson |
globalmenu-extension/1.0: status |
Fix Committed |
Fix Released |
|
| 2011-06-05 12:46:12 |
Chris Coulson |
thunderbird (Ubuntu): status |
Triaged |
Fix Released |
|
| 2011-09-19 20:56:59 |
Ubuntu Foundations Team Bug Bot |
tags |
verification-needed |
testcase verification-needed |
|
| 2014-12-03 08:55:15 |
Rolf Leggewie |
thunderbird (Ubuntu Natty): status |
Triaged |
Won't Fix |
|
