Firefox 4.0.1 Crash Report [@ uGlobalMenuBar::ShouldParentStayVisible ]
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Global menubar extension |
Fix Released
|
High
|
Chris Coulson | ||
1.0 |
Fix Released
|
High
|
Chris Coulson | ||
firefox (Ubuntu) |
Fix Released
|
Medium
|
Chris Coulson | ||
Natty |
Fix Released
|
Medium
|
Chris Coulson | ||
thunderbird (Ubuntu) |
Fix Released
|
Medium
|
Chris Coulson | ||
Natty |
Won't Fix
|
Medium
|
Chris Coulson |
Bug Description
*** TEST CASE FOR SRU ***
This one is pretty difficult to reproduce, and it doesn't help that we have no way of contacting the people who reported the crash reports to Mozilla's crash system. However, I have a test case which I think triggers the same bug
Preparation:
- Install indicator-
Test:
1) Attach gdb to unity-panel-service
2) Start Firefox or Thunderbird
3) In gdb, add a breakpoint on register_windows in indicator-appmenu.c
4) In Firefox, open a new window (or compose an e-mail in Thunderbird)
5) As soon as the new window appears, close it
6) gdb should have stopped on register_windows. Type cont so that Firefox (or Thunderbird) gets the reply
Result:
- With the old version, Firefox (or Thunderbird) will crash occasionally. It won't happen everytime (it might take several attempts to make it crash), and the trace may not look exactly the same as the ones linked from this bug, but I'm pretty sure it's the same issue (having uGlobalMenuBar:
- With the new version, they won't ever crash
***
There's lots of crash reports like this:
This is crashing where we iterate over the menubar's parent nodes to figure out which node we should hide. The issue here is that we hold a ref on the menubar, but each node doesn't hold a ref to its parent (else there would be reference cycles). The code sort-of makes an assumption that the pointer returned from GetParent() isn't dangling, but it looks like it's hitting a case where it is.
I'm not sure what condition would cause this yet. One possibility is that the window is being closed (and the document being destroyed) in between calling RegisterWindow and getting a response back from the panel service (which is when this code path gets triggered). In this condition though, it would be unsafe to access any uGlobalMenuBar functions for the particular menubar, as the menuservice would have already destroyed it
Changed in globalmenu-extension: | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Chris Coulson (chrisccoulson) |
Changed in globalmenu-extension: | |
status: | Triaged → Fix Committed |
Changed in firefox (Ubuntu): | |
assignee: | nobody → Chris Coulson (chrisccoulson) |
Changed in firefox (Ubuntu Natty): | |
assignee: | nobody → Chris Coulson (chrisccoulson) |
Changed in thunderbird (Ubuntu): | |
assignee: | nobody → Chris Coulson (chrisccoulson) |
Changed in thunderbird (Ubuntu Natty): | |
assignee: | nobody → Chris Coulson (chrisccoulson) |
Changed in firefox (Ubuntu): | |
importance: | Undecided → Medium |
Changed in firefox (Ubuntu Natty): | |
importance: | Undecided → Medium |
Changed in thunderbird (Ubuntu): | |
importance: | Undecided → Medium |
Changed in thunderbird (Ubuntu Natty): | |
importance: | Undecided → Medium |
Changed in firefox (Ubuntu): | |
status: | New → Triaged |
Changed in firefox (Ubuntu Natty): | |
status: | New → Triaged |
Changed in thunderbird (Ubuntu): | |
status: | New → Triaged |
Changed in thunderbird (Ubuntu Natty): | |
status: | New → Triaged |
description: | updated |
Changed in firefox (Ubuntu): | |
status: | Triaged → Fix Committed |
Changed in globalmenu-extension: | |
status: | Fix Committed → Fix Released |
Changed in thunderbird (Ubuntu): | |
status: | Triaged → Fix Released |
tags: | added: testcase |
Accepted firefox into natty-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https:/ /wiki.ubuntu. com/Testing/ EnableProposed for documentation how to enable and use -proposed. Thank you in advance!