MASTER firefox crash [@ IM_get_input_context]

Bug #85627 reported by yannis
760
Affects Status Importance Assigned to Milestone
Mozilla Firefox
Fix Released
Critical
firefox (Ubuntu)
Fix Released
High
Mozilla Bugs

Bug Description

Proposed Workaround:
System -> Preferences -> SCIM Input Method Setup

FrontEnd -> Global Setup Uncheck => 'Share the same ipnut method
among all applications'

Proposed testcase:

Using Firefox 2.0.0.3, stock package from Ubuntu Edgy, with only the following add-on:

  RikaiChan 1.00 (from http://www.polarcloud.com/rikaichan/) and the Japanese-English dictionary for it.

Also using SCIM with Anthy for Japanese language input using a US keyboard.

1. Start up Firefox
2. Switch input method to Anthy
3. Go to the Tools menu, and select "Add-ons"

Firefox will crash every time. It will not crash if the input method is "English/Keyboard", only if it is set to "Anthy". Note that it is not necessary to type anything for it to crash, if the menu option is selected (even by mouse) simply while Anthy is active, it will crash immediately.

An alternate method is also to do the following:

1. Start up Firefox
2. Press Alt-Delete to bring up the RikaiChan LookupBar
3. Switch input method to Anthy
4. Click on the "settings" (gear) icon in the RikaiChan bar

Revision history for this message
In , L. David Baron (dbaron) wrote :

Created an attachment (id=219392)
analysis of TB17828923

Revision history for this message
In , Masayuki (masayuki) wrote :

taking. but what is cause of this regression?

Revision history for this message
In , Masayuki (masayuki) wrote :

Created an attachment (id=219424)
Patch rv1.0

This patch is not needed on Trunk. Because trunk already has this code.

Revision history for this message
In , Masayuki (masayuki) wrote :

I cannot reproduce this bug, but maybe the patch fixes this bug.

Revision history for this message
In , Masayuki (masayuki) wrote :

Created an attachment (id=219454)
Patch rv1.1

Oops. Sorry. I'm wrong.

Revision history for this message
In , Masaki-katakai-test (masaki-katakai-test) wrote :

(From update of attachment 219454)
+katakai

I'm also not seeing this problem on my environment, but the patch seems OK.

Revision history for this message
In , Masayuki (masayuki) wrote :

Created an attachment (id=219531)
Patch rv1.0 for Trunk

Uh, I found similar risk. We should fix this too.

Revision history for this message
In , Masaki-katakai-test (masaki-katakai-test) wrote :

(From update of attachment 219531)
+katakai

Revision history for this message
In , Roc-ocallahan (roc-ocallahan) wrote :

(From update of attachment 219454)
The code is fine, but can you explain why aArea can be null or owningWindow can be null?

Revision history for this message
In , Roc-ocallahan (roc-ocallahan) wrote :

(From update of attachment 219454)
Actually, let's wait until we can verify that this fixes the real issue. Do we know anyone who can reproduce the crash here?

Revision history for this message
In , Masayuki (masayuki) wrote :

(In reply to comment #10)
> (From update of attachment 219454 [edit])
> Actually, let's wait until we can verify that this fixes the real issue. Do we
> know anyone who can reproduce the crash here?
>

No, I don't know. I don't see this report on bugzilla-jp, Japanese forums and Japanese blogs.

Revision history for this message
In , Masayuki (masayuki) wrote :

Oshima-san:

Can you reproduce this bug?

Revision history for this message
In , L. David Baron (dbaron) wrote :

Could it be a teardown ordering issue? Are the stacks something that commonly happens during window teardown?

Revision history for this message
In , Roc-ocallahan (roc-ocallahan) wrote :

dbaron: looks like it to me.

I'm a bit afraid that checking in this patch will just make us crash somewhere else, or worse, corrupt memory instead of crashing.

Revision history for this message
In , Dveditz (dveditz) wrote :

This sounds like the sort of fix that truly needs the trunk-baking time to make sure there are't any bad regressions or side-effects. Too late for 1.8.0.4

Revision history for this message
In , Masayuki (masayuki) wrote :

(In reply to comment #15)
> This sounds like the sort of fix that truly needs the trunk-baking time to make
> sure there are't any bad regressions or side-effects. Too late for 1.8.0.4

We cannot test on Trunk, because the trunk doesn't have this code. We can test only on MOZILLA_1_8_BRANCH.

Revision history for this message
In , Masayuki (masayuki) wrote :

Boris has reported same report in bug 337036.

Boris:
Can you help us? See comment 10, comment 13 and comment 14.

Revision history for this message
In , Bzbarsky (bzbarsky) wrote :

So I see bug 337036 almost half the time when closing windows. Simple testcase:

  javascript:alert('aaa')

Then click "ok".

Half the time I crash (inside GTK); that's bug 337036 (which has a slightly different stack from this one). The other half, I get:

(Gecko:12931): GLib-GObject-WARNING **: invalid cast from `(null)' to `GtkWidget'
(Gecko:12931): GLib-GObject-WARNING **: invalid cast from `(null)' to `GObject'
(Gecko:12931): GLib-GObject-CRITICAL **: file gobject.c: line 1642 (g_object_get_data): assertion `G_IS_OBJECT (object)' failed

When I crash, mIMEData is false. So I wouldn't even hit the codepath the patch in this bug is changing. Furthermore, in IM_get_owning_window I have a non-null aArea and a non-null aArea->inner_window. But the call to get_gtk_widget_for_gdk_window crashes.

So as far as I can tell, either bug 337036 is a different bug or this patch is wallpaper that doesn't fix the underlying issue.

Revision history for this message
In , Masayuki (masayuki) wrote :

(In reply to comment #18)
> Half the time I crash (inside GTK); that's bug 337036 (which has a slightly
> different stack from this one).

Ah, right, sorry.

Revision history for this message
In , Dveditz (dveditz) wrote :

Can we get this bug landed on the 1.8 branch ("fixed1.8.1" state) and get some verification there that this doesn't cause the worse problems roc was worried about?

Revision history for this message
In , Roc-ocallahan (roc-ocallahan) wrote :

Has anyone yet confirmed that this patch actually fixes anything? Comment #18 suggests it does not. I don't think we should check in a patch that we're not sure actually fixes anything.

Revision history for this message
In , Dveditz (dveditz) wrote :

Too late to get an unbaked patch into 1.8.0.5 for a non-security issue.

Revision history for this message
In , L. David Baron (dbaron) wrote :

Minusing for blocking1.8.1 because it doesn't look like we're going to be able to get a fix for this one, although it would be great if we could still get a patch.

Revision history for this message
In , Adam Guthrie (ispiked) wrote :

*** Bug 352537 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Mats Palmgren (matspal) wrote :

Just a long shot: does the patch in bug 351225 fix it?
(speculating that we destroy a view/window that has already been destroyed)

Revision history for this message
yannis (yanniseatworld) wrote : [apport] firefox-bin crashed with SIGSEGV in __kernel_vsyscall()"

Binary package hint: firefox

crach when i see a video

ProblemType: Crash
Date: Fri Feb 16 20:19:36 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/lib/firefox/firefox-bin
Package: firefox 2.0.0.1+1-0ubuntu1
ProcCmdline: /usr/lib/firefox/firefox-bin -a firefox
ProcCwd: /home/yannis
ProcEnviron:
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games
 LANG=fr_FR.UTF-8
 LANGUAGE=fr_FR:fr:en_GB:en
Signal: 11
SourcePackage: firefox
StacktraceTop:
 __kernel_vsyscall ()
 raise () from /lib/tls/i686/cmov/libpthread.so.0
 ?? ()
 ?? ()
 ?? ()
Uname: Linux snoopy 2.6.20-8-386 #2 Tue Feb 13 05:15:43 UTC 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev scanner video

Revision history for this message
yannis (yanniseatworld) wrote :
Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote :

Thank you for submitting this bug report.

I'm taking it for retrace

Changed in firefox:
assignee: nobody → mozillateam
status: Unconfirmed → Needs Info
Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote :

Retrace done

Revision history for this message
Alexander Sack (asac) wrote :

this crash [@ IM_get_input_context] aka

https://bugzilla.mozilla.org/show_bug.cgi?id=335028

Changed in firefox:
status: Needs Info → In Progress
description: updated
Changed in firefox:
status: Unknown → In Progress
Revision history for this message
In , Alexander Sack (asac) wrote :

(In reply to comment #25)
> Just a long shot: does the patch in bug 351225 fix it?
> (speculating that we destroy a view/window that has already been destroyed)
>

I don't think so; we have received a report whose stacktrace looks quite similar from a user of 2.0.0.1. bug 351225 is verified1.8.1.1 so this is unlikely to be the same problem.

You can take a look here:
https://launchpad.net/ubuntu/+source/firefox/+bug/85627

David Farning (dfarning)
Changed in firefox:
assignee: mozillateam → mozilla-bugs
Revision history for this message
In , Adam Guthrie (ispiked) wrote :

For all intents and purposes, this crash is the #1 Linux topcrash in 2.0.0.1 (only crashes in libc.so.6 and Flash outnumber it). Renominating in hopes that someone has time to take a second look.

Alexander Sack (asac)
description: updated
Revision history for this message
In , Mike Connor (mconnor) wrote :

Not going to block 1.8.1.3 for this, this is a very short cycle with no time for baking. Moving nom over to 1.8.1.4, we probably want to take this early.

Revision history for this message
Alexander Sack (asac) wrote : Re: MASTER firefox crash [@ IM_get_input_context] when watching video

take it as upstream has a patch and its a top-crasher that should be fixed for feisty

Changed in firefox:
importance: Undecided → High
assignee: mozilla-bugs → asac
Revision history for this message
In , Dveditz (dveditz) wrote :

We should get this fixed -- the small percentage of our users who use an IM (5%? 10% at most?) have managed to generate the #2 linux top crash.

roc: is there a way to track down your concerns in comment 14?

Revision history for this message
Alexander Sack (asac) wrote : Re: MASTER firefox crash [@ IM_get_input_context] when watching video

We have no suitable to fix this top crash atm. If anyone can reproduce it, please let us know.

Thanks for your help.

Revision history for this message
Alexander Sack (asac) wrote :

Unfortunately, we will not get a fix for this as upstream patch is still debated and said to potentially make things worse (e.g. memory corruption).

If anyone can reproduce this reliably, don't hestitate to provide us with a testcase.

For now moving milestone to Ubuntu:later.

Revision history for this message
Dave M G (martin-autotelic) wrote :

I was asked to report what extenstions/plugins I have enabled.

They are:
Colorful Tabs 2.0.1
FoxClocks 2.0.20
Google Toolbar for FireFox 2.1.2
GooglePreview 2.1.4
Japanese-English Dictionary for rikaichan 1.03
Mozilla Xforms 0.7.0.1
Names Dictionary for rikaichan 1.03
Rikaichan 0.5.13
Session Manager 0.5.3.2
StumbleUpon 3.04
TrackMeNot 0.4.61
UnPlug 1.6.03
Web Developer 1.1.3
Zend Studio Toolbar 2.0.0

Revision history for this message
Alexander Sack (asac) wrote : Re: [Bug 85627] Re: MASTER firefox crash [@ IM_get_input_context]

On Mon, Apr 09, 2007 at 02:45:12AM -0000, Dave M G wrote:
> I was asked to report what extenstions/plugins I have enabled.
>

As you use Japanese-English dictionary, can you tell me if you use
some input method when these crashes occur (e.g. input method - typing
japanese characters on latin keyboard).?

 - Alexander

Revision history for this message
Dave M G (martin-autotelic) wrote :

Alexander ,

Thanks for your efforts in working to improve Ubuntu.

> As you use Japanese-English dictionary, can you tell me if you use
> some input method when these crashes occur (e.g. input method - typing
> japanese characters on latin keyboard).

I use UIM/Anthy for Japanese input.

However, I can't confirm that Japanese input was enabled when the crash
happened. Just that there was a 50/50 chance that it was.

The crashes do not happen routinely enough or often enough to discern a
pattern.

However, if I discern a pattern, I will report it.

--
Dave M G
Ubuntu 7.04 Feisty Fawn
Kernel 2.6.20-14-generic
Pentium D Dual Core Processor

description: updated
Revision history for this message
In , Masayuki (masayuki) wrote :

roc:

see comment 29.

Revision history for this message
In , Roc-ocallahan (roc-ocallahan) wrote :

(From update of attachment 219454)
OK. I'm unconvinced this will fix anything but it obviously won't make things worse, so let's land this on the 1.8.1 branch and see if that affects anything.

What we really need here, though, is someone who can reproduce this crash reliably. If it's such a huge crasher we should be able to find such a person...

Revision history for this message
In , Masayuki (masayuki) wrote :

(From update of attachment 219454)
Thank you roc. Let's land it.

Revision history for this message
In , Dveditz (dveditz) wrote :

(From update of attachment 219454)
approved for 1.8.1.4, a=dveditz for release-drivers

Revision history for this message
In , Masayuki (masayuki) wrote :

checked-in to 1.8 branch.

Changed in firefox:
status: In Progress → Fix Released
Revision history for this message
Alexander Sack (asac) wrote : Re: [Bug 85627] Re: MASTER firefox crash [@ IM_get_input_context]

On Fri, Apr 20, 2007 at 07:24:36AM -0000, Bug Watch Updater wrote:
> ** Changed in: firefox (upstream)
> Status: In Progress => Fix Released
>

The upstream patc is supposed to land in 2.0.0.4. So lets see if
things get better :)

 - Alexander

Revision history for this message
Yannick (splitsch) wrote :

Hi, I recieved an email asking what plugin/extension I have enabled. Here they are:

adblock plus 0.7.5
chatzilla 0.9.78.1
fireftp 0.95.2.1
flashgot 0.5.98.070328
Gmail Notifier 0.5.6.5
webdevelopper 1.1.3

The version of those extension could be different from the one I had whe the bug occured.

Thanks !

Revision history for this message
bcron (brian-cronmiller) wrote :

I have this same issue when I play more than one video or try to navigate away from a video that is playing.

I have the following plugins

adblock plus
stumbleupon
password exporter
chatzilla

This happens every time so if you can tell me how to save the crash info I would be happy to help. I also run Beryl and the firefox screen greys out and I have to force a close (it doesn't crash and go away).

Revision history for this message
foogod (alex-foogod) wrote :

In case it's useful, I have what I suspect is a related crashing problem, with a very reproducible testcase:

Using Firefox 2.0.0.3, stock package from Ubuntu Edgy, with only the following add-on:

  RikaiChan 1.00 (from http://www.polarcloud.com/rikaichan/) and the Japanese-English dictionary for it.

Also using SCIM with Anthy for Japanese language input using a US keyboard.

1. Start up Firefox
2. Switch input method to Anthy
3. Go to the Tools menu, and select "Add-ons"

Firefox will crash every time. It will not crash if the input method is "English/Keyboard", only if it is set to "Anthy". Note that it is not necessary to type anything for it to crash, if the menu option is selected (even by mouse) simply while Anthy is active, it will crash immediately.

An alternate method is also to do the following:

1. Start up Firefox
2. Press Alt-Delete to bring up the RikaiChan LookupBar
3. Switch input method to Anthy
4. Click on the "settings" (gear) icon in the RikaiChan bar

(Firefox will crash)

Revision history for this message
Alexander Sack (asac) wrote :

foogod,

Thanks for the testcase. We now have to test if we can reproduce this issue with your steps. Until a *mozillateammember* can confirm this testcase, I set it to mt-needtester/Needs Info

description: updated
Changed in firefox:
assignee: asac → mozilla-bugs
status: In Progress → Needs Info
Revision history for this message
In , Twalker (twalker) wrote :

Verified with Simple testcase:

  javascript:alert('aaa')

Then click "ok"

on Linux FC5 with 2.0.0.4 rc2

Revision history for this message
In , Alexander Sack (asac) wrote :

i never saw this crash with the simple testcase mentioned. Hope this fix does not just split this issue in crashes at multiple places.

Revision history for this message
Alexander Sack (asac) wrote :

yeah mt-needtester should not conflict with confirm state ... moving to confirmed again ... where MASTER bugs belong.

Changed in firefox:
status: Needs Info → Confirmed
Revision history for this message
Alexander Sack (asac) wrote :

oh, sorry for the noise. 2.0.0.4 was released, so this bug is officially fixed.

Thanks for your contributions and sorry for the amount of bugmail this bug has likely brought to you.

Keep reporting crashes!

 - Alexander

Changed in firefox:
status: Confirmed → Fix Released
description: updated
Revision history for this message
michihara (michihara) wrote :

System -> Preferences -> SCIM Input Method Setup

FrontEnd -> Global Setup Uncheck => 'Share the same ipnut method among all applications'

If you can do this, no more crash

Revision history for this message
Jules (j-morcinek) wrote : Re: [Bug 85627] Re: MASTER firefox crash [@ IM_get_input_context]

Many thanks for this - I wasn't sure what the SCIM control was about.....

Jules

michihara wrote:
> System -> Preferences -> SCIM Input Method Setup
>
> FrontEnd -> Global Setup Uncheck => 'Share the same ipnut method
> among all applications'
>
> If you can do this, no more crash
>
>

Alexander Sack (asac)
description: updated
Changed in firefox:
importance: Unknown → Critical
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.