Bug 1398768

Ditto here, I've seen an unprecedented number of Firefox crashes in the first two hours of Fedora 25. Here's one that I can reproduce nearly every time, both with firefox-50.0-1.fc25.x86_64 and firefox-50.0.2-1.fc25.x86_64.rpm from koji:

- Go to https://bugzilla.redhat.com/show_bug.cgi?id=1163899
- Press end, press home -> crash (sometimes you need to repeat this a few times)
- Also sometimes happens with page up reaching top of the page

Here's a traceback of the above crash:
Thread 1 "firefox" received signal SIGTRAP, Trace/breakpoint trap.
_g_log_abort (breakpoint=breakpoint@entry=1) at gmessages.c:487
487     }
(gdb) bt
#0  0x00007f969eb21a21 in _g_log_abort (breakpoint=breakpoint@entry=1)
    at gmessages.c:487
#1  0x00007f969eb24161 in g_log_writer_default (log_level=6,
    log_level@entry=G_LOG_LEVEL_ERROR, fields=fields@entry=0x7ffe2fcb3800, n_fields=n_fields@entry=6, user_data=user_data@entry=0x0) at gmessages.c:2382
#2  0x00007f969eb225bc in g_log_structured_array (log_level=G_LOG_LEVEL_ERROR, fields=0x7ffe2fcb3800, n_fields=6) at gmessages.c:1770
#3  0x00007f969eb228b9 in g_log_structured (log_domain=log_domain@entry=0x7f96a1513cce "Gdk", log_level=log_level@entry=G_LOG_LEVEL_ERROR) at gmessages.c:1597
#4  0x00007f96a14d5e1e in _gdk_x11_display_error_event (display=display@entry=0x7f96868061c0 [GdkX11Display], error=error@entry=0x7ffe2fcb3f80)
    at gdkdisplay-x11.c:2579
#5  0x00007f96a14e2ff3 in gdk_x_error (xdisplay=
    0x7f96a25f6000, error=0x7ffe2fcb3f80) at gdkmain-x11.c:307
#6  0x00007f96a0d6aded in _XError (dpy=dpy@entry=0x7f96a25f6000, rep=rep@entry=0x7f965496e970) at XlibInt.c:1434
#7  0x00007f96a0d67d17 in handle_error (dpy=0x7f96a25f6000, err=0x7f965496e970, in_XReply=<optimized out>) at xcb_io.c:199
#8  0x00007f96a0d67dd5 in handle_response (dpy=dpy@entry=0x7f96a25f6000, response=0x7f965496e970, in_XReply=in_XReply@entry=0) at xcb_io.c:311
#9  0x00007f96a0d686d5 in _XEventsQueued (dpy=dpy@entry=0x7f96a25f6000, mode=mode@entry=2) at xcb_io.c:350
#10 0x00007f96a0d5a3a7 in XPending (dpy=0x7f96a25f6000) at Pending.c:55
#11 0x00007f96a14dd56e in gdk_check_xpending (display=0x7f96868061c0 [GdkX11Display]) at gdkeventsource.c:269
#12 0x00007f96a14dd56e in gdk_event_source_prepare (source=<optimized out>, timeout=timeout@entry=0x7ffe2fcb4144) at gdkeventsource.c:287
#13 0x00007f969eb1b699 in g_main_context_prepare (context=context@entry=0x7f9686821740, priority=priority@entry=0x7ffe2fcb41d0) at gmain.c:3501
#14 0x00007f969eb1c07b in g_main_context_iterate (context=context@entry=0x7f9686821740, block=block@entry=0, dispatch=dispatch@entry=1, self=<optimized out>)
    at gmain.c:3909
#15 0x00007f969eb1c26c in g_main_context_iteration (context=0x7f9686821740,
    context@entry=0x0, may_block=0) at gmain.c:3990
---Type <return> to continue, or q <return> to quit---
#16 0x00007f9694b3585f in nsAppShell::ProcessNextNativeEvent(bool) (this=<optimized out>, mayWait=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/widget/gtk/nsAppShell.cpp:270
#17 0x00007f9694b1d4b3 in nsBaseAppShell::DoProcessNextNativeEvent(bool) (this=this@entry=0x7f967e307140, mayWait=mayWait@entry=false)
    at /usr/src/debug/firefox-50.0/firefox-50.0/widget/nsBaseAppShell.cpp:138
#18 0x00007f9694b1d612 in nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) (this=0x7f967e307140, thr=0x7f96a2569050, mayWait=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/widget/nsBaseAppShell.cpp:271
#19 0x00007f9693799b9f in nsThread::ProcessNextEvent(bool, bool*) (this=0x7f96a2569050, aMayWait=<optimized out>, aResult=0x7ffe2fcb4367)
    at /usr/src/debug/firefox-50.0/firefox-50.0/xpcom/threads/nsThread.cpp:1047
#20 0x00007f96937b4c37 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=<optimized out>, aMayWait=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/xpcom/glue/nsThreadUtils.cpp:290
#21 0x00007f96939c371e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (this=0x7f9686861e40, aDelegate=0x7f96a25ac840)
    at /usr/src/debug/firefox-50.0/firefox-50.0/ipc/glue/MessagePump.cpp:100
#22 0x00007f96939ae7a2 in MessageLoop::RunHandler() (this=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/ipc/chromium/src/base/message_loop.cc:225
#23 0x00007f96939ae7a2 in MessageLoop::Run() (this=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/ipc/chromium/src/base/message_loop.cc:205
#24 0x00007f9694b1b39c in nsBaseAppShell::Run() (this=0x7f967e307140)
    at /usr/src/debug/firefox-50.0/firefox-50.0/widget/nsBaseAppShell.cpp:156
#25 0x00007f969516ed12 in nsAppStartup::Run() (this=0x7f967e312060)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/components/startup/nsAppStartup.cpp:284
#26 0x00007f96951b3b78 in XREMain::XRE_mainRun() (this=this@entry=
    0x7ffe2fcb45f8)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/xre/nsAppRunner.cpp:4297
---Type <return> to continue, or q <return> to quit---
#27 0x00007f96951b3e3f in XREMain::XRE_main(int, char**, nsXREAppData const*) (this=this@entry=0x7ffe2fcb45f8, argc=argc@entry=2, argv=argv@entry=0x7ffe2fcb59d8, aAppData=aAppData@entry=0x7ffe2fcb47f8)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/xre/nsAppRunner.cpp:4424
#28 0x00007f96951b4080 in XRE_main(int, char**, nsXREAppData const*, uint32_t) (argc=2, argv=0x7ffe2fcb59d8, aAppData=0x7ffe2fcb47f8, aFlags=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/xre/nsAppRunner.cpp:4515
#29 0x000055cce145025e in do_main(int, char**, char**, nsIFile*) (argc=2, argv=0x7ffe2fcb59d8, envp=<optimized out>, xreDirectory=0x7f96a259ea80)
    at /usr/src/debug/firefox-50.0/firefox-50.0/browser/app/nsBrowserApp.cpp:247
#30 0x000055cce144f817 in main(int, char**, char**) (argc=2, argv=0x7ffe2fcb59d8, envp=0x7ffe2fcb59f0)
    at /usr/src/debug/firefox-50.0/firefox-50.0/browser/app/nsBrowserApp.cpp:380
(gdb)

Also got a one-time crash when clicking on save file on the attachment in https://bugzilla.redhat.com/show_bug.cgi?id=1399646#c1 but no traceback of that unfortunately.

Disabling smooth scrolling seems to prevent the above home-end-crash reproducer from happening. I'm still seeing other crashes though, such as this when just clicking on https://bugzilla.redhat.com/show_bug.cgi?id=1163899:


#0  0x00007f030f321a21 in _g_log_abort (breakpoint=breakpoint@entry=1)
    at gmessages.c:487
#1  0x00007f030f324161 in g_log_writer_default (log_level=6,
    log_level@entry=G_LOG_LEVEL_ERROR, fields=fields@entry=0x7ffc01354750, n_fields=n_fields@entry=6, user_data=user_data@entry=0x0) at gmessages.c:2382
#2  0x00007f030f3225bc in g_log_structured_array (log_level=G_LOG_LEVEL_ERROR, fields=0x7ffc01354750, n_fields=6) at gmessages.c:1770
#3  0x00007f030f3228b9 in g_log_structured (log_domain=log_domain@entry=0x7f0311d13cce "Gdk", log_level=log_level@entry=G_LOG_LEVEL_ERROR) at gmessages.c:1597
#4  0x00007f0311cd5e1e in _gdk_x11_display_error_event (display=display@entry=0x7f02f70061c0 [GdkX11Display], error=error@entry=0x7ffc01354ed0)
    at gdkdisplay-x11.c:2579
#5  0x00007f0311ce2ff3 in gdk_x_error (xdisplay=
    0x7f0312df6000, error=0x7ffc01354ed0) at gdkmain-x11.c:307
#6  0x00007f031156aded in _XError (dpy=dpy@entry=0x7f0312df6000, rep=rep@entry=0x7f02d08c5d00) at XlibInt.c:1434
#7  0x00007f0311567d17 in handle_error (dpy=0x7f0312df6000, err=0x7f02d08c5d00, in_XReply=<optimized out>) at xcb_io.c:199
#8  0x00007f0311567dd5 in handle_response (dpy=dpy@entry=0x7f0312df6000, response=0x7f02d08c5d00, in_XReply=in_XReply@entry=0) at xcb_io.c:311
#9  0x00007f03115686d5 in _XEventsQueued (dpy=dpy@entry=0x7f0312df6000, mode=mode@entry=2) at xcb_io.c:350
10 0x00007f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (this=0x7f02f7061d80, aDelegate=0x7f0312dac840)
    at /usr/src/debug/firefox-50.0/firefox-50.0/ipc/glue/MessagePump.cpp:100
#24 0x00007f03041ae7a2 in MessageLoop::RunHandler() (this=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/ipc/chromium/src/base/message_loop.cc:225
#25 0x00007f03041ae7a2 in MessageLoop::Run() (this=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/ipc/chromium/src/base/message_loop.cc:205
#26 0x00007f030531b39c in nsBaseAppShell::Run() (this=0x7f02eeb07140)
    at /usr/src/debug/firefox-50.0/firefox-50.0/widget/nsBaseAppShell.cpp:156
#27 0x00007f030596ed12 in nsAppStartup::Run() (this=0x7f02eeb12060)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/components/startup/nsApp---Type <return> to continue, or q <return> to quit---
Startup.cpp:284
#28 0x00007f03059b3b78 in XREMain::XRE_mainRun() (this=this@entry=
    0x7ffc01355678)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/xre/nsAppRunner.cpp:4297
#29 0x00007f03059b3e3f in XREMain::XRE_main(int, char**, nsXREAppData const*) (this=this@entry=0x7ffc01355678, argc=argc@entry=1, argv=argv@entry=0x7ffc01356a58, aAppData=aAppData@entry=0x7ffc01355878)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/xre/nsAppRunner.cpp:4424
#30 0x00007f03059b4080 in XRE_main(int, char**, nsXREAppData const*, uint32_t) (argc=1, argv=0x7ffc01356a58, aAppData=0x7ffc01355878, aFlags=<optimized out>)
    at /usr/src/debug/firefox-50.0/firefox-50.0/toolkit/xre/nsAppRunner.cpp:4515
#31 0x000055e51677c25e in do_main(int, char**, char**, nsIFile*) (argc=1, argv=0x7ffc01356a58, envp=<optimized out>, xreDirectory=0x7f0312d9ea80)
    at /usr/src/debug/firefox-50.0/firefox-50.0/browser/app/nsBrowserApp.cpp:247
#32 0x000055e51677b817 in main(int, char**, char**) (argc=1, argv=0x7ffc01356a58, envp=0x7ffc01356a68)
    at /usr/src/debug/firefox-50.0/firefox-50.0/browser/app/nsBrowserApp.cpp:380

This message is a reminder that Fedora 25 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 25. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '25'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 25 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Fedora 25 changed to end-of-life (EOL) status on 2017-12-12. Fedora 25 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.