Bug 437132

Created attachment 297790 [details]
backtrace

Created attachment 297793 [details]
bt2

Created attachment 297794 [details]
bt3

The crash in the bt for comment #2 seems likely to be the null callback_data in
a call to moz_container_forall() as mentioned in
http://bugs.activestate.com/show_bug.cgi?id=64037

That suggested patch just adds a trivial check on callback_data before
attempting to walk the moz_container->children calling their widget callbacks...

Yes, I think so. There are many dupes for that bug on web:

http://bugzilla.gnome.org/show_bug.cgi?id=467698

https://bugzilla.mozilla.org/show_bug.cgi?id=371387
https://bugzilla.mozilla.org/show_bug.cgi?id=359870

Created attachment 297832 [details]
possible patch for crash in comment 2

From the http://bugs.activestate.com/show_bug.cgi?id=64037 just so a copy is
here too.  Adding that to firefox-1.5.0.12-11 (and it applies to thunderbird
too!) certainly seems to help reduce a number of crashes here...

I've not yet tested it with the other patches added in firefox-1.5.0.12-13

(personally I don't use firefox but many of our users here seem to...)

I'm currently rebuilding our test version of ffox to include the extra two
patches from your firefox-1.5.0.12-13 srpm as well as the gtk fix above.  If all
goes well I plan to push that out to about ~400 machines here in the next few
days.  I'll let you know how that goes.

The tests with just adding the gtk-fix seem to have reduced the number of
crashes quite a lot and the remaining ones *mostly* seem to be related to sites
using lots of annoying flash animations (like 6 adverts on one page all
competing for your attention...)

Long (long*) ago the flash plugin was so buggy that we didn't enable it by
default, and had to provide a wrapper which allowed people to turn it on for
sites which needed it.  I hope we don't need to go back to that... :-(

 -- Jon

Well as promised I'm including an update.

I'd like to confirm that the extra patch seems to help though we were still
getting a few crashes.  As of friday we are using a version based on the new
security update firefox-1.5.0.12-14 with this (and the empty-doc) patch with no
obvious ill effects.

Most of the remaining crashes *seem* to be inside the flash plugin, though
obviously we havn't been running the new version for long enough to be really sure.

 -- Jon

Though the fix isn't a good fix, as admitted in the activestate bug...
http://bugs.activestate.com/show_bug.cgi?id=64037#c23

It defeats legitimate callbacks, so we need to find a better fix here.

The bug is in GTK and a fix is available (see
http://bugzilla.gnome.org/show_bug.cgi?id=467698).

So it should be fixed in GTK.

That is certainly *a* bug in GTK with a fix available - which should obviously
be fixed in GTK.

Since the discussion in there seems to be related to problems with re-parenting
an object when it is dragged in a notebook it isn't entirely obvious that this
is the bug which is causing ffox (and tbird etc) to crash - or at least not
obviously the *only* bug...

The cited GTK+ change can _not_ fix any firefox crash in RHEL5 - for the simple
reason that there is not notebook tab DND in the GTK+ thats shipped with RHEL5.

Hopefully fixed by the RHEL-5.2 update. Please reopen if not.