Description of problem: firefox crashes quite often, since Yahoo!Mail added a new tab, that contains a flashplugin-chat-client. Then it leaves a process, that i have to kill manually and a core file. Version-Release number of selected component (if applicable): nspluginwrapper.i386 1.3.0-2.fc10 installed How reproducible: after some page loads, it crashes... multiple tabs r not necessary for that... Steps to Reproduce: 1. start firefox 2. open Yahoo!Mail (or maybe any other site with complicated flash applets) 3. repeat 2. until it crashes Actual results: firefox window disappears and a very tiny window pops up (called npviewer) and a process hangs there and needs manual attention: aw 31149 88.9 0.7 123200 16320 ? Rl 14:22 1:35 /usr/lib/nspluginwrapper/npviewer.bin --plugin /usr/lib/mozilla/plugins/libflashplayer.so --connection /org/wrapper/NSPlugins/libflashplayer.so/28996-1 Expected results: the flash applet should be shown again and again until i leave that page... at least no process should remain after a crash somehow... :-) Additional info: possibly this is caused by flashplayer and cannot be prevented by nspluginwrapper?
somehow it got much better, since i changed my Yahoo!Chat to offline mode... -arne
Can you please provide firefox backtrace from the crash?
do u mean this? (gdb) where #0 0x0000003e9ec0efab in raise () from /lib64/libpthread.so.0 #1 0x000000351d830f05 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #2 <signal handler called> #3 0x000000351deb51eb in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #4 0x000000351deb533e in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #5 0x000000351deae02e in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #6 0x000000351d9f63c6 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #7 0x000000351d9f98d2 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #8 0x000000351db0ac1e in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #9 0x000000351db0c888 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #10 0x000000351dc3f411 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #11 0x000000351dc40c4a in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #12 0x000000351dc44fe9 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #13 0x000000351d858fc7 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #14 0x000000351d842d3d in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #15 0x000000351d8366f6 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #16 0x000000351dc4136d in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #17 0x000000351dc419d0 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #18 0x000000351d85d6c7 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #19 0x0000003a98e522e4 in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #20 0x0000003a98e53292 in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #21 0x0000003a98e3f175 in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #22 0x0000003a98e4bdca in js_Invoke () #23 0x0000003a98e397ec in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #24 0x0000003a98e3e1f0 in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #25 0x0000003a98e4bdca in js_Invoke () from /usr/lib64/xulrunner-1.9/libmozjs.so #26 0x0000003a98e397ec in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #27 0x0000003a98e3e1f0 in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #28 0x0000003a98e4bdca in js_Invoke () from /usr/lib64/xulrunner-1.9/libmozjs.so #29 0x0000003a98e397ec in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #30 0x0000003a98e3e1f0 in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #31 0x0000003a98e4bdca in js_Invoke () from /usr/lib64/xulrunner-1.9/libmozjs.so #32 0x0000003a98e4c12e in ?? () from /usr/lib64/xulrunner-1.9/libmozjs.so #33 0x0000003a98e17b8c in JS_CallFunctionValue () from /usr/lib64/xulrunner-1.9/libmozjs.so #34 0x000000351dc1905f in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #35 0x000000351dc5230c in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #36 0x000000351db2dfc0 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #37 0x000000351db2e6a1 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #38 0x000000351db47591 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #39 0x000000351db476aa in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #40 0x000000351db47a3f in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #41 0x000000351db155eb in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #42 0x000000351db15ea4 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #43 0x000000351db16b1c in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #44 0x000000351db16c58 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #45 0x000000351db16cbc in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #46 0x000000351d88d151 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #47 0x000000351d8e3d6f in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #48 0x000000351d875e33 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #49 0x000000351d8760c2 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #50 0x000000351e02cb98 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #51 0x000000351e040e8e in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #52 0x000000351e012b7e in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #53 0x000000351df772bd in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #54 0x000000351de35b01 in ?? () from /usr/lib64/xulrunner-1.9/libxul.so #55 0x000000351d829f30 in XRE_main () from /usr/lib64/xulrunner-1.9/libxul.so #56 0x0000000000401665 in _Unwind_Resume () #57 0x0000003e9e01e576 in __libc_start_main () from /lib64/libc.so.6 #58 0x0000000000401159 in _Unwind_Resume () #59 0x00007fff2cb27f28 in ?? () #60 0x000000000000001c in ?? () #61 0x0000000000000004 in ?? () #62 0x00007fff2cb29746 in ?? () #63 0x0000000000000000 in ?? () -arne
Yes, but please install xulrunner-debuginfo and attach the backtrace again.
how? # yum list xulrunner\* Installed Packages xulrunner.i386 1.9.0.7-1.fc10 installed xulrunner.x86_64 1.9.0.7-1.fc10 installed Available Packages xulrunner-devel.i386 1.9.0.7-1.fc10 updates xulrunner-devel.x86_64 1.9.0.7-1.fc10 updates xulrunner-devel-unstable.x86_64 1.9.0.7-1.fc10 updates xulrunner-python.x86_64 1.9.0.7-1.fc10 updates xulrunner-python-devel.i386 1.9.0.7-1.fc10 updates xulrunner-python-devel.x86_64 1.9.0.7-1.fc10 updates it is not there... -arne
found it here: http://kojipkgs.fedoraproject.org/packages/xulrunner/1.9.0.7/1.fc10/x86_64/xulrunner-debuginfo-1.9.0.7-1.fc10.x86_64.rpm -arne
it worked, i think: #0 0x0000003e9ec0efab in raise () from /lib64/libpthread.so.0 #1 0x000000351d830f05 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:212 #2 <signal handler called> #3 nsPluginNativeWindowGtk2::CreateXEmbedWindow (this=0x7f05698b7f30) at nsPluginNativeWindowGtk2.cpp:209 #4 0x000000351deb533e in nsPluginNativeWindowGtk2::CallSetWindow (this=0x7f05698b7f30, aPluginInstance=@0x7fff7f6bf820) at nsPluginNativeWindowGtk2.cpp:137 #5 0x000000351deae02e in nsPluginHostImpl::InstantiateEmbeddedPlugin (this=0x7f05692c4420, aMimeType=0x7f0568f63af8 "application/x-shockwave-flash", aURL=0x7f05680ae010, aOwner=0x7f05637a2fd0) at nsPluginHostImpl.cpp:3652 #6 0x000000351d9f63c6 in nsObjectFrame::InstantiatePlugin (this=<value optimized out>, aPluginHost=0x7f05692c4428, aMimeType=0x7f0568f63af8 "application/x-shockwave-flash", aURI=0x7f05680ae010) at nsObjectFrame.cpp:850 #7 0x000000351d9f98d2 in nsObjectFrame::Instantiate (this=0x7f05635d86b0, aMimeType=0x7f0568f63af8 "application/x-shockwave-flash", aURI=0x7f05680ae010) at nsObjectFrame.cpp:1686 #8 0x000000351db0ac1e in nsObjectLoadingContent::Instantiate (this=0x7f0563a86950, aFrame=0x7f05635d86f0, aMIMEType=<value optimized out>, aURI=0x7f05680ae010) at nsObjectLoadingContent.cpp:1725 #9 0x000000351db0c888 in nsObjectLoadingContent::EnsureInstantiation (this=0x7f0563a86950, aInstance=0x7fff7f6bfc90) at nsObjectLoadingContent.cpp:750 #10 0x000000351dc3f411 in nsHTMLPluginObjElementSH::GetPluginInstanceIfSafe (wrapper=<value optimized out>, _result=0x7fff7f6bfc90) at nsDOMClassInfo.cpp:8843 #11 0x000000351dc40c4a in nsHTMLPluginObjElementSH::SetupProtoChain (wrapper=0x7f05698025a0, cx=0x7f05624e0b50, obj=0x31ae1c0) at nsDOMClassInfo.cpp:8923 #12 0x000000351dc44fe9 in nsHTMLPluginObjElementSH::PostCreate (this=<value optimized out>, wrapper=0x7f05698025a0, cx=0x7f05624e0b50, obj=0x31ae1c0) at nsDOMClassInfo.cpp:9045 #13 0x000000351d858fc7 in XPCWrappedNative::GetNewOrUsed (ccx=@0x7fff7f6bff20, Object=<value optimized out>, Scope=0x7f0569711e00, Interface=0x23ccc90, isGlobal=0, resultWrapper=0x7fff7f6bfea8) at xpcwrappednative.cpp:546 #14 0x000000351d842d3d in XPCConvert::NativeInterface2JSObject (ccx=@0x7fff7f6bff20, dest=0x7fff7f6c0070, src=0x7f0563a869f8, iid=0x351e09d260, scope=0x7f05682105c0, allowNativeWrapper=0, isGlobal=0, pErr=0x7fff7f6bff1c) at xpcconvert.cpp:1107 #15 0x000000351d8366f6 in nsXPConnect::WrapNative (this=<value optimized out>, aJSContext=<value optimized out>, aScope=0x7f05682105c0, aCOMObj=0x7f0563a869f8, aIID=@0x351e09d260, _retval=0x7fff7f6c0070) at nsXPConnect.cpp:1256 #16 0x000000351dc4136d in nsDOMClassInfo::WrapNative (cx=0x7f05624e0b50, scope=0x7f0568216380, native=0x7f0563a869f8, aIID=@0x351e09d260, vp=0x7fff7f6c03e0, aHolder=0x7fff7f6c00f0) at nsDOMClassInfo.cpp:1563 #17 0x000000351dc419d0 in nsHTMLDocumentSH::GetProperty (this=0x32cdfd0, wrapper=0x7f05693d1cd0, cx=0x7f05624e0b50, obj=0x7f0568216380, id=139661198432308, vp=0x7fff7f6c03e0, _retval=0x7fff7f6c0164) at nsDOMClassInfo.cpp:8476 #18 0x000000351d85d6c7 in XPC_WN_Helper_GetProperty (cx=0x7f05624e0b50, obj=0x7f0568216380, idval=139661198432308, vp=0x7fff7f6c03e0) at xpcwrappednativejsops.cpp:954 #19 0x0000003a98e522e4 in js_NativeGet (cx=0x7f05624e0b50, obj=0x7f0568216380, pobj=0x7f0568216380, sprop=0x7f0567f46380, vp=0x7fff7f6c03e0) at jsobj.c:3575 #20 0x0000003a98e53292 in js_GetPropertyHelper (cx=0x7f05624e0b50, obj=0x7f0568216380, id=139661198432308, vp=0x7fff7f6c03e0, entryp=0x7fff7f6c03b8) at jsobj.c:3725 #21 0x0000003a98e3f175 in js_Interpret (cx=0x7f05624e0b50) at jsinterp.c:4186 #22 0x0000003a98e4bdca in js_Invoke (cx=0x7f05624e0b50, argc=2, vp=0x7f05624e7650, flags=0) at jsinterp.c:1320 #23 0x0000003a98e397ec in fun_call (cx=0x7f05624e0b50, argc=2, vp=0x7f05624e7618) at jsfun.c:1589 #24 0x0000003a98e3e1f0 in js_Interpret (cx=0x7f05624e0b50) at jsinterp.c:4847 #25 0x0000003a98e4bdca in js_Invoke (cx=0x7f05624e0b50, argc=2, vp=0x7f05624e74b8, flags=0) at jsinterp.c:1320 #26 0x0000003a98e397ec in fun_call (cx=0x7f05624e0b50, argc=2, vp=0x7f05624e7480) at jsfun.c:1589 #27 0x0000003a98e3e1f0 in js_Interpret (cx=0x7f05624e0b50) at jsinterp.c:4847 #28 0x0000003a98e4bdca in js_Invoke (cx=0x7f05624e0b50, argc=1, vp=0x7f05624e7328, flags=0) at jsinterp.c:1320 #29 0x0000003a98e397ec in fun_call (cx=0x7f05624e0b50, argc=1, vp=0x7f05624e72e8) at jsfun.c:1589 #30 0x0000003a98e3e1f0 in js_Interpret (cx=0x7f05624e0b50) at jsinterp.c:4847 #31 0x0000003a98e4bdca in js_Invoke (cx=0x7f05624e0b50, argc=1, vp=0x7f05624e7050, flags=0) at jsinterp.c:1320 #32 0x0000003a98e4c12e in js_InternalInvoke (cx=0x7f05624e0b50, obj=0x2bb9ec0, fval=45854720, flags=0, argc=1, argv=<value optimized out>, rval=0x7fff7f6c1298) at jsinterp.c:1376 #33 0x0000003a98e17b8c in JS_CallFunctionValue (cx=0x7fff7f6bf708, obj=0x7fff7f6bf708, fval=0, argc=<value optimized out>, argv=<value optimized out>, rval=<value optimized out>) at jsapi.c:5054 #34 0x000000351dc1905f in nsJSContext::CallEventHandler (this=0x7f0567f133f0, aTarget=0x7f0568f617a0, aScope=0x7f05682105c0, aHandler=0x2bbb000, aargv=0x7f05695c73b0, arv=0x7fff7f6c1490) at nsJSEnvironment.cpp:1962 #35 0x000000351dc5230c in nsJSEventListener::HandleEvent (this=0x7f0567e68090, aEvent=0x7f05623ec160) at nsJSEventListener.cpp:248 #36 0x000000351db2dfc0 in nsEventListenerManager::HandleEventSubType (this=0x31d8b10, aListenerStruct=<value optimized out>, aListener=0x7f0567e68090, aDOMEvent=0x7f05623ec160, aCurrentTarget=0x7f0568f617a0, aPhaseFlags=<value optimized out>) at nsEventListenerManager.cpp:1080 #37 0x000000351db2e6a1 in nsEventListenerManager::HandleEvent (this=0x31d8b10, aPresContext=0x7f05632a7010, aEvent=0x7fff7f6c18d0, aDOMEvent=0x7fff7f6c1860, aCurrentTarget=0x7f0568f617a0, aFlags=6, aEventStatus=0x7fff7f6c1868) at nsEventListenerManager.cpp:1185 #38 0x000000351db47591 in nsEventTargetChainItem::HandleEvent (this=0x7f05626815a8, aVisitor=@0x7fff7f6c1850, aFlags=6) at nsEventDispatcher.cpp:210 #39 0x000000351db476aa in nsEventTargetChainItem::HandleEventTargetChain (this=0x7f0562681650, aVisitor=@0x7fff7f6c1850, aFlags=6, aCallback=0x0) at nsEventDispatcher.cpp:268 #40 0x000000351db47a3f in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, aPresContext=<value optimized out>, aEvent=0x7fff7f6c18d0, aDOMEvent=0x0, aEventStatus=0x7fff7f6c192c, aCallback=0x0) at nsEventDispatcher.cpp:483 #41 0x000000351db155eb in nsScriptElement::ScriptEvaluated (this=<value optimized out>, aResult=<value optimized out>, aElement=<value optimized out>, aIsInline=<value optimized out>) at nsScriptElement.cpp:105 #42 0x000000351db15ea4 in nsScriptLoadRequest::FireScriptEvaluated () at nsScriptLoader.cpp:96 #43 nsScriptLoader::FireScriptEvaluated (this=0x7f0567bdb460, aResult=0, aRequest=0x2811250) at nsScriptLoader.cpp:527 #44 0x000000351db16b1c in nsScriptLoader::ProcessRequest (this=0x7f0567bdb460, aRequest=0x2811250) at nsScriptLoader.cpp:498 #45 0x000000351db16c58 in nsScriptLoader::ProcessPendingRequests (this=0x7f0567bdb460) at nsScriptLoader.cpp:633 #46 0x000000351db16cbc in nsScriptLoader::OnStreamComplete (this=0x7f0567bdb460, aLoader=<value optimized out>, aContext=0x2811250, aStatus=<value optimized out>, aStringLen=<value optimized out>, aString=<value optimized out>) at nsScriptLoader.cpp:808 #47 0x000000351d88d151 in nsStreamLoader::OnStopRequest (this=0x7f0562660810, request=<value optimized out>, ctxt=<value optimized out>, aStatus=0) at nsStreamLoader.cpp:108 #48 0x000000351d8e3d6f in nsHttpChannel::OnStopRequest (this=0x7f05627bb300, request=0x7f0563524550, ctxt=<value optimized out>, status=0) at nsHttpChannel.cpp:4452 #49 0x000000351d875e33 in nsInputStreamPump::OnStateStop (this=0x7f0563524550) at nsInputStreamPump.cpp:576 #50 0x000000351d8760c2 in nsInputStreamPump::OnInputStreamReady (this=0x7f0563524550, stream=0x7fff7f6bf708) at nsInputStreamPump.cpp:401 #51 0x000000351e02cb98 in nsInputStreamReadyEvent::Run (this=0x7f05627a54e0) at nsStreamUtils.cpp:111 #52 0x000000351e040e8e in nsThread::ProcessNextEvent (this=0x22ecd20, mayWait=1, result=0x7fff7f6c1b8c) at nsThread.cpp:510 #53 0x000000351e012b7e in NS_ProcessNextEvent_P (thread=0x7fff7f6bf708, mayWait=1) at nsThreadUtils.cpp:227 #54 0x000000351df772bd in nsBaseAppShell::Run (this=0x24e1f40) at nsBaseAppShell.cpp:170 #55 0x000000351de35b01 in nsAppStartup::Run (this=0x25176f0) at nsAppStartup.cpp:181 #56 0x000000351d829f30 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>) at nsAppRunner.cpp:3193 #57 0x0000000000401665 in main (argc=4, argv=0x7fff7f6c55a8) at nsXULStub.cpp:364 -arne
It seems to be here: GdkWindow *gdkWindow = gdk_window_lookup((XID)window); mWsInfo.display = GDK_WINDOW_XDISPLAY(gdkWindow); and the gdk_window_lookup() returns some invalid value. Can you please reproduce the crash again and attach values of: (gdb) p window (gdb) p gdkWindow Thanks.
I forgot to mention, it's in function nsPluginNativeWindowGtk2::CreateXEmbedWindow() at nsPluginNativeWindowGtk2.cpp, stack frame #3 from your report.
i updated to xulrunner-debuginfo-1.9.0.8-1.fc10.x86_64.rpm then i made a fresh core then i started gdb... here r the results (i hope "select 3" was right): (gdb) where #0 0x0000003e9ec0efab in raise () from /lib64/libpthread.so.0 #1 0x0000003f4fa30f05 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:212 #2 <signal handler called> #3 nsPluginNativeWindowGtk2::CreateXEmbedWindow (this=0x2e283c0) at nsPluginNativeWindowGtk2.cpp:209 (gdb) list nsPluginNativeWindowGtk2.cpp:209 204 window = (nsPluginPort *)gtk_socket_get_id(GTK_SOCKET(mSocketWidget)); 205 206 // Fill out the ws_info structure. 207 // (The windowless case is done in nsObjectFrame.cpp.) 208 GdkWindow *gdkWindow = gdk_window_lookup((XID)window); 209 mWsInfo.display = GDK_WINDOW_XDISPLAY(gdkWindow); 210 mWsInfo.colormap = GDK_COLORMAP_XCOLORMAP(gdk_drawable_get_colormap(gdkWindow)); 211 GdkVisual* gdkVisual = gdk_drawable_get_visual(gdkWindow); 212 mWsInfo.visual = GDK_VISUAL_XVISUAL(gdkVisual); 213 mWsInfo.depth = gdkVisual->depth; (gdb) select 3 (gdb) print window $1 = (struct nsPluginPort *) 0x0 (gdb) print gdkWindow $2 = <value optimized out> -arne
Cool, thanks. It's as expected...
Can you please attach values of other local variables? I mean: parent_win mSocketWidget
(gdb) select 3 (gdb) print window $1 = (struct nsPluginPort *) 0x0 (gdb) where #0 0x0000003e9ec0efab in raise () from /lib64/libpthread.so.0 #1 0x0000003f4fa30f05 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:212 #2 <signal handler called> #3 nsPluginNativeWindowGtk2::CreateXEmbedWindow (this=0x897a0a0) at nsPluginNativeWindowGtk2.cpp:209 ... (gdb) p parent_win $2 = (GdkWindow *) 0x2eb7db0 (gdb) p mSocketWidget $3 = (GtkWidget *) 0x1390440 (gdb) p *parent_win $4 = {parent_instance = {g_type_instance = {g_class = 0x10ef9d0}, ref_count = 3, qdata = 0x0}} (gdb) p *mSocketWidget $5 = {object = {parent_instance = {g_type_instance = {g_class = 0x2d40e50}, ref_count = 1, qdata = 0x751a760}, flags = 2098946}, private_flags = 15360, state = 0 '\0', saved_state = 0 '\0', name = 0x0, style = 0x1376030, requisition = {width = 0, height = 0}, allocation = { x = 0, y = 0, width = 1, height = 1}, window = 0x0, parent = 0x0} -arne
Moved upstream - https://bugzilla.mozilla.org/show_bug.cgi?id=486482