epiphany-gecko crashed with SIGSEGV in directory_atoms()

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en; rv:1.9) Gecko/20080528 Epiphany/2.22
Build Identifier: xulrunner1 .9 rc2

Epiphany crashes when closed.

Distribution: Debian lenny/sid
Gnome Release: 2.22.1 2008-04-08 (Debian)
BugBuddy Version: 2.22.0

System: Linux 2.6.25-1-amd64 #1 SMP Fri Apr 25 14:38:55 UTC 2008 x86_64
X Vendor: The X.Org Foundation
X Vendor Release: 10400090
Selinux: No
Accessibility: Disabled
GTK+ Theme: Clearlooks
Icon Theme: gnome

Memory status: size: 393383936 vsize: 393383936 resident: 54853632 share:
27402240 rss: 54853632 rss_rlim: 18446744073709551615
CPU usage: start_time: 1210349746 rtime: 128 utime: 110 stime: 18 cutime:2
cstime: 6 timeout: 0 it_real_value: 0 frequency: 100

Backtrace was generated from '/usr/bin/epiphany-browser'

Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 0x7f9c662d0780 (LWP 10068)]
0x00007f9c5eec0edf in waitpid () from /lib/libpthread.so.0
#0 0x00007f9c5eec0edf in waitpid () from /lib/libpthread.so.0
#1 0x00007f9c5e6165a6 in IA__g_spawn_sync (
    working_directory=<value optimized out>, argv=<value optimized out>,
    envp=<value optimized out>, flags=<value optimized out>,
    child_setup=<value optimized out>, user_data=0xffffffff,
    standard_output=0x0, standard_error=0x0, exit_status=0x0,
    error=0x7fff6e412358) at /tmp/buildd/glib2.0-2.16.3/glib/gspawn.c:374
#2 0x00007f9c5e6168b8 in IA__g_spawn_command_line_sync (
    command_line=<value optimized out>, standard_output=0x0,
    standard_error=0x0, exit_status=0x0, error=0x7fff6e412358)
    at /tmp/buildd/glib2.0-2.16.3/glib/gspawn.c:682
#3 0x00007f9c5aa324b3 in ?? ()
   from /usr/lib/gtk-2.0/modules/libgnomebreakpad.so
#4 0x00007f9c5458cb16 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:216
#5 <signal handler called>
#6 0x00007f9c552ddd40 in GkAtoms_info ()
   from /usr/lib/xulrunner-1.9/libxul.so
#7 0x00007f9c54c8b600 in NS_HasPendingEvents_P (thread=0x154c5f0)
    at nsThreadUtils.cpp:207
#8 0x00007f9c54c0f7d4 in nsBaseAppShell::OnProcessNextEvent (this=0x1a7f4a0,
    thr=0x154c5f0, mayWait=0, recursionDepth=<value optimized out>)
    at nsBaseAppShell.cpp:288
#9 0x00007f9c54cb62d9 in nsThread::ProcessNextEvent (this=0x154c5f0,
    mayWait=0, result=0x7fff6e41294c) at nsThread.cpp:497
#10 0x00007f9c54c8b54d in NS_ProcessPendingEvents_P (thread=0x154c5f0,
    timeout=20) at nsThreadUtils.cpp:180
#11 0x00007f9c54c0f5e4 in nsBaseAppShell::NativeEventCallback (this=0x1a7f4a0)
    at nsBaseAppShell.cpp:121
#12 0x00007f9c54bfc9da in nsAppShell::EventProcessorCallback (
    source=<value optimized out>, condition=<value optimized out>,
    data=0x1a7f4a0) at nsAppShell.cpp:69
#13 0x00007f9c5e5e30f2 in IA__g_main_context_dispatch (context=0xb01ae0)
    at /tmp/buildd/glib2.0-2.16.3/glib/gmain.c:2009
#14 0x00007f9c5e5e6396 in g_main_context_iterate (context=0xb01ae0, block=1,
    dispatch=1, self=<value optimized out>)
    at /tmp/buildd/glib2.0-2.16.3/glib/gmain.c:2642
#15 0x00007f9c5e5e6657 in IA__g_main_loop_run (loop=0xae1c40)
    at /tmp/buildd/glib2.0-2.16.3/glib/gmain.c:2850
#16 0x00007f9c6188eb63 in IA__g...

Adding myself to cc

reporter: afaict the report is missing symbols for libxul, which makes it useless.

#6 0x00007f9c552ddd40 in GkAtoms_info ()
   from /usr/lib/xulrunner-1.9/libxul.so
No symbol table info available.

reinout: please don't comment when you add yourself to the cc list.

Hm. Debugging symbols are definitely present--they have been picked up for the other stack frames.

Please observe the stack traces of some of the duplicates of this bug (tracked at <http://bugzilla.gnome.org/show_bug.cgi?id=509083>). None of them have symbols for the GKAtoms_info frame, some don't have the frame at all, but are otherwise identical; see these for examples:

 * http://bugzilla.gnome.org/show_bug.cgi?id=537750
 * http://bugzilla.gnome.org/show_bug.cgi?id=538377

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpcom/glue/nsThreadUtils.cpp&rev=1.8&mark=191,193,198,199,201,203,204,207#190

the comptr is destroyed and then we try to use the pointer ... :(

Created attachment 329294
use comptr locally

Comment on attachment 329294
use comptr locally

The HASPENDINGEVENTS macro is ugly and IMO unnecessary. Use an inline function if you need to.

Created attachment 330904
use inline

i just wanted to make sure people didn't accidentally change just one part

Why is the if (!thread) test changed into if (thread) ? It looks wrong.

Created attachment 331701
patch applied to debian package

FWIW, I applied this patch to the debian xulrunner package, which should also fix this issue.

Could the patch from comment #9 be reviewed please? Thanks!

Comment on attachment 331701
patch applied to debian package

This patch makes no sense. If "current" is non-null, how could "thread" possibly end up null?

i will land my patch (w/ the typo fixed) if i can ever find a green period for the tree.

Mike: I'm still seeing this on Debian systems, with xulrunner-1.9 version 1.9.0.1-1 installed. So the patch does not seem to work.

timeless, what's the typo? thread instead of !thread? Would like to get this landed.

(In reply to comment #14)
> timeless, what's the typo? thread instead of !thread? Would like to get this
> landed.

timeless e-mailed me with "yeah, that's the typo."

For future note, please comment in the bug rather than e-mailing me. E-mail gets lost and forgotten while bug comments are forever.

Created attachment 345333
without the typo

Fixed patch

timeless: attach the patch you want checked in, mark everything else obsolete, add the checkin-needed keyword. kthxbye.

http://hg.mozilla.org/mozilla-central/rev/26994892da30