GNOME Bugzilla – Bug 482531
firefox crashed on print preview [@IA__gdk_window_get_toplevel] [@gdk_window_is_toplevel_frozen]
Last modified: 2009-05-15 15:06:37 UTC
The bug has been opened on https://bugs.launchpad.net/bugs/144326 "Test case: - Open a browser window (my home page is iGoogle -- http://www.google.com.br/ig?hl=pt-BR) - File > Print Preview - The browser crash. ...
+ Trace 167087
Created attachment 96504 [details] [review] patch by Alexander Sack to fix the bug comment from Alexander Sack who submitted the patch "gtk 2.12 introduced gdk_window_is_toplevel_frozen (window) and makes use of it in gdk_window_process_all_updates; this introduces crashes when there are NULL pointers in update_windows list; in addition gdk_window_get_toplevel crashes when there is no TOPLEVEL ancestor. Both cases appear to happen in this firefox "print preview" crash. This patch adds some NULL checks to make gdkwindow more failsafe in these cases."
Kris, can you have a look at this ?
Built test packages for downstream bug: https://bugzilla.novell.com/show_bug.cgi?id=331725 They fix the problem for me, would like some verification of the gtk fix.
Created attachment 96900 [details] [review] updated patch For me just applying this bit of the original patch fixes the crash. It feels like the NULL pointers in the "tmp_list" were being caused by the gdk_window_is_toplevel() issue. Two points of concern: - Fixing gdk_window_get_toplevel() does make sense to me, however it concerns me a bit that this has never been hit before while iterating over a window hierarchy without a toplevel. [- Should gdk_window_is_toplevel_frozen() return TRUE or FALSE? FALSE does work fine. Though you can make the argument that updating a window hierarchy without a toplevel is kind of useless and the hierarchy could be considered frozen... When you switch to TRUE firefox will work but spit a bunch of warnings (I think because you need additional logic to get rid of stale windows in the update-list later on... ] I think we can commit this patch as is, however a second opinion from Owen might never be bad ;)
Confirming, we have this crash too on Mandriva : http://qa.mandriva.com/show_bug.cgi?id=33579 and I can confirm Kris patch fixes the issue.
This crash is also visible on opensolaris nevada_75.
Fedora bug: https://bugzilla.redhat.com/show_bug.cgi?id=336771
Created attachment 98848 [details] [review] another patch Further debugged this with Owen and came up with this patch. Basically mozilla is destroying windows from their paint handler, which is kind of evil. Owen suggests that we file a bug with the gecko developers with a back trace generated by getting a global in process updates in case we come along a window with GDK_WINDOW_DESTROYED and a g_assert() in gdk_window_destroy().
Committed r18975.
*** Bug 581661 has been marked as a duplicate of this bug. ***