[GUTSY] firefox crashed [@XQueryExtension] [@XInitExtension] [@XextAddDisplay]

[Brian Murray]

Binary package hint: firefox

... firefox-bin crashed with SIGSEGV in XQueryExtension()

I am using firefox version 2.0.0.6+2-0ubuntu4 from Gutsy Gibbon. I'm not sure when this particular crash happened.

ProblemType: Crash
Architecture: amd64
Date: Thu Sep 27 21:16:04 2007
DistroRelease: Ubuntu 7.10
ExecutablePath: /usr/lib/firefox/firefox-bin
NonfreeKernelModules: fglrx
Package: firefox 2.0.0.6+2-0ubuntu4
PackageArchitecture: amd64
ProcCmdline: /usr/lib/firefox/firefox-bin
ProcCwd: /home/theman
ProcEnviron:
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games
 LANG=en_US.UTF-8
Signal: 11
SourcePackage: firefox
StacktraceTop:
 XQueryExtension () from /usr/lib/libX11.so.6
 XInitExtension () from /usr/lib/libX11.so.6
 XextAddDisplay () from /usr/lib/libXext.so.6
 XShmDetach () from /usr/lib/libXext.so.6
 NPP_Destroy ()
Title: firefox-bin crashed with SIGSEGV in XQueryExtension()
Uname: Linux flash 2.6.22-12-generic #1 SMP Sun Sep 23 20:03:18 GMT 2007 x86_64 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip family floppy lpadmin plugdev pulse pulse-access scanner video

[Apport retracing service (apport)]

StacktraceTop:XInitExtension (dpy=0x0,
XextAddDisplay (extinfo=0x2b2c41b62c40, dpy=0x0,
XShmDetach (dpy=0x0, shminfo=0x2b2c4195ff11)
NPP_Destroy (instance=0x3f21388,
Private_Destroy (instance=0x0, save=0x2b2c4195ff11)

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Thank you Brian Murray for your report.

Please, in case you find a way to reproduce the crash please report it.

It may be related to Bug #75061 MASTER - firefox crashed [@ XQueryExtension] [@ XInitExtension], though the retraced stack traces differ quite.

Thank you.

H. Montoliu

[Brian Murray (brian-murray)]

I fixed some problems I was having with Firefox today by installing flashplugin-nonfree and using nspluginwrapper. Previously Firefox would crash regularly when visiting ww.imdb.com . When troubleshooting it earlier I noticed that there was not an apport crash report being created in /var/crash though so perhaps this is unrelated.

[Brian Murray (brian-murray)]

I never was able to recreate this bug report.

[kenorb (kenorb)]

Hi,
I've similar problem on my FreeBSD 7.0 and I think it's bug in gplflash-0.4.13 package.

Here is a dump:
#0 0x28d2bdc3 in thr_kill () from /lib/libc.so.7
#1 0x28ce1c69 in pthread_kill () from /lib/libthr.so.3
#2 0x28cdfb6b in raise () from /lib/libthr.so.3
#3 0x08064fb2 in nsProfileLock::FatalSignalHandler (signo=684616620) at nsProfileLock.cpp:206
#4 <signal handler called>
#5 0x28902c31 in XQueryExtension (dpy=0x0, name=0x2870fb09 "MIT-SHM", major_opcode=0xbfbfd024, first_event=0xbfbfd028,
    first_error=0xbfbfd02c) at QuExt.c:46
#6 0x288f34b6 in XInitExtension (dpy=0x0, name=0x2870fb09 "MIT-SHM") at InitExt.c:49
#7 0x2870f3c8 in XextAddDisplay (extinfo=0x287106c0, dpy=0x0, ext_name=0x2870fb09 "MIT-SHM", hooks=0x287102e0, nevents=1, data=0x0)
    at extutil.c:108
#8 0x287094b9 in find_display (dpy=0x0) at XShm.c:82
#9 0x28709d38 in XShmDetach (dpy=0x0, shminfo=0x9494214) at XShm.c:254
#10 0x2b6a0e00 in NPP_Destroy (instance=0x9a3b660, save=0xbfbfd17c) at plugin.c:193

dpy is NULL when XShmDetach is called and that NULL is passed through.
File: gplflash-0.4.13/plugin/plugin.c
        if (This != NULL) {
                pthread_mutex_lock(&synchro);
                if (This->timer) {
                        XtRemoveTimeOut(This->timer);
                        This->timer = 0;
                }
                if (This->fh) {
                        XShmDetach(This->dpy, &This->segInfo); // <-- line 254

There is no any checks if This->dpy can be NULL.
On page: http://gplflash.sourceforge.net/index.php?page=devel
we read that 'GPLFlash2 is not maintained nor developed anymore', but I don't know if it's related to gplflash-0.4.13 as well.

[kenorb (kenorb)]

http://bugs.freedesktop.org/show_bug.cgi?id=7964