firefox3 crashes when viewing big PNG files

[Martin Olsson]

Open one of these PNG files in FF3b5 or FF3-RC1:

http://www.kernel.org/pub/linux/kernel/people/gregkh/kernel_history/developer_graph-2.6.22.png
http://libpng.org/pub/png/img_png/16million.png

Note: the first one is a real life image that I want to view, it's not some strange special case which has been crafted for crashing FF.

[Martin Olsson (mnemo)]

Breakpad did NOT trigger. Is that a separate bug maybe or is breakpad windows only?

[Sylvain Pasche (sylvain-pasche)]

maybe you don't have the ca-certificates package installed?. See bug 407748

[Martin Olsson (mnemo)]

I tried starting ff3, then attaching gdb to ff3 and then reproing the bug. All I got was this:

(gdb) c
Continuing.
[New Thread -1271010416 (LWP 10605)]
[New Thread -1302750320 (LWP 10606)]

Program exited with code 01.
(gdb) bt
No stack.
(gdb)

---

Also, it seems sylvain is right about the certificates. This is what I see on my machine:
mnemo@gutsyT5:~$ curl https://crash-reports.mozilla.com/submit
curl: (77) error setting certificate verify locations:
  CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none

[Martin Olsson (mnemo)]

I ran "sudo apt-get install ca-certificates" to see if I could get breakpad running but no luck.

[Martin Olsson (mnemo)]

Here is the error code being passed into gdk_x_error(), I have no idea how to improve the readability of the backstrace (im not a frequent gdb user).

---------------

(gdb) break gdk_x_error
Breakpoint 1 at 0xb6eac7d3: file /build/buildd/gtk+2.0-2.12.0/gdk/x11/gdkmain-x11.c, line 614.
(gdb) c
Continuing.

Breakpoint 1, gdk_x_error (display=0x8130000, error=0xbfeaaf08) at /build/buildd/gtk+2.0-2.12.0/gdk/x11/gdkmain-x11.c:614
614 /build/buildd/gtk+2.0-2.12.0/gdk/x11/gdkmain-x11.c: No such file or directory.
        in /build/buildd/gtk+2.0-2.12.0/gdk/x11/gdkmain-x11.c
(gdb) bt
#0 gdk_x_error (display=0x8130000, error=0xbfeaaf08) at /build/buildd/gtk+2.0-2.12.0/gdk/x11/gdkmain-x11.c:614
#1 0xb621a655 in ?? () from /usr/lib/libbonoboui-2.so.0
#2 0x08130000 in ?? ()
#3 0xbfeaaf08 in ?? ()
#4 0x00000056 in ?? ()
#5 0xb6c87b2c in ?? () from /usr/lib/libX11.so.6
#6 0xbfeaafb8 in ?? ()
#7 0xb6c87b2c in ?? () from /usr/lib/libX11.so.6
#8 0xbfeaaf78 in ?? ()
#9 0xb6bd6bfa in _XError () from /usr/lib/libX11.so.6
Backtrace stopped: frame did not save the PC
(gdb)

[Timeless-bemail (timeless-bemail)]

gdk_x_error triggers exit() or abort(), we could probably get breakpad to replace and trap it, but that's kinda stupid. we could also try to fix gdk/gtk2/cairo/gecko to handle such errors.

to get useful stacks, you need symbols for glib/gdk/gtk/cairo and a couple of others, you must run w/ --sync as the error indicates, and you should run it under a debugger.

[Jruderman (jruderman)]

WFM on Mac.

[Mats Palmgren (matspal)]

Created an attachment (id=313978)
stack

[Mats Palmgren (matspal)]

I have updated the patch in bug 424333 so it fixes this case too.

[Martin Olsson (mnemo)]

The RC1 version still crashes on the mentioned PNG, and it also crashes on this PNG as well:
http://libpng.org/pub/png/img_png/16million.png

[Vladimir Vukicevic (vvuk)]

Same disposition as 424333; won't block no it, will get a fix in for a dot release.

[Martin Olsson (mnemo)]

Open one of these PNG files in FF3b5 or FF3-RC1:

http://www.kernel.org/pub/linux/kernel/people/gregkh/kernel_history/developer_graph-2.6.22.png
http://libpng.org/pub/png/img_png/16million.png

Note: the first one is a real life image that I want to view, it's not some strange special case which has been crafted for crashing FF.

[istoyanov (istoyanov)]

Ubuntu 8.04, firefox-3.0~b5+nobinonly-0ubuntu3

I can confirm Firefox 3 Beta 5 crashing on these PNGs.

[Alexander Sack (asac)]

On Tue, May 13, 2008 at 09:29:20PM -0000, Ivailo Stoyanov wrote:
> Ubuntu 8.04, firefox-3.0~b5+nobinonly-0ubuntu3
>
> I can confirm Firefox 3 Beta 5 crashing on these PNGs.
>
> ** Changed in: firefox-3.0 (Ubuntu)
> Status: New => Confirmed
>

So far upstream says, that this is not a 3.0 release blocker, but might
get fixed in a point update 3.0.x.

 status inprogress

 - Alexander

[Martin Olsson (mnemo)]

This is still completely broken in FF 3.5.2 although now the gdk_x_error/BadGC is gone and instead the image refuses to paint scaled to fit and refuses to scroll when zoomed to 100%.

[Jruderman (jruderman)]

Related to bug 166862 and/or bug 210931?

[penalvch (penalvch)]

Martin Olsson, thank you for reporting this and helping make Ubuntu better. However, your crash report is missing. Please follow these instructions to have apport report a new bug about your crash that can be dealt with by the automatic retracer. First, execute at a terminal:
cd /var/crash && sudo rm * ; sudo apt-get update && sudo apt-get -y upgrade && sudo apt-get -y install firefox-dbg && sudo service apport start force_start=1

If you are running the Ubuntu Stable Release you might need to enable apport in /etc/default/apport and restart.

Now reproduce the crash, then open your file manager, navigate to your /var/crash directory and open the crash report you wish to submit.
If this fails you will have to open a terminal and file your report with 'ubuntu-bug /var/crash/_my_crash_report.crash' where _my_crash_report.crash is the crash you would like to report. If you get an error that you aren't allowed to access this report you will have to file it with 'sudo ubuntu-bug /var/crash/_my_crash_report.crash'. If you run the command against the crash report and a window pops up asking you to report this, but then never opens a new report, you would be affected by https://bugs.launchpad.net/ubuntu/+source/apport/+bug/994921 . In order to WORKAROUND this, one would need to open the following file via a command line:
gksudo gedit /etc/apport/crashdb.conf

and comment out the line:
'problem_types': ['Bug', 'Package'],

by changing it to:
# 'problem_types': ['Bug', 'Package'],

Save, close, and try to file the crash report again via:
ubuntu-bug /var/crash/_my_crash_report.crash

Please follow https://wiki.ubuntu.com/MozillaTeam/Bugs when you file this crash report so the necessary information is provided.

I'm closing this bug report since the process outlined above will automatically open a new bug report which can then dealt with more efficiently.

Thank you for your understanding.

Helpful bug reporting tips:
https://wiki.ubuntu.com/ReportingBugs