[MASTER] FF crash with BadAlloc on png's/images with large dimensions

[Prvic]

Binary package hint: firefox-3.0

Ubuntu 8.04
FF-3 (3.0~b5+nobinonly-0ubuntu3) crashes on "http://lady.mail.ru/article/45944"
FF-2 opens this URL successfully.

Testcase: http://lady.mail.ru/img/bg_l.png (caution: this might crash your browser)

ProblemType: Bug
Architecture: i386
Date: Mon May 19 00:51:22 2008
DistroRelease: Ubuntu 8.04
NonfreeKernelModules: nvidia
Package: firefox-3.0 3.0~b5+nobinonly-0ubuntu3
PackageArchitecture: i386
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=ru_RU.UTF-8
 SHELL=/bin/bash
SourcePackage: firefox-3.0
Uname: Linux 2.6.24-16-generic i686

[Quintenbernaert (quintenbernaert)]

Firefox 3 alpha 6 says the image contains errors and it doesn't crash.

[Adam Guthrie (ispiked)]

Can you get a stacktrace for the crash? http://kb.mozillazine.org/Talkback

[Mats Palmgren (matspal)]

Created attachment 275211
stack

XError calls exit in response to an XCreatePixmap error...

[Mats Palmgren (matspal)]

We have bugs filed on this, eg bug 348463 and bug 210931.

[Bsb-sanger (bsb-sanger)]

On a mac with Firefox 2.0.0.9, I get the same behaviour. The two bugs referenced above were reported on Linux with GTK, so I am a bit puzzled. I attach a test-case png which always kills firefox on my mac as well as on Linux when trying to zoom in. A stack trace is also included. The command line spits out this:

/Applications/Firefox.app/Contents/MacOS/run-mozilla.sh: line 424: 9222 Segmentation fault "$prog" ${1+"$@"}

Is this a bug in Apples rendering? Safari shows the picture nicely...

[Bsb-sanger (bsb-sanger)]

Created attachment 290214
Stack trace of Firefox 2.0.0.9 crash on Mac

[Bsb-sanger (bsb-sanger)]

Sorry, just realized the PNG is too large to show. Try this url:

http://www.sanger.ac.uk/cgi-bin/software/analysis/logomat-m.cgi?pfamid=PF04735

[Timeless-bemail (timeless-bemail)]

benjamin: file a new bug. this bug is *only* for Gtk. Your crash in apple's code could either be a bug in apple's code, or a bug in some of our mac code, but it needs to be tracked differently.

[Daniel Holbert (dholbert)]

I see this bug using Ubuntu 8.04, using FF3 and FF2, at these places:
 a) the URL in comment 7
 b) http://www.howtoforge.com
 c) attachment 310818 (a wide PNG taken from howtoforge.com)
 d) http://tech.yahoo.com/blogs/

I initially posted about this in bug 369971 comment 24 through 37, but I'm directing further info to this bug page, because what I'm seeing is Linux-specific and PNG-specific.

If it matters, my libgtk2.0-0 package is version 2.0-0_2.12.9-2ubuntu1

[Mats Palmgren (matspal)]

Daniel, bug 424333 now has a patch for trunk too... does that help?

[Daniel Holbert (dholbert)]

Nope. I tested
   attachment 310818 (evil howtoforge PNG)
along with
   attachment 310964 (gif that crashes FF, from bug 424333)
and they both still crash (thought the gif takes ~5 seconds)

[Daniel Holbert (dholbert)]

Oops -- I think I was running the wrong build when I posted comment 11.

I just tested it with the patch correctly applied, and while the patch *does* fix attachment 310964 (gif from bug 424333) on my machine, it doesn't fix attachment 310818 or howtoforge.com or tech.yahoo.com/blogs.

[Daniel Holbert (dholbert)]

Created attachment 312155
Stack trace of Trunk crash on Linux (Ubuntu 8.04)

Here's a stack trace I caught in GDB for the linux crash on attachment 310818.

If I continue from this point, I immediately hit the _Xerror call.

[Daniel Holbert (dholbert)]

I can actually scale the howtoforge image down to 8189px wide and still produce the crash. (but at 8188px wide, we don't crash)

Then, keeping the 8189px width, I can also scale it vertically down to 2px tall and still produce the crash. (but at 1px, or at 2px by 8188px, we don't crash)

So what's the significance of 8189px? It's *almost* 2^13:
    2^13 = 8192 = 8189 + 3

So I think we're hitting some byte-count boundary, or something...

e.g. if we're hypothetically using 4 bits per pixel of width, that puts us at
    8188 * 4 = 32752 = (2^15 - 16) => no crash
    8189 * 4 = 32756 = (2^15 - 12) => crash
so we could be dealing with a signed 16-bit number (i.e. 15 bits of value) which is offset by 16 for some reason, and which is overflowing & causing the crash.

[Daniel Holbert (dholbert)]

Created attachment 312172
reduced PNG testcase (crashes firefox on some systems)

Here's a black 2px-high 8189px-wide PNG which crashes both Firefox 2 and trunk builds. (per my last comment)

[Daniel Holbert (dholbert)]

For convenience, here's that last testcase as a data-url: http://preview.tinyurl.com/398gxr

[Daniel Holbert (dholbert)]

Requesting blocking1.9, as this affects trunk (along with branch) and seems fairly serious.

[Daniel Holbert (dholbert)]

Comment on attachment 312172
reduced PNG testcase (crashes firefox on some systems)

On my laptop, which is also running Ubuntu 8.04, I only get the crash with the URL from comment 7 -- not with the reduced testcase, the howtoforge.com site, or the tech.yahoo.com/blogs site.

[Vladimir Vukicevic (vvuk)]

Swapping this based on roc's comments -- it's not a regression, but we should fix it at some point.

[Prvic (victoravasiliev)]

Binary package hint: firefox-3.0

Ubuntu 8.04
FF-3 (3.0~b5+nobinonly-0ubuntu3) crashes on "http://lady.mail.ru/article/45944"
FF-2 opens this URL successfully.

ProblemType: Bug
Architecture: i386
Date: Mon May 19 00:51:22 2008
DistroRelease: Ubuntu 8.04
NonfreeKernelModules: nvidia
Package: firefox-3.0 3.0~b5+nobinonly-0ubuntu3
PackageArchitecture: i386
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=ru_RU.UTF-8
 SHELL=/bin/bash
SourcePackage: firefox-3.0
Uname: Linux 2.6.24-16-generic i686

[PaneQ (robert-pankowecki)]

On my computer it crashes too. Can anyone else confirm it ?

[Alexander Sack (asac)]

On Sun, May 18, 2008 at 11:13:14PM -0000, PaneQ wrote:
> On my computer it crashes too. Can anyone else confirm it ?
>

Anyone else can reproduce?

Please get a backtrace like:

  https://wiki.ubuntu.com/MozillaTeam/Bugs#head-c576e78d92cb3c959c271158b6ace98be835de83

further attach /tmp/ffox.strace.txt produced by

   strace -f -eopen firefox &> /tmp/ffox.strace.txt

when having reproduced the crash.

 status incomplete

 - Alexander

[Alexander Sack (asac)]

On Sun, May 18, 2008 at 11:13:14PM -0000, PaneQ wrote:
> On my computer it crashes too. Can anyone else confirm it ?
>

... and if its reapply reproducible importance is at least medium.

 importance medium

 - Alexander

[Livid (g-livid)]

Bug reproduced.
Firefox-3.0-rc1

[Alexander Sack (asac)]

On Sun, Jun 08, 2008 at 01:25:17PM -0000, Livid wrote:
> Bug reproduced.
> Firefox-3.0-rc1
>

Please get a backtrace like i said in my previous mail.

 status incomplete

Thanks,

 - Alexander

[Livid (g-livid)]

> Please get a backtrace like i said in my previous mail.
Sorry, but there are only debug symbols for b5, not for rc1. So no luck.
When I get some time on my hands, if there will be no solution or at least debug symbols by then, I'll try to mess with sources a bit, but it's more likely to happen about the end of june.

[Alexander Sack (asac)]

On Mon, Jun 09, 2008 at 07:07:06PM -0000, Livid wrote:
> > Please get a backtrace like i said in my previous mail.
> Sorry, but there are only debug symbols for b5, not for rc1. So no luck.
> When I get some time on my hands, if there will be no solution or at least debug symbols by then, I'll try to mess with sources a bit, but it's more likely to happen about the end of june.
>

RC1 is now in hardy-updates. So dbgsym packages should be available
too.

Thanks!

 - Alexander

[Alexander Sack (asac)]

On Mon, Jun 09, 2008 at 09:39:15PM -0000, Alexander Sack wrote:
> On Mon, Jun 09, 2008 at 07:07:06PM -0000, Livid wrote:
> > > Please get a backtrace like i said in my previous mail.
> > Sorry, but there are only debug symbols for b5, not for rc1. So no luck.
> > When I get some time on my hands, if there will be no solution or at least debug symbols by then, I'll try to mess with sources a bit, but it's more likely to happen about the end of june.
> >
>
> RC1 is now in hardy-updates. So dbgsym packages should be available
> too.
>
Please try those ...

 status incomplete

 - Alexander

[Livid (g-livid)]

My bad. Anyway, although I installed all required dbgsym packages, gdb keeps telling "no debug symbols".
But you might be able to get some information from the output. Only meaningful info, in my opinion, is this:
> The program 'firefox' received an X Window System error.
> This probably reflects a bug in the program.
> The error was 'BadAlloc (insufficient resources for operation)'.
> (Details: serial 24760 error_code 11 request_code 53 minor_code 0)
Thre rest is attached

[Livid (g-livid)]

Oh, sorry, i seem to have attached wrong file w/o bt full, thread apply all backtrace full
Anyway those commands return nothing, since program exited already by the time I can enter them.

[Alexander Sack (asac)]

On Tue, Jun 10, 2008 at 11:59:29AM -0000, Livid wrote:
> My bad. Anyway, although I installed all required dbgsym packages, gdb keeps telling "no debug symbols".
> But you might be able to get some information from the output. Only meaningful info, in my opinion, is this:
> > The program 'firefox' received an X Window System error.
> > This probably reflects a bug in the program.
> > The error was 'BadAlloc (insufficient resources for operation)'.
> > (Details: serial 24760 error_code 11 request_code 53 minor_code 0)
> Thre rest is attached
>

If you see this, its most likely a X driver issue. which driver are
you using?

Have you tried to disable flash (sorry if i already asked before)

 - Alexander

[Livid (g-livid)]

nvidia-glx-new 169.12+2.6.24.13-19.42
The bug happened to be reproducible on a notebook with intel embedded video, and on ati mobile chipset, so it doesn't seem to be the case.
Yes, I tried disabling flash, java, quicktime, mplayer, vlc etc etc plugins, and even disabled every addon, and it changed nothing.

Oh, btw. Not only http://lady.mail.ru/article/45944 crashes firefox. Any page on http://lady.mail.ru does. I will try and find what exactly on page causes the crash, but that might be harder than I hope.

[Livid (g-livid)]

Hmm. I disabled autoloading of images, and it miraculously loaded.
When I turned it back, crashes came back as well.

[Alexander Sack (asac)]

On Tue, Jun 10, 2008 at 03:42:04PM -0000, Livid wrote:
> nvidia-glx-new 169.12+2.6.24.13-19.42
> The bug happened to be reproducible on a notebook with intel embedded video, and on ati mobile chipset, so it doesn't seem to be the case.
> Yes, I tried disabling flash, java, quicktime, mplayer, vlc etc etc plugins, and even disabled every addon, and it changed nothing.
>
> Oh, btw. Not only http://lady.mail.ru/article/45944 crashes firefox. Any
> page on http://lady.mail.ru does. I will try and find what exactly on
> page causes the crash, but that might be harder than I hope.
>

Do you always get this XError (from a few posts before) on the
terminal?

 - Alexander

[Livid (g-livid)]

> Do you always get this XError (from a few posts before) on the terminal?
Funny, but I don't Crash is well there though.
I found what exactly causes the crash, by the way. It's broken png image, believe it or not.
I attached it to this post.

[Alexander Sack (asac)]

On Tue, Jun 10, 2008 at 04:23:35PM -0000, Livid wrote:
> > Do you always get this XError (from a few posts before) on the terminal?
> Funny, but I don't Crash is well there though.
> I found what exactly causes the crash, by the way. It's broken png image, believe it or not.
> I attached it to this post.
>
> ** Attachment added: "little image which crashes ff3"
> http://launchpadlibrarian.net/15176381/bg_l.png
>

Most likely a xorg driver issue then. Which driver are you using?
maybe attach xorg.conf and Xorg.0.log to this bug to help the future
triage.

 status incomplete

 - Alexander

[Livid (g-livid)]

I thought that clarification is in order.
Here
> Funny, but I don't Crash is well there though.
I mistyped one dot. I tried to say, that on a notebook with intel embedded video, there is no XError message, but firefox DOES crash.

Anyway... Log and conf attached.

[Livid (g-livid)]

A little more information.
On my desktop PC FF3 crashes on that image with XError.
On my HP nc6320 laptop, it crashes with no error messages at all. (but crashes all the same)
On ASUS Z99l it crashes with segfault.
I suppose I should run it under gdb on asus and maybe hp, but not right now.

[Alexander Sack (asac)]

On Tue, Jun 10, 2008 at 06:25:23PM -0000, Livid wrote:
>
> ** Attachment added: "xorg.conf"
> http://launchpadlibrarian.net/15179246/xorg.conf
>

why nvidia card is that?

 - Alexander

[Alexander Sack (asac)]

On Tue, Jun 10, 2008 at 07:04:11PM -0000, Livid wrote:
> A little more information.
> On my desktop PC FF3 crashes on that image with XError.
> On my HP nc6320 laptop, it crashes with no error messages at all. (but crashes all the same)
> On ASUS Z99l it crashes with segfault.
> I suppose I should run it under gdb on asus and maybe hp, but not right now.
>

If you do, the instructions on how to get a backtrace are:

   https://wiki.ubuntu.com/MozillaTeam/Bugs#head-c576e78d92cb3c959c271158b6ace98be835de83

 status incomplete

thanks,

 - Alexander

[Alexander Sack (asac)]

On Tue, Jun 10, 2008 at 07:15:17PM -0000, Alexander Sack wrote:
> On Tue, Jun 10, 2008 at 06:25:23PM -0000, Livid wrote:
> >
> > ** Attachment added: "xorg.conf"
> > http://launchpadlibrarian.net/15179246/xorg.conf
> >
>
> why nvidia card is that?

I mean "what ..." here :)

 - Alexander

[Livid (g-livid)]

Ok. Just ran FF through GDB. On my HP laptop (intel video) it, strangely enough, gave me XError and exited, although it didn't throw it at me before. So it doesn't seem to be specific X driver.
On ASUS it actually allowed me to get some backtrace output, which is attached. But XError persists.

And, there is new upstream version, well, bug is still there.

[Livid (g-livid)]

Ah, right. My graphics card on desktop is nv geforce 8500.
But as to me, it doesn't seem like it has to do anything with this bug.
Anyway, did you look at
> ** Attachment added: "little image which crashes ff3"
> http://launchpadlibrarian.net/15176381/bg_l.png
?
It's broken png file, as far as I can see. I have a hypothesis, but I'm not too sure about it.
Looks like firefox tries to display broken png, without checking how bad things are. As a result, X server tries to display something undisplayable, and application crashes with XError. A bit naive, but I don't know how things work between x client and x server on such detailed level.
Another hypothesis may be that all my image viewing software are suddenly broken, so they all either crash (firefox), or display nothing.

[Alexander Sack (asac)]

On Wed, Jun 11, 2008 at 10:17:45AM -0000, Livid wrote:
> Ok. Just ran FF through GDB. On my HP laptop (intel video) it, strangely enough, gave me XError and exited, although it didn't throw it at me before. So it doesn't seem to be specific X driver.
> On ASUS it actually allowed me to get some backtrace output, which is attached. But XError persists.
>
> And, there is new upstream version, well, bug is still there.
>
> ** Attachment added: "gdb-firefox.txt"
> http://launchpadlibrarian.net/15193930/gdb-firefox.txt
>

this is a flashplayer crash.

 affects ubuntu/firefox-3.0
 status invalid

 affects ubuntu/flashplugin-nonfree
 status new

 - Alexander

[Livid (g-livid)]

Well, mayhap it's related, but I just uninstalled flashplugin-nonfree, and here we go - lady.mail.ru crashes.
This time without segfault, though, with similar symptoms to my other two systems.
Besides, I told already that I tried disabling it, and there was no change in behavior.

More or less side note: that image is being responsed as 4x65000 transparent PNG. That may explain BadAlloc (insufficent resources for operation).
Here I should agree that it's not firefox's problem, but more likely lady.mail.ru webdesigner`s problem. But it might be good idea to check alloc against maximum allocation size, so that it wouldn't crash.
Oh, and let me emphasize: firefox crashes when tries to render attached PNG, and it doesn't really matter, where does ff get image from. It may be local file, or picture on a web site, or attachment. When FF tries to render this image, it crashes. It can load this image, until it is not on active tab (checked that, just forgot to mention), but when image is to become visible, FF crashes. Doesn't seem flash-reated to me.

[Alexander Sack (asac)]

On Wed, Jun 11, 2008 at 01:32:43PM -0000, Livid wrote:
> Well, mayhap it's related, but I just uninstalled flashplugin-nonfree, and here we go - lady.mail.ru crashes.
> This time without segfault, though, with similar symptoms to my other two systems.
> Besides, I told already that I tried disabling it, and there was no change in behavior.
>
> More or less side note: that image is being responsed as 4x65000
> transparent PNG. That may explain BadAlloc (insufficent resources
> for operation).

This is a known upstream bug. Images with a size > some value can
cause crashes. Can you crash firefox by just opening that image?

Can you please provide a link ot the image that crashes?

 status incomplete

 - Alexander

[Rui Boon (ruiboon)]

Upstream link: https://bugzilla.mozilla.org/show_bug.cgi?id=402204
Image that crash ff: http://launchpadlibrarian.net/15176381/bg_l.png

I have also attached my backtrace.

qiv also seems to be affected by that image. Maybe this is related?
eog,gimp does not seems to be affected.

This is not a flashplugin bug.

[Rui Boon (ruiboon)]

This may be a duplicate of bug 205599. Although the bug seems to be fixed, i am able to reproduce it with the current version of xserver-xorg-core (2:1.4.1~git20080131-1ubuntu9)

There seems to be a workaround in https://bugs.edge.launchpad.net/ubuntu/+source/xorg-server/+bug/205599/comments/19

[Livid (g-livid)]

Alexander: I attached image in one of my previous posts, sorry if I didn't emphasize it. Two posts higher, Rui Boon gave link to this attachment. Original's at http://lady.mail.ru/img/bg_l.png

Rui Boon: Not sure about duplicate, but workaround didn't work. Though I'm not sure it should work with nvidia graphics chipset at all.

[Alexander Sack (asac)]

right upstream bug found. triaged for ubuntu.

[Tonglebeak (tonglebeak)]

*** Bug 436833 has been marked as a duplicate of this bug. ***

[Tonglebeak (tonglebeak)]

*** Bug 436037 has been marked as a duplicate of this bug. ***

[alain.tuor (alain-tuor)]

same issue with www.directnet.com (quite critical, it's for Credit Suisse
online banking)

[Stransky (stransky)]

*** Bug 448276 has been marked as a duplicate of this bug. ***

[Stransky (stransky)]

In 1.8, it's handled here:

nsresult nsImageGTK::Init(PRInt32 aWidth, PRInt32 aHeight,
                          PRInt32 aDepth, nsMaskRequirements aMaskRequirements)
{

  [snip]

  // X Protocol limits us to image dimensions less than 32767
  // unless we want to go through lots of pain and suffering.
  if (aWidth > SHRT_MAX || aHeight > SHRT_MAX)
    return NS_ERROR_FAILURE;

  [snip]

}

[Matti-mversen (matti-mversen)]

*** Bug 448653 has been marked as a duplicate of this bug. ***

[Mats Palmgren (matspal)]

The patch in attachment 381814 in bug 424333 fixes this bug (and duplicates)
for me.

[Jst (jst)]

Should this bug be closed then, or is there something still remaining here?

[Mats Palmgren (matspal)]

Nothing remaining here besides the issues in bug 424333 as far as I know.

*** This bug has been marked as a duplicate of bug 424333 ***

[Aklem (aklem)]

anybody who gets this crash.... type trans in google just try it type in TRANS or trans or anything with trans in it like transparent or transcribe.... it crashes with the same error!

[penalvch (penalvch)]

Not reproducible in Trusty.