BadAccess (attempt to access private resource denied) - with symbols and backtrace

[Dave Gilbert]

Binary package hint: firefox-3.5

Karmic x86/64
             firefox-3.5 3.5.2+nobinonly-0ubuntu2
             xulrunner-1.9.1 1.9.1.2+nobinonly-0ubuntu3
             nspluginwrapper 1.2.2-0ubuntu6

I've started having this problem in the last few weeks, possibly with the ff3.5 introduction but
not sure.

I'm getting frequent crashes of ff which seem related to plugins where the stderr shows:

Gdk-ERROR **: The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAccess (attempt to access private resource denied)'.
  (Details: serial 7814407 error_code 10 request_code 2 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)
aborting...

 I've seen one that looks like it was icedtea that did it, but the one that's more common
for me is flash (32bit) +nspluginwrapper - it used to be that flash would crash, take out the
nspluginwrapper process but ff would survive, but this seems to have changed due to this
behaviour.

In particular if flash stops rendering (e.g. grey square) I kill the nspluginwrapper process,
then if I reload the webpage ff dies with the badaccess. I'm guessing something is assuming too much
about the health of the plugins windows when killing it off.

This is *much* harder to trigger when running with --sync

This backtrace is from a core - gdbing ff tends to kill my X.

Core was generated by `/usr/lib/firefox-3.5.2/firefox --sync'.
Program terminated with signal 5, Trace/breakpoint trap.
#0 IA__g_logv (log_domain=<value optimized out>, log_level=<value optimized out>, format=<value optimized out>, args1=0x7ffffeb19f00)
    at /build/buildd/glib2.0-2.21.5/glib/gmessages.c:512
512 /build/buildd/glib2.0-2.21.5/glib/gmessages.c: No such file or directory.
        in /build/buildd/glib2.0-2.21.5/glib/gmessages.c
(gdb) where
#0 IA__g_logv (log_domain=<value optimized out>, log_level=<value optimized out>, format=<value optimized out>, args1=0x7ffffeb19f00)
    at /build/buildd/glib2.0-2.21.5/glib/gmessages.c:512
#1 0x00007fa1fcb76d43 in IA__g_log (log_domain=0x7fa2027ee040 "", log_level=0, format=0x7fa2027ee040 "")
    at /build/buildd/glib2.0-2.21.5/glib/gmessages.c:526
#2 0x00007fa1fb9f4476 in gdk_x_error (display=<value optimized out>, error=<value optimized out>)
    at /build/buildd/gtk+2.0-2.17.7/gdk/x11/gdkmain-x11.c:466
#3 0x00007fa1fd93d414 in _XError () from /usr/lib/libX11.so.6
#4 0x00007fa1fd94389c in ?? () from /usr/lib/libX11.so.6
#5 0x00007fa1fd943f40 in _XReply () from /usr/lib/libX11.so.6
#6 0x00007fa1fd937cd3 in XSync () from /usr/lib/libX11.so.6
#7 0x00007fa1fd937e8b in ?? () from /usr/lib/libX11.so.6
#8 0x00007fa1fd93524f in XSelectInput () from /usr/lib/libX11.so.6
#9 0x00007fa1fb9d1fd6 in IA__gdk_window_reparent (window=0x7fa1d9a979a0, new_parent=0x7fa1d9a97450, x=0, y=0)
    at /build/buildd/gtk+2.0-2.17.7/gdk/gdkwindow.c:1556
#10 0x00007fa1fc0e7e49 in gtk_widget_reparent_subwindows (widget=0x7fa1d9a97560, new_parent=<value optimized out>)
    at /build/buildd/gtk+2.0-2.17.7/gtk/gtkwidget.c:4920
#11 IA__gtk_widget_reparent (widget=0x7fa1d9a97560, new_parent=<value optimized out>) at /build/buildd/gtk+2.0-2.17.7/gtk/gtkwidget.c:4983
#12 0x00007fa1ffd33e85 in SetWidgetForHierarchy (aWindow=0x7fa1d9a979a0, aOldWidget=0x7fa1ebd1d000, aNewWidget=0x7fa1d7866d00) at nsWindow.cpp:698
#13 0x00007fa1ffd33ec0 in SetWidgetForHierarchy (aWindow=0x7fa1d9a97450, aOldWidget=0x7fa1ebd1d000, aNewWidget=0x7fa1d7866d00) at nsWindow.cpp:710
#14 0x00007fa1ffd33ec0 in SetWidgetForHierarchy (aWindow=0x7fa1d9a97340, aOldWidget=0x7fa1ebd1d000, aNewWidget=0x7fa1d7866d00) at nsWindow.cpp:710
#15 0x00007fa1ffd35840 in nsWindow::SetParent (this=0x7fa1d9913f00, aNewParent=<value optimized out>) at nsWindow.cpp:905
#16 0x00007fa1ff7e7cea in nsPluginInstanceOwner::PrepareToStop (this=0x7fa1d8b6f600, aDelayedStop=<value optimized out>) at nsObjectFrame.cpp:4092
#17 0x00007fa1ff7ebf01 in nsObjectFrame::StopPluginInternal (this=0x7fa1d78510d8, aDelayedStop=1) at nsObjectFrame.cpp:2084
#18 0x00007fa1ff7ecdec in nsObjectFrame::Destroy (this=0x7fa2027ee040) at nsObjectFrame.cpp:646
#19 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1d65231e0) at nsFrameList.cpp:67
#20 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1d6523190) at nsContainerFrame.cpp:263
#21 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#22 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dda9af28) at nsBlockFrame.cpp:300
#23 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#24 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dd70e5f0) at nsBlockFrame.cpp:300
#25 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#26 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dd70e020) at nsBlockFrame.cpp:300
#27 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1dcdfedd8) at nsFrameList.cpp:67
#28 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1dcdfed88) at nsContainerFrame.cpp:263
#29 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1dcdfe1d8) at nsFrameList.cpp:67
#30 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1dcdfe188) at nsContainerFrame.cpp:263
#31 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1dcdfa9b8) at nsFrameList.cpp:67
#32 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1dcdfa968) at nsContainerFrame.cpp:263
#33 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1dcdfa840) at nsFrameList.cpp:67
#34 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1dcdfa7f0) at nsContainerFrame.cpp:263
#35 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1dcdfa7c8) at nsFrameList.cpp:67
#36 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1dcdfa778) at nsContainerFrame.cpp:263
#37 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#38 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcdf1a38) at nsBlockFrame.cpp:300
#39 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#40 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcdf1420) at nsBlockFrame.cpp:300
#41 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#42 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcd88808) at nsBlockFrame.cpp:300
#43 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#44 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcd884e0) at nsBlockFrame.cpp:300
#45 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#46 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcd882f0) at nsBlockFrame.cpp:300
#47 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#48 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcbc7308) at nsBlockFrame.cpp:300
#49 0x00007fa1ff7e3f58 in nsLineBox::DeleteLineList (aPresContext=0x7fa1d7621400, aLines=...) at nsLineBox.cpp:339
#50 0x00007fa1ff7bb459 in nsBlockFrame::Destroy (this=0x7fa1dcbbacb8) at nsBlockFrame.cpp:300
#51 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1d7e3a5d8) at nsFrameList.cpp:67
---Type <return> to continue, or q <return> to quit---
#52 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1d7e3a588) at nsContainerFrame.cpp:263
#53 0x00007fa1ff7dad5e in CanvasFrame::Destroy (this=0x7fa1d7e3a588) at nsHTMLFrame.cpp:239
#54 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1d7e3ae40) at nsFrameList.cpp:67
#55 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1d7e3adf0) at nsContainerFrame.cpp:263
#56 0x00007fa1ff7cfd80 in nsFrameList::DestroyFrames (this=0x7fa1d7e3ab40) at nsFrameList.cpp:67
#57 0x00007fa1ff7c37fb in nsContainerFrame::Destroy (this=0x7fa1d7e3aaf0) at nsContainerFrame.cpp:263
#58 0x00007fa1ff799f76 in nsFrameManager::Destroy (this=0x7fa1d7cc8838) at nsFrameManager.cpp:292
#59 0x00007fa1ff7ad913 in PresShell::Destroy (this=0x7fa1d7cc8800) at nsPresShell.cpp:1949
#60 0x00007fa1ff792803 in DocumentViewerImpl::DestroyPresShell (this=0x7fa1d6def6a0) at nsDocumentViewer.cpp:4260
#61 0x00007fa1ff796112 in DocumentViewerImpl::Destroy (this=0x7fa1d6def6a0) at nsDocumentViewer.cpp:1534
#62 0x00007fa1ff7981cc in DocumentViewerImpl::Show (this=0x7fa1d6def580) at nsDocumentViewer.cpp:1840
#63 0x00007fa1ff7a1922 in nsPresContext::EnsureVisible (this=<value optimized out>, aUnsuppressFocus=1) at nsPresContext.cpp:1550
#64 0x00007fa1ff7e91fa in nsPluginInstanceOwner::Init (this=0x7fa1d8c634f0, aPresContext=<value optimized out>, aFrame=0x7fa1de2d8910,
    aContent=0x7fa1dacc0900) at nsObjectFrame.cpp:4491
#65 0x00007fa1ff7ebfeb in nsObjectFrame::PrepareInstanceOwner (this=0x7fa1de2d8910) at nsObjectFrame.cpp:1746
#66 0x00007fa1ff7ec60e in nsObjectFrame::Instantiate (this=0x7fa2027ee040, aMimeType=0x7fa1e2baaac8 "application/x-shockwave-flash", aURI=0x7fa1dac12d60)
    at nsObjectFrame.cpp:1801
#67 0x00007fa1ff8f45b9 in nsObjectLoadingContent::Instantiate (this=0x7fa1dacc0938, aFrame=0x7fa1de2d8950, aMIMEType=..., aURI=0x7fa1dac12d60)
    at nsObjectLoadingContent.cpp:1768
#68 0x00007fa1ff8f5fad in nsObjectLoadingContent::EnsureInstantiation (this=0x7fa1dacc0938, aInstance=0x7ffffeb1b390) at nsObjectLoadingContent.cpp:783
#69 0x00007fa1ffa1adac in nsHTMLPluginObjElementSH::GetPluginInstanceIfSafe (wrapper=<value optimized out>, _result=0x7ffffeb1b390)
    at nsDOMClassInfo.cpp:9251
#70 0x00007fa1ffa1efdf in nsHTMLPluginObjElementSH::NewResolve (this=<value optimized out>, wrapper=0x7fa1d79d3b20, cx=0x7fa1edc64400, obj=0x7fa1ee0442c0,
    id=140333505152516, flags=<value optimized out>, objp=0x7ffffeb1b490, _retval=0x7ffffeb1b4ac) at nsDOMClassInfo.cpp:9792
#71 0x00007fa1ff655bb0 in XPCWrapper::ResolveNativeProperty (cx=0x7fa1edc64400, wrapperObj=0x7fa1ee0442c0, innerObj=<value optimized out>,
    wn=0x7fa1d79d3b20, id=140333505152516, flags=<value optimized out>, objp=0x7ffffeb1b6c8, isNativeWrapper=1) at XPCWrapper.cpp:406
#72 0x00007fa1ff64f6a4 in XPC_NW_NewResolve (cx=0x7fa1edc64400, obj=0x7fa1ee0442c0, id=140333505152516, flags=5, objp=0x7ffffeb1b6c8)
    at XPCNativeWrapper.cpp:748
#73 0x00007fa200c96707 in js_LookupPropertyWithFlags (cx=0x7fa1edc64400, obj=0x7fa1ee0442c0, id=<value optimized out>, flags=<value optimized out>,
    objp=<value optimized out>, propp=<value optimized out>) at jsobj.cpp:3851
#74 0x00007fa200c97017 in js_GetPropertyHelper (cx=0x7fa1edc64400, obj=0x7fa1ee0442c0, id=140333505152516, cacheResult=<value optimized out>,
    vp=0x7ffffeb1ba08) at jsobj.cpp:4258
#75 0x00007fa200c80ea4 in js_Interpret (cx=0x7fa1edc64400) at jsinterp.cpp:4449
#76 0x00007fa200c8f34d in js_Invoke (cx=0x7fa1edc64400, argc=<value optimized out>, vp=0x7fa1d6de7038, flags=<value optimized out>) at jsinterp.cpp:1394
#77 0x00007fa200c8f6a4 in js_InternalInvoke (cx=0x7fa1edc64400, obj=0x7fa1ee267400, fval=140333505246752, flags=0, argc=0, argv=<value optimized out>,
    rval=0x7ffffeb1bcf0) at jsinterp.cpp:1447
#78 0x00007fa200c57836 in JS_CallFunctionValue (cx=0x7fa2027ee040, obj=0x0, fval=140333803298880, argc=<value optimized out>, argv=<value optimized out>,
    rval=<value optimized out>) at jsapi.cpp:5187
#79 0x00007fa1ff9fa83e in nsJSContext::CallEventHandler (this=0x7fa1edc13ba0, aTarget=<value optimized out>, aScope=<value optimized out>,
    aHandler=0x7fa1f0baf620, aargv=<value optimized out>, arv=0x7ffffeb1be90) at nsJSEnvironment.cpp:2035
#80 0x00007fa1ffa0e7b2 in nsGlobalWindow::RunTimeout (this=0x7fa1d7875800, aTimeout=0x7fa1d79e30a0) at nsGlobalWindow.cpp:7818
#81 0x00007fa1ffa0ea42 in nsGlobalWindow::TimerCallback (aTimer=<value optimized out>, aClosure=0x0) at nsGlobalWindow.cpp:8152
#82 0x00007fa1ffdf65c1 in nsTimerImpl::Fire (this=0x7fa1e4d93dd0) at nsTimerImpl.cpp:420
#83 0x00007fa1ffdf668b in nsTimerEvent::Run (this=<value optimized out>) at nsTimerImpl.cpp:512
#84 0x00007fa1ffdf40cf in nsThread::ProcessNextEvent (this=0x7fa201038b80, mayWait=1, result=0x7ffffeb1bfcc) at nsThread.cpp:510
#85 0x00007fa1ffdc986f in NS_ProcessNextEvent_P (thread=0x7fa2027ee040, mayWait=0) at nsThreadUtils.cpp:227
#86 0x00007fa1ffd4d6bd in nsBaseAppShell::Run (this=0x7fa1f4e6e880) at nsBaseAppShell.cpp:170
#87 0x00007fa1ffc26ac0 in nsAppStartup::Run (this=0x7fa1f0b13200) at nsAppStartup.cpp:193
#88 0x00007fa1ff61d75f in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>) at nsAppRunner.cpp:3347
#89 0x000000000040265f in ?? ()
#90 0x00007fa2014ffabd in __libc_start_main () from /lib/libc.so.6
#91 0x0000000000401ed9 in ?? ()
#92 0x00007ffffeb209c8 in ?? ()
#93 0x000000000000001c in ?? ()
#94 0x0000000000000002 in ?? ()
#95 0x00007ffffeb216ab in ?? ()
#96 0x0000000000000000 in ?? ()

[Shiv V (svenkata)]

I'm having the same issue since upgrading to firefox-3.5. Karmic x86_64 with the same versions of firefox-3.5 and xulrunner-1.9.1 but with swfdec-mozilla (0.8.2-1ubuntu1) instead of flashplugin. As mentioned above, "firefox --sync" makes it harder to trigger the crash.

[Victor Vargas (kamus)]

This report looks similiar to bug 401055, if you are using swfdec to reproduce this, please uninstall this package and instead use flashplugin.

[Dave Gilbert (ubuntu-treblig)]

Hi Kamus,
  I've never used swfdec; always nspluginwrapper+adobe flash.

Looking at 401055 there seems to be some confusion - a startup bug and a separate bug - although I don't
know if they are actually related. Note also this is BadAccess where certainly the first part of 401055 is a BadWindow - the backtrace also looks a bit different from me.

One other observation; I've been using chromium the last few days with the same plugin setup and it's solid as a rock - so while I also tend to blame flash and nspluginwrapper for most of the worlds woes I don't think it is in this case.

Dave

[Micah Gersten (micahg)]

Thank you for the update. Are you still experiencing this with the latest updates on Karmic?

[Micah Gersten (micahg)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 413737, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.