epiphany crash when entering RTL data

Bug #12373 reported by Yuval Tanny
This bug report is a duplicate of:  Bug #16554: segfault with textarea. Edit Remove
6
Affects Status Importance Assigned to Milestone
firefox (Ubuntu)
Invalid
High
Ian Jackson

Bug Description

Go to here:
http://www.whatsup.org.il/index.php?name=PNphpBB2&file=posting&mode=reply&t=20591&sid=f499a0fbe311e2d44d6339358f19ed35
write "Hello World" (or something else) in the big textarea,
press the down arrow, and then the right arrow.
The geko browser get crashed and "Segmentation fault" is printed.

This bug has been fixed in the nightly build of firefox and mozilla some time ago.

Thanks.

Revision history for this message
Thom May (thombot) wrote :

Can't reproduce on firefox.
I assume that epiphany needs to be rebuilt to pick up pango changes in firefox.

Revision history for this message
Sebastien Bacher (seb128) wrote :

doesn't crash here. What version of epiphany/firefox are you using ? Could you
provide a backtrace of the crash (you can get it in the bug-buddy dialog to send
a bug to the devel open after the crash) ?

Revision history for this message
Yuval Tanny (tanai) wrote :

Created an attachment (id=1218)
A crash info from galeon

Sorry,
I'm using Hoary, mozilla-firefox-1.0+dfsg.1-2ubuntu5, mozilla-2:1.7.5-1ubuntu1,
epiphany-browser-1.5.5-0ubuntu3 and galeon-1.3.19-1ubuntu1.

Revision history for this message
Sebastien Bacher (seb128) wrote :

happens in firefox/epiphany/galeon, reassigning back to firefox

Revision history for this message
Sebastien Bacher (seb128) wrote :
Download full text (10.1 KiB)

backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1218985312 (LWP 29721)]
0xb6958a8a in nsSelection::MoveCaret () from
/usr/lib/mozilla-firefox/components/libgklayout.so
(gdb) thread apply all bt

Thread 6 (Thread -1287062608 (LWP 29776)):
#0 0xffffe410 in ?? ()
#1 0xb348f9d8 in ?? ()
#2 0x00000001 in ?? ()
#3 0x00000000 in ?? ()
#4 0xb7de51ca in pthread_cond_timedwait@@GLIBC_2.3.2 () from
/lib/tls/i686/cmov/libpthread.so.0
#5 0xb7e276cb in pt_TimedWait () from /usr/lib/mozilla-firefox/libnspr4.so
#6 0xb7e2796c in PR_WaitCondVar () from /usr/lib/mozilla-firefox/libnspr4.so
#7 0xb7053de9 in nsHostResolver::GetHostToLookup () from
/usr/lib/mozilla-firefox/components/libnecko.so
#8 0xb70540b5 in nsHostResolver::ThreadFunc () from
/usr/lib/mozilla-firefox/components/libnecko.so
#9 0xb7e2e1ea in _pt_root () from /usr/lib/mozilla-firefox/libnspr4.so
#10 0xb7de2ae0 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#11 0xb7755c2a in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 4 (Thread -1251976272 (LWP 29736)):
#0 0xffffe410 in ?? ()
#1 0xb5605798 in ?? ()
#2 0xffffffff in ?? ()
#3 0x00000003 in ?? ()
#4 0xb774d4d9 in poll () from /lib/tls/i686/cmov/libc.so.6
#5 0xb7e2c9df in _pr_poll_with_poll () from /usr/lib/mozilla-firefox/libnspr4.so
#6 0xb7e2ccfb in PR_Poll () from /usr/lib/mozilla-firefox/libnspr4.so
#7 0xb7044109 in nsSocketTransportService::Poll () from
/usr/lib/mozilla-firefox/components/libnecko.so
#8 0xb7044880 in nsSocketTransportService::Run () from
/usr/lib/mozilla-firefox/components/libnecko.so
#9 0xb7f0c98a in nsThread::Main () from /usr/lib/mozilla-firefox/libxpcom.so
#10 0xb7e2e1ea in _pt_root () from /usr/lib/mozilla-firefox/libnspr4.so
#11 0xb7de2ae0 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#12 0xb7755c2a in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 3 (Thread -1261229136 (LWP 29737)):
#0 0xffffe410 in ?? ()
#1 0xb4d32a08 in ?? ()
#2 0x00000062 in ?? ()
#3 0x00000000 in ?? ()
#4 0xb7de51ca in pthread_cond_timedwait@@GLIBC_2.3.2 () from
/lib/tls/i686/cmov/libpthread.so.0
#5 0xb7e276cb in pt_TimedWait () from /usr/lib/mozilla-firefox/libnspr4.so
#6 0xb7e2796c in PR_WaitCondVar () from /usr/lib/mozilla-firefox/libnspr4.so
#7 0xb7019108 in nsIOThreadPool::ThreadFunc () from
/usr/lib/mozilla-firefox/components/libnecko.so
#8 0xb7e2e1ea in _pt_root () from /usr/lib/mozilla-firefox/libnspr4.so
#9 0xb7de2ae0 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#10 0xb7755c2a in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 2 (Thread -1269621840 (LWP 29738)):
#0 0xffffe410 in ?? ()
#1 0xb45319f8 in ?? ()
---Type <return> to continue, or q <return> to quit---
#2 0x000003d0 in ?? ()
#3 0x00000000 in ?? ()
#4 0xb7de51ca in pthread_cond_timedwait@@GLIBC_2.3.2 () from
/lib/tls/i686/cmov/libpthread.so.0
#5 0xb7e276cb in pt_TimedWait () from /usr/lib/mozilla-firefox/libnspr4.so
#6 0xb7e2796c in PR_WaitCondVar () from /usr/lib/mozilla-firefox/libnspr4.so
#7 0xb7f0fc5a in TimerThread::Run () from /usr/lib/mozilla-firefox/libxpcom.so
#8 0xb7f0c98a in nsThread::Main () from /usr/lib/mozilla-firefox/libxpcom.so
#9 0xb7e2e1...

Revision history for this message
Sebastien Bacher (seb128) wrote :
Download full text (12.3 KiB)

debug version:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1219444064 (LWP 3827)]
0xb6532128 in nsSelection::MoveCaret (this=0x89ab280, aKeycode=39,
    aContinue=0, aAmount=eSelectCharacter) at nsSelection.cpp:1526
1526 theFrame->GetOffsets(frameStart, frameEnd);
(gdb) thread apply all bt

Thread 10 (Thread -1299190864 (LWP 3896)):
#0 0xffffe410 in ?? ()
#1 0xb28fe9f8 in ?? ()
#2 0x00000046 in ?? ()
#3 0x00000000 in ?? ()
#4 0xb7d751ca in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/tls/i686/cmov/libpthread.so.0
#5 0xb7dbaf28 in pt_TimedWait (cv=0x8227d94, ml=0x8228a08, timeout=60000)
    at ptsynch.c:264
#6 0xb7dbb43f in PR_WaitCondVar (cvar=0x8227d90, timeout=60000)
    at ptsynch.c:391
#7 0xb6e8ef60 in nsIOThreadPool::ThreadFunc (arg=0x8227d40)
    at nsIOThreadPool.cpp:254
#8 0xb7dc2ca4 in _pt_root (arg=0x87c57b8) at ptthread.c:214
#9 0xb7d72ae0 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#10 0xb76e5c2a in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 9 (Thread -1307583568 (LWP 3895)):
#0 0xffffe410 in ?? ()
#1 0xb20fd9c8 in ?? ()
#2 0x00000001 in ?? ()
#3 0x00000000 in ?? ()
---Type <return> to continue, or q <return> to quit---
#4 0xb7d751ca in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/tls/i686/cmov/libpthread.so.0
#5 0xb7dbaf28 in pt_TimedWait (cv=0x8128db4, ml=0x8128d50, timeout=60000)
    at ptsynch.c:264
#6 0xb7dbb43f in PR_WaitCondVar (cvar=0x8128db0, timeout=60000)
    at ptsynch.c:391
#7 0xb6edcbb3 in nsHostResolver::GetHostToLookup (this=0x8128cf0,
    result=0xb20fda98) at nsHostResolver.cpp:545
#8 0xb6edce99 in nsHostResolver::ThreadFunc (arg=0x8128cf0)
    at nsHostResolver.cpp:630
#9 0xb7dc2ca4 in _pt_root (arg=0x87a4560) at ptthread.c:214
#10 0xb7d72ae0 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#11 0xb76e5c2a in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 8 (Thread -1290798160 (LWP 3894)):
#0 0xffffe410 in ?? ()
#1 0xb30ff9f8 in ?? ()
#2 0x00000046 in ?? ()
#3 0x00000000 in ?? ()
#4 0xb7d751ca in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/tls/i686/cmov/libpthread.so.0
#5 0xb7dbaf28 in pt_TimedWait (cv=0x8227d94, ml=0x8228a08, timeout=60000)
    at ptsynch.c:264
---Type <return> to continue, or q <return> to quit---
#6 0xb7dbb43f in PR_WaitCondVar (cvar=0x8227d90, timeout=60000)
    at ptsynch.c:391
#7 0xb6e8ef60 in nsIOThreadPool::ThreadFunc (arg=0x8227d40)
    at nsIOThreadPool.cpp:254
#8 0xb7dc2ca4 in _pt_root (arg=0x87a0de8) at ptthread.c:214
#9 0xb7d72ae0 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#10 0xb76e5c2a in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 7 (Thread -1262580816 (LWP 3839)):
#0 0xffffe410 in ?? ()
#1 0xb4be8788 in ?? ()
#2 0xffffffff in ?? ()
#3 0x00000003 in ?? ()
#4 0xb76dd4d9 in poll () from /lib/tls/i686/cmov/libc.so.6
#5 0xb7dc1417 in _pr_poll_with_poll (pds=0x81283c8, npds=3,
    timeout=4294967295) at ptio.c:3902
#6 0xb7dc1733 in PR_Poll (pds=0x81283c8, npds=3, timeout=4294967295)
    at ptio.c:4304
#7 0xb6ec93f1 in nsSocketTransportService::Poll (this=0x8128070)
    at nsSocketTransportService2.cpp:325
#8 0xb6ec9d2c in nsSo...

Revision history for this message
Yuval Tanny (tanai) wrote :

It is the same bug as this:
https://bugzilla.mozilla.org/show_bug.cgi?id=267212

As I said, it appearently fixed somewhere, because the nightly build of
mozilla/firefox are not crashing.

Thanks,
Yuval

Revision history for this message
Ian Jackson (ijackson) wrote :

This works for me with firefox 1.0.6-1ubuntu13 and I think it may have been
related to 10257

This bug has been marked as a duplicate of bug 16554.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.