Bug #931637 “Firefox 10.0.1 crashes when trying to enter a comma...” : Bugs : firefox package : Ubuntu

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-14:

#24

I get semi-random crashes while running the Firefox developer tools mochitests on my machine.

This started happening since I pulled https://tbpl.mozilla.org/?tree=Fx-Team&rev=9d697ecaf161 ... and it still happens, even with the latest fx-team code.

Tests from the Style Inspector, Source Editor and from the Web Console cause crashes, in opt and dbg builds.

I am not sure if the component I picked is correct, I just saw the crasher is related to js/Vector.h and jscntxt.h, etc.

Going to attach gdb stacktraces.

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-14:

#25

Created attachment 567125
gdb stacktrace 1

Generated debug output and stacktrace as suggested in:
https://wiki.ubuntu.com/MozillaTeam/Bugs

This is the result of running the mochitest-browser-chrome tests from browser/devtools (all our tests).

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-14:

#26

Created attachment 567127
gdb stacktrace 2

Another stacktrace.

I would really appreciate a fix for this crash ... it breaks daily work on my machine. Please let me know if further information is needed. Thank you!

Revision history for this message

In Mozilla Bugzilla #694594, Jorendorff (jorendorff) wrote on 2011-10-14:

#27

Both stacks are assertion failures in Vector.

msucan says you can trigger this like so:

  - build with --enable-debug on Linux x86-64
  - start the browser
  - open the console (Ctrl+Shift+K)
  - type w

The console's auto-complete feature triggers the assertion.

gkw, could you please reproduce this and bisect if possible?

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-16:

#28

This crasher started since bug 648801 landed.

Peter, can you please look into this? I haven't seen anyone who can repro the crasher. I can't even repro the crasher with tinderbox builds. This happens only on my own local builds.

if I set pref("dom.new_bindings", false) I still get the crash.

I have Ubuntu 10.04 LTS (amd64), gcc 4.4.3 (from official repos), everything up-to-date. Please let me know if you need any additional technical info about my build setup.

Thank you!

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-16:

#29

Bisected into the patches pushed for bug 648801. The first changeset that causes crashes is 0b6fe35629ae:

https://hg.mozilla.org/mozilla-central/rev/0b6fe35629ae

Revision history for this message

In Mozilla Bugzilla #694594, Peterv (peterv) wrote on 2011-10-17:

#30

I can't reproduce this on Ubuntu 11.04 (tried running the tests and using autocomplete in the console).

(In reply to Mihai Sucan [:msucan] from comment #5)
> Bisected into the patches pushed for bug 648801. The first changeset that
> causes crashes is 0b6fe35629ae:
>
> https://hg.mozilla.org/mozilla-central/rev/0b6fe35629ae

That'd be very surprising, that changeset adds code that isn't actually used (later patches cause it to be used).

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-17:

#31

(In reply to Peter Van der Beken [:peterv] from comment #6)
> I can't reproduce this on Ubuntu 11.04 (tried running the tests and using
> autocomplete in the console).

Even nightly builds I get from mozilla.org work fine. It's certainly a problem (only?) on my machine. Only my local builds crash...

> (In reply to Mihai Sucan [:msucan] from comment #5)
> > Bisected into the patches pushed for bug 648801. The first changeset that
> > causes crashes is 0b6fe35629ae:
> >
> > https://hg.mozilla.org/mozilla-central/rev/0b6fe35629ae
>
> That'd be very surprising, that changeset adds code that isn't actually used
> (later patches cause it to be used).

Heh, surprising indeed. Unfortunately, that's what I found yesterday...

Are you on IRC, by any chance? I can try things live, as you see fit.

Anything I can help with debugging this crasher? Are the gdb stack traces of any help?

Thank you!

Revision history for this message

In Mozilla Bugzilla #694594, Peterv (peterv) wrote on 2011-10-17:

#32

The gdb traces are in JS engine code that's unrelated to that changeset. Are you saying that without that changeset you can't reproduce at all and with it you can 100% of the time? If so, can you try removing just the change in qsgen.py from that changeset?
If that's the changeset that causes it this looks more like a compiler bug.

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-17:

#33

(In reply to Peter Van der Beken [:peterv] from comment #8)
> The gdb traces are in JS engine code that's unrelated to that changeset. Are
> you saying that without that changeset you can't reproduce at all and with
> it you can 100% of the time? If so, can you try removing just the change in
> qsgen.py from that changeset?
> If that's the changeset that causes it this looks more like a compiler bug.

If I take out the qsgen.py change I get no crash. I can always reproduce this.

Can you please try with Ubuntu 10.04 on your machine? Compile Firefox and run the tests. Please make sure the OS is up-to-date (gcc 4.4.3).

Thank you!

Revision history for this message

In Mozilla Bugzilla #694594, Mihai Sucan (mihai-sucan) wrote on 2011-10-18:

#34

Downloaded the latest clang and llvm sources, built them, then built the latest Firefox from fx-team. No crashes.

It looks like, yes, we can blame gcc 4.4.3 having a bug.

Revision history for this message

In Mozilla Bugzilla #694594, Peterv (peterv) wrote on 2011-10-19:

#35

CC'ing blake, he might have the same OS/compiler combo.

Revision history for this message

In Mozilla Bugzilla #694594, Nigel Babu (nigelbabu) wrote on 2011-12-06:

#36

Hi, I have the same OS/compiler combo and started faced this crash from a few days ago (I was working with an older tree and then updated)

Revision history for this message

In Mozilla Bugzilla #694594, Jhorak (jhorak) wrote on 2012-02-08:

#37

*** Bug 723900 has been marked as a duplicate of this bug. ***

Revision history for this message

Bjorn Christianson (bjorn-k4) wrote on 2012-02-13:

#1

AlsaDevices.txt Edit (759 bytes, text/plain; charset="utf-8")
BootDmesg.txt Edit (69.2 KiB, text/plain; charset="utf-8")
Card0.Amixer.values.txt Edit (1.0 KiB, text/plain; charset="utf-8")
Card0.Codecs.codec.0.txt Edit (6.9 KiB, text/plain; charset="utf-8")
Card1.Codecs.codec.0.txt Edit (906 bytes, text/plain; charset="utf-8")
Card1.Codecs.codec.1.txt Edit (906 bytes, text/plain; charset="utf-8")
Card1.Codecs.codec.2.txt Edit (906 bytes, text/plain; charset="utf-8")
Card1.Codecs.codec.3.txt Edit (906 bytes, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (96.1 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (3.4 KiB, text/plain; charset="utf-8")
Extensions.txt Edit (128 bytes, text/plain; charset="utf-8")
IfupdownConfig.txt Edit (413 bytes, text/plain; charset="utf-8")
IpAddr.txt Edit (996 bytes, text/plain; charset="utf-8")
IwConfig.txt Edit (350 bytes, text/plain; charset="utf-8")
Lspci.txt Edit (23.7 KiB, text/plain; charset="utf-8")
PciMultimedia.txt Edit (1.2 KiB, text/plain; charset="utf-8")
PciNetwork.txt Edit (1.2 KiB, text/plain; charset="utf-8")
Prefs.txt Edit (639 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (6.4 KiB, text/plain; charset="utf-8")
RfKill.txt Edit (182 bytes, text/plain; charset="utf-8")
Themes.txt Edit (132 bytes, text/plain; charset="utf-8")
WifiSyslog.txt Edit (35.4 KiB, text/plain; charset="utf-8")

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-02-13:

#2

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in firefox (Ubuntu):
status:	New → Confirmed

Revision history for this message

Timur I. Davletshin (timur-davletshin) wrote on 2012-02-14:

#3

This bug affects only Ubuntu build (both 10 and 10.0.1). Works OK in official build (both ESR and "standard" releases).

Revision history for this message

Shrenik (shrenik-bhura) wrote on 2012-02-14:

#4

I don't think this is only triggered by firebug. Clicking on Firebug's DOM tab is a sure crasher.

Even with firebug disabled, for e.g. other addons such as Awesome Screeshot from Diigo. Take a screenshot -> click Done -> Close Tab and the browser crashes.

Everytime I am closing the browser, it crashes and notifies to submit a bug report:

Here are some that have been uploaded already -

http://crash-stats.mozilla.com/report/index/bp-6ff8f906-cb26-4864-82ed-31db72120213
http://crash-stats.mozilla.com/report/index/bp-5a9ac084-5c83-42e9-9295-923132120213

Am moving to official build till we see some solution to this as FF is unsuable on Ubuntu as of now.

Revision history for this message

joe (relisys002) wrote on 2012-02-14:

#5

This is definitely not limited to Firebug. To reproduce:

Open the Web Console (Ctrl + Shift + K)
Start typing anything
Watch Firefox crash

It only seems to be a problem with the 64 bit Ubuntu and Mozillateam builds, the build straight from Mozilla is unaffected. Based on my experience and the comments from https://bugzilla.mozilla.org/show_bug.cgi?id=725619 this seems limited to the 64 bit build running on Ubuntu 10.04, but it's possible that 32 bit users on other version of Ubuntu simply haven't reported in.

I was using the Next repo for a while before 11 was stable and this problem cropped up some time before the new year, maybe that'll help you track down the bug. I've tried running the mozregression tool but can't reproduce the problem in any versions with that since it's not a problem in the builds (even nightlies) coming from Mozilla directly.

Like the post above me, I've moved to the official build as the builds from Ubuntu and Mozillateam are completely unusable for anyone doing web development.

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-14:

#38

Download full text (7.2 KiB)

On a build with gcc 4.4.3 (with --disable-jemalloc --enable-valgrind), I see these quite consistently in valgrind after typing in the Web Console:

==1460== Invalid write of size 8
==1460== at 0x8B3349E: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jscntxt.h:2220)
==1460== by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460== by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460== by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460== by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460== by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460== by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460== by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460== by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460== by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)
==1460== by 0x851673F: nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJSClass.cpp:1530)
==1460== by 0x851140E: nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJS.cpp:611)
==1460== Address 0x1ead2338 is 0 bytes after a block of size 8 alloc'd
==1460== at 0x4C274A8: malloc (vg_replace_malloc.c:236)
==1460== by 0x857D3D5: js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long) (Utility.h:166)
==1460== by 0x8B335A2: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (Vector.h:675)
==1460== by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460== by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460== by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460== by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460== by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460== by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460== by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460== by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460== by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)
==1460==
==1460== Invalid write of size 8
==1460== at 0x8B334B0: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jscntxt.h:2220)
==1460== by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)...

On a build with gcc 4.4.3 (with --disable-jemalloc --enable-valgrind), I see these quite consistently in valgrind after typing in the Web Console:

==1460== Invalid write of size 8
==1460==    at 0x8B3349E: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jscntxt.h:2220)
==1460==    by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460==    by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460==    by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460==    by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460==    by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460==    by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460==    by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)
==1460==    by 0x851673F: nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJSClass.cpp:1530)
==1460==    by 0x851140E: nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJS.cpp:611)
==1460==  Address 0x1ead2338 is 0 bytes after a block of size 8 alloc'd
==1460==    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
==1460==    by 0x857D3D5: js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long) (Utility.h:166)
==1460==    by 0x8B335A2: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (Vector.h:675)
==1460==    by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460==    by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460==    by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460==    by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460==    by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460==    by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460==    by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)
==1460== 
==1460== Invalid write of size 8
==1460==    at 0x8B334B0: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jscntxt.h:2220)
==1460==    by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460==    by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460==    by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460==    by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460==    by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460==    by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460==    by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)
==1460==    by 0x851673F: nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJSClass.cpp:1530)
==1460==    by 0x851140E: nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJS.cpp:611)
==1460==  Address 0x1ead28c0 is not stack'd, malloc'd or (recently) free'd
==1460== 
==1460== Invalid write of size 8
==1460==    at 0x8B334FC: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jswrapper.cpp:679)
==1460==    by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460==    by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460==    by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460==    by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460==    by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460==    by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460==    by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)
==1460==    by 0x851673F: nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJSClass.cpp:1530)
==1460==    by 0x851140E: nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (XPCWrappedJS.cpp:611)
==1460==  Address 0x1ead2338 is 0 bytes after a block of size 8 alloc'd
==1460==    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
==1460==    by 0x857D3D5: js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long) (Utility.h:166)
==1460==    by 0x8B335A2: js::CrossCompartmentWrapper::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (Vector.h:675)
==1460==    by 0x8ADEBF4: js::Proxy::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) (jsproxy.cpp:860)
==1460==    by 0x8AA4971: js::GetIterator(JSContext*, JSObject*, unsigned int, JS::Value*) (jsiter.cpp:655)
==1460==    by 0x8AA4D1C: js_ValueToIterator(JSContext*, unsigned int, JS::Value*) (jsiter.cpp:789)
==1460==    by 0x8A9282C: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2465)
==1460==    by 0x8A8F33B: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:647)
==1460==    by 0x8A5E244: js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A8F1B6: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:297)
==1460==    by 0x8A8F8C5: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:148)
==1460==    by 0x8A16B9B: JS_CallFunctionValue (jsapi.cpp:5199)

And this in a debug build, I get this before it crashes too:

Assertion failure: mLength + incr <= mCapacity, at ./../../dist/include/js/Vector.h:678

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-14:

#39

Uninlining js::Vector<T,N,AP>::calculateNewCapacity() makes the problem go away, but how come we've only started seeing this issue in Firefox 10? :(

Revision history for this message

In Mozilla Bugzilla #694594, Kai Engert (kaie) wrote on 2012-02-15:

#40

Would you be able to locally build a gcc-4.4.6, and rebuild Firefox with 4.4.6, to see if the bug has already been fixed on the gcc 4.4.x branch?

Revision history for this message

pdescham49 (pdescham49) wrote on 2012-02-15:

#6

This is Totally reproducible in Ubuntu 11.04 as well.

Uninstalled FB
removed my .mozilla profile folder
restarted FireFox
Web Console (Ctrl + Shift + K)

typed in "Print" got to "pri" crash. Dump submitted with this url posted in it's contents:

https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/931637?comments=all

Feel free to contact I work in FF every day.

FF 10
Ubuntu 11.04 64 bit

I can also reproduce via the Web Console (Ctrl + Shift + K)

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-15:

#41

*** Bug 725619 has been marked as a duplicate of this bug. ***

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-15:

#42

Hello Kai,

Yes, the problem still occurs in gcc-4.4.6 too

Revision history for this message

Bjorn Christianson (bjorn-k4) wrote on 2012-02-16:

#7

Note that the bugzilla.org bug

https://bugzilla.mozilla.org/show_bug.cgi?id=725619

was marked a duplicate of this bug

https://bugzilla.mozilla.org/show_bug.cgi?id=694594

which indicates that the problem's root is compiling Firefox 10+ with gcc 4.4.3+. I've little experience with building packages, but it seems a simple fix for the Ubuntu distributions would be to compile with gcc <4.4.3.

Revision history for this message

Timur I. Davletshin (timur-davletshin) wrote on 2012-02-16:

#8

Firefox running on Ubuntu 10.10 also affected by this bug.

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-16:

#43

Download full text (4.1 KiB)

I did some more debugging of this this morning, and here is a summary of what I found:

- js::Vector<long, 8ul, js::TempAllocPolicy>::calculateNewCapacity() doesn't actually appear to be inlined by the compiler in both the working / non-working cases.

- Using JS_NEVER_INLINE for js::Vector<T,N,AP>::calculateNewCapacity() makes the problem go away.

- In the non-working case with gcc-4.4, js::Vector<long, 8ul, js::TempAllocPolicy>::calculateNewCapacity() appears to be completely optimized for the append() case (ie, it completely ignores lengthInc, and just assumes this is always 1). This can be seen by looking at the generated code:

0000000000da3b9a <js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)>:
  da3b9a: 41 54 push %r12
  da3b9c: 48 8d 47 20 lea 0x20(%rdi),%rax
  da3ba0: 55 push %rbp
  da3ba1: 53 push %rbx
  da3ba2: 48 89 fb mov %rdi,%rbx
  da3ba5: 48 83 ec 10 sub $0x10,%rsp
  da3ba9: 48 39 47 08 cmp %rax,0x8(%rdi)

Up until here, %rdi contains our instance pointer, and %rsi contains "incr". 0x8(%rdi) is the pointer to "mBegin" and 0x20(%rdi) is "storage". The last instruction is usingInlineStorage().

da3bad: 48 8b 77 10 mov 0x10(%rdi),%rsi

Y'ouch. This overwrites "incr" with "mLength", which then gets passed to calculateNewCapacity() here:

  da3bb1: 48 8d 54 24 08 lea 0x8(%rsp),%rdx
  da3bb6: 75 68 jne da3c20 <js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)+0x86>
  da3bb8: e8 85 ff ff ff callq da3b42 <T.2961>

%rdx now contains the address of where calculateNewCapacity() will store "newCap"

I'm not sure what this is doing, but it seems to pretty much boil down to "move 0x1 to (%rdx):

0000000000da3b42 <T.2961>:
  da3b42: 48 89 f0 mov %rsi,%rax
  da3b45: 48 83 ec 08 sub $0x8,%rsp
  da3b49: 48 83 c0 01 add $0x1,%rax
  da3b4d: 72 42 jb da3b91 <T.2961+0x4f>
  da3b4f: 48 b9 00 00 00 00 00 movabs $0xf000000000000000,%rcx
  da3b56: 00 00 f0
  da3b59: 48 85 c8 test %rcx,%rax
  da3b5c: 75 33 jne da3b91 <T.2961+0x4f>
  da3b5e: 48 83 f8 01 cmp $0x1,%rax
  da3b62: 41 b8 01 00 00 00 mov $0x1,%r8d
  da3b68: 76 13 jbe da3b7d <T.2961+0x3b>
  da3b6a: 48 0f bd f6 bsr %rsi,%rsi
  da3b6e: b9 3f 00 00 00 mov $0x3f,%ecx
  da3b73: 83 f6 3f xor $0x3f,%esi
  da3b76: 29 f1 sub %esi,%ecx
  da3b78: ff c1 inc %ecx
  da3b7a: 49 d3 e0 shl %cl,%r8
  da3b7d: 4c 89 02 mov %r8,(%rdx)
  da3b80: 48 ba 00 00 00 00 00 movabs $0xf000000000000000,%rdx
  da3b87: 00 00 f0
  da3b8a: b0 01 mov $0x1,%al
  da3b8c: 49 85 d0 test %rdx,%r8
  da3b8f: 74 07 je da3b98 <T.2961+0x56>
...

I did some more debugging of this this morning, and here is a summary of what I found:

- js::Vector<long, 8ul, js::TempAllocPolicy>::calculateNewCapacity() doesn't actually appear to be inlined by the compiler in both the working / non-working cases.

- Using JS_NEVER_INLINE for js::Vector<T,N,AP>::calculateNewCapacity() makes the problem go away.

- In the non-working case with gcc-4.4, js::Vector<long, 8ul, js::TempAllocPolicy>::calculateNewCapacity() appears to be completely optimized for the append() case (ie, it completely ignores lengthInc, and just assumes this is always 1). This can be seen by looking at the generated code:

0000000000da3b9a <js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)>:
  da3b9a:    41 54                    push   %r12
  da3b9c:    48 8d 47 20              lea    0x20(%rdi),%rax
  da3ba0:    55                       push   %rbp
  da3ba1:    53                       push   %rbx
  da3ba2:    48 89 fb                 mov    %rdi,%rbx
  da3ba5:    48 83 ec 10              sub    $0x10,%rsp
  da3ba9:    48 39 47 08              cmp    %rax,0x8(%rdi)

Up until here, %rdi contains our instance pointer, and %rsi contains "incr". 0x8(%rdi) is the pointer to "mBegin" and 0x20(%rdi) is "storage". The last instruction is usingInlineStorage().

da3bad:    48 8b 77 10              mov    0x10(%rdi),%rsi

Y'ouch. This overwrites "incr" with "mLength", which then gets passed to calculateNewCapacity() here:

da3bb1:    48 8d 54 24 08           lea    0x8(%rsp),%rdx
  da3bb6:    75 68                    jne    da3c20 <js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)+0x86>
  da3bb8:    e8 85 ff ff ff           callq  da3b42 <T.2961>

%rdx now contains the address of where calculateNewCapacity() will store "newCap"

I'm not sure what this is doing, but it seems to pretty much boil down to "move 0x1 to (%rdx):

0000000000da3b42 <T.2961>:
  da3b42:    48 89 f0                 mov    %rsi,%rax
  da3b45:    48 83 ec 08              sub    $0x8,%rsp
  da3b49:    48 83 c0 01              add    $0x1,%rax
  da3b4d:    72 42                    jb     da3b91 <T.2961+0x4f>
  da3b4f:    48 b9 00 00 00 00 00     movabs $0xf000000000000000,%rcx
  da3b56:    00 00 f0
  da3b59:    48 85 c8                 test   %rcx,%rax
  da3b5c:    75 33                    jne    da3b91 <T.2961+0x4f>
  da3b5e:    48 83 f8 01              cmp    $0x1,%rax
  da3b62:    41 b8 01 00 00 00        mov    $0x1,%r8d
  da3b68:    76 13                    jbe    da3b7d <T.2961+0x3b>
  da3b6a:    48 0f bd f6              bsr    %rsi,%rsi
  da3b6e:    b9 3f 00 00 00           mov    $0x3f,%ecx
  da3b73:    83 f6 3f                 xor    $0x3f,%esi
  da3b76:    29 f1                    sub    %esi,%ecx
  da3b78:    ff c1                    inc    %ecx
  da3b7a:    49 d3 e0                 shl    %cl,%r8
  da3b7d:    4c 89 02                 mov    %r8,(%rdx)
  da3b80:    48 ba 00 00 00 00 00     movabs $0xf000000000000000,%rdx
  da3b87:    00 00 f0
  da3b8a:    b0 01                    mov    $0x1,%al
  da3b8c:    49 85 d0                 test   %rdx,%r8
  da3b8f:    74 07                    je     da3b98 <T.2961+0x56>
  da3b91:    e8 aa 01 87 ff           callq  613d40 <js::TempAllocPolicy::reportAllocOverflow() const@plt>
  da3b96:    31 c0                    xor    %eax,%eax
  da3b98:    5a                       pop    %rdx
  da3b99:    c3                       retq

Now, we call malloc with 0x1 * 8:

da3bbd:    84 c0                    test   %al,%al
  da3bbf:    0f 84 a0 00 00 00        je     da3c65 <js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)+0xcb>
  da3bc5:    48 8b 6c 24 08           mov    0x8(%rsp),%rbp
  da3bca:    48 c1 e5 03              shl    $0x3,%rbp
  da3bce:    48 89 ef                 mov    %rbp,%rdi
  da3bd1:    e8 aa 6f 87 ff           callq  61ab80 <malloc@plt>

And so, growStorageBy() appears to succeed, yet it has allocated a lot less than the caller thinks. mLength gets incremented by the value of "incr", and then MakeRangeGCSafe() (from js::AutoVectorRooter<long>::growBy()) tramples all over the end of the buffer.

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-16:

#44

Created attachment 597962
js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy() assembly with gcc-4.4

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-16:

#45

Created attachment 597963
js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy() assembly with gcc-4.6

Revision history for this message

In Mozilla Bugzilla #694594, Kai Engert (kaie) wrote on 2012-02-17:

#46

If you were able to come up with a minimal testcase, you could report it as a bug at http://gcc.gnu.org/bugzilla/enter_bug.cgi?product=gcc

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-20:

#47

I'm not convinced this is a compiler bug at all now. The implementation of js::Vector<long, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long) in jswrapper.o looks correct, and is actually perfectly ok. The issue is that another implementation of this is getting linked in to the final .so instead (from js/xpconnect/src/dombindings.o, which is also using js::AutoIdVector - see dombindings.cpp). This implementation is optimized differently because it only uses js::AutoIdVector::append(), which explains my finding in comment 19.

This also explains comment 5.

I imagine that it's just pure luck that this works with newer gcc versions...

Revision history for this message

In Mozilla Bugzilla #694594, Stransky (stransky) wrote on 2012-02-22:

#48

Actually it may be a gcc bug after all, because the growStorageBy() from dombindings.cpp are hidden/local so they should not be linked to final .so:

$objdump -t dombindings.o | grep growStorageBy | c++filt
0000000000000000 l d .text._ZN2js6VectorI4jsidLm8ENS_15TempAllocPolicyEE13growStorageByEm 0000000000000000 .text._ZN2js6VectorI4jsidLm8ENS_15TempAllocPolicyEE13growStorageByEm

0000000000000000 w F .text._ZN2js6VectorI4jsidLm8ENS_15TempAllocPolicyEE13growStorageByEm 00000000000001d1 .hidden js::Vector<jsid, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-22:

#49

Actually, that is showing that it is a weak symbol rather than a local symbol (which is what I see).

Revision history for this message

In Mozilla Bugzilla #694594, Stransky (stransky) wrote on 2012-02-22:

#50

(In reply to Chris Coulson from comment #25)
> Actually, that is showing that it is a weak symbol rather than a local
> symbol (which is what I see).

Yeah, but the weak symbol is .hidden so it should be ignored by linker.

Revision history for this message

In Mozilla Bugzilla #694594, Chris Coulson (chrisccoulson) wrote on 2012-02-22:

#51

Not quite. hidden just means that the symbol isn't exported in the public API of libxul

Revision history for this message

In Mozilla Bugzilla #694594, Stransky (stransky) wrote on 2012-02-22:

#52

Yeah. BTW. with gcc-4.4.x, the js::Vector<jsid, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long) is linked in libxul.so (RHEL6)

$ objdump -t libxul.so | grep _ZN2js6VectorI4jsidLm8ENS_15TempAllocPolicyEE13growStorageByEm

0000000001094d9a l F .text 00000000000001d1
js::Vector<jsid, 8ul, js::TempAllocPolicy>::growStorageBy(unsigned long)

but with gcc 4.6.1 it's completely optimized away (Fedora15):

$ objdump -t /usr/lib64/xulrunner-2/libxul.so | grep _ZN2js6VectorI4jsidLm8ENS_15TempAllocPolicyEE13growStorageByEm

Revision history for this message

In Mozilla Bugzilla #694594, Stransky (stransky) wrote on 2012-02-24:

#53

Created attachment 600326
workaround based on comment 15

Revision history for this message

clemenstimpler (mir-faellt-gar-nix-ein) wrote on 2012-02-25:

#9

This bug is not limited to Firebug. It concerns Zotero, too: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/940776

Revision history for this message

Xavier Robin (jti-533g) wrote on 2012-02-27:

#10

I can reproduce this crash nearly each time I save a reference from the address bar with Zotero.
I have a bunch of Firefox crash reports if needed.

Revision history for this message

In Mozilla Bugzilla #694594, Stransky (stransky) wrote on 2012-02-29:

#54

Confirmed as a gcc 4.4 bug:

http://gcc.gnu.org/PR52430
https://bugzilla.redhat.com/show_bug.cgi?id=784048#c9

the latter contains a workaround.

Revision history for this message

In Mozilla Bugzilla #694594, Mh+mozilla (mh+mozilla) wrote on 2012-02-29:

#55

(In reply to Martin Stránský from comment #30)
> Confirmed as a gcc 4.4 bug:
>
> http://gcc.gnu.org/PR52430
> https://bugzilla.redhat.com/show_bug.cgi?id=784048#c9
>
> the latter contains a workaround.

You are not authorized to access bug #784048. To see this bug, you must first log in to an account with the appropriate permissions.

Revision history for this message

Tom (tom-lorinthe) wrote on 2012-03-01:

#11

Same for me: Ubuntu 10.10 / FF10 - 100% crash on Firebug, Web Console and others.

Matthias Klose (doko) on 2012-03-08

Changed in firefox (Ubuntu Natty):
status:	New → Invalid
Changed in firefox (Ubuntu Oneiric):
status:	New → Invalid

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-08:

#12

This bug was fixed in the package gcc-4.4 - 4.4.6-15ubuntu1

---------------
gcc-4.4 (4.4.6-15ubuntu1) precise; urgency=low

* Merge with Debian.

gcc-4.4 (4.4.6-15) unstable; urgency=low

  * Update to SVN 20120308 from the gcc-4_4-branch (r185107).
    - Fix PR tree-optimization/52430 (LP: #931637), PR target/52408 (hppa),
      PR target/51408, PR target/51393 (x86 avx), PR c++/51344.
  * gdc-4.4: Provide <gnu-triplet>-{gdc,gdmd}-4.4 symlinks.

gcc-4.4 (4.4.6-14) unstable; urgency=low

* Fix passing the dynamic linker on armel.
-- Matthias Klose <email address hidden> Thu, 08 Mar 2012 20:02:02 +0100

Changed in gcc-4.4 (Ubuntu):
status:	New → Fix Released

Revision history for this message

Matthias Klose (doko) wrote on 2012-03-08:

#13

packages for lucid and maverick building in the ubuntu-toolchain-r/glibc ppa. binaries can be copied after checking the test-summary for regressions.

Jamie Strandboge (jdstrand) on 2012-03-09

Changed in gcc-4.4 (Ubuntu Natty):
status:	New → Invalid

Revision history for this message

mmalmeida (mmalmeida) wrote on 2012-03-13:

#14

Matthias Klose: does that mean packages will be added to the updates in lucid/maverick?

I've just confirmed the presence of this bug in Maverick with Firefox 10.0.2-ubuntu.

1) Start firefox
2) Open the console tab in firebug
3) write "self"
4) Firefox crashes.

I've tested with a clean Firefox 10.0.2 version from Mozilla's website and the problem isn't there, which means this is definitely an issue with Ubuntu's Firefox version.

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2012-03-13:

#15

It will be fixed in the next update

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-15:

#16

This bug was fixed in the package gcc-4.4 - 4.4.3-4ubuntu5.1

---------------
gcc-4.4 (4.4.3-4ubuntu5.1) lucid; urgency=low

* Fix PR tree-optimization/52430, taken from the 4.4 branch. LP: #931637.
-- Matthias Klose <email address hidden> Thu, 08 Mar 2012 20:34:00 +0100

Changed in gcc-4.4 (Ubuntu Lucid):
status:	New → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-15:

#17

This bug was fixed in the package gcc-4.4 - 4.4.4-14ubuntu5.1

---------------
gcc-4.4 (4.4.4-14ubuntu5.1) maverick; urgency=low

* Fix PR tree-optimization/52430, taken from the 4.4 branch. LP: #931637.
-- Matthias Klose <email address hidden> Thu, 08 Mar 2012 20:44:24 +0100

Changed in gcc-4.4 (Ubuntu Maverick):
status:	New → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-15:

#18

Download full text (4.4 KiB)

This bug was fixed in the package firefox - 11.0+build1-0ubuntu0.10.04.2

---------------
firefox (11.0+build1-0ubuntu0.10.04.2) lucid; urgency=low

* New upstream stable release (FIREFOX_11_0_BUILD1)
- see LP: #951250 for USN information

  * Rebuilt against updated gcc to fix LP: #931637
  * Ensure that the crash reporter is disabled if rebuilt by Ubuntu
    derivatives, as there will be no crash symbols for those
    - update debian/rules
  * Only add "Ubuntu" to the UA string when being built for Ubuntu
    - update debian/rules
  * Temporarily disable ipdl tests due to build failures. These aren't
    enabled upstream, anyway
    - update debian/config/mozconfig.in
  * Always set the update channel - not setting it at build-time on release
    builds breaks the extensions.checkCompatibility pref. The only things
    using it at runtime are nsBlocklistService, Test Pilot (beta + aurora)
    and the about dialog (where the channel is hidden anyway)
    - update debian/rules
    - update debian/firefox.install.in
  * Fix LP: #898883 - IPC xpcshell tests hang the buildd's. Give all
    xpcshell tests an X display, as plugin-container won't work without one
    - update debian/build/testsuite.mk
  * Turn on all IPC xpcshell tests again
    - update debian/build/testsute.mk
  * Drop the default-apps xml file - there is already one provided by
    gnome-control-center, so ours duplicates this. We never used to install
    it for Firefox 3.6
    - remove debian/firefox.xml.in
    - update debian/firefox-gnome-support.install.in
    - update debian/rules
  * Ship Test Pilot as a distribution addon, like upstream. This means
    that the addon manager can update it. It does also mean that it will
    remain installed in users profiles if they try the beta or aurora
    builds, but the Feedback button is disabled on release builds
    - update debian/firefox.install.in
    - fixes LP: #913357
  * Drop patches fixed upstream
    - remove debian/patches/fix-cursor-handling.patch
    - update debian/patches/series
  * Call xvfb-run with "-a" in case there are other servers running on the
    builder
    - update debian/build/testsuite.mk
  * Really fix LP: #898883 - IPC xpcshell tests hang the build. What was
    actually happening is plugin-container would fail to start because all
    available X connections had been used up by many instances of dbus-launch,
    spawned each time an xpcshell tried to talk to the session bus. Because
    we run all of the xpcshell tests with one Xvfb instance, the buses
    accumulate until the available X connections all run out. To fix this, run
    all tests requiring a display inside dbus-launch, so we create just a
    single bus for all xpcshell tests
    - update debian/build/testsuite.mk
    - update debian/control{,.in}
  * Add Ligurian to locale blacklist, as we don't support this in Ubuntu
    - update debian/config/locales.blacklist
  * Fix LP: #918763 - Revert the temporary investigation patch for
    bmo: #621446, as it breaks GCC4.4
    - add debian/patches/revert-bmo621446-investigation.patch
    - update debian/patches/series
  * Refresh patches
    - update debian/patches/ubuntu-ua-string-chan...

This bug was fixed in the package firefox - 11.0+build1-0ubuntu0.10.04.2

---------------
firefox (11.0+build1-0ubuntu0.10.04.2) lucid; urgency=low

* New upstream stable release (FIREFOX_11_0_BUILD1)
    - see LP: #951250 for USN information

* Rebuilt against updated gcc to fix LP: #931637
  * Ensure that the crash reporter is disabled if rebuilt by Ubuntu
    derivatives, as there will be no crash symbols for those
    - update debian/rules
  * Only add "Ubuntu" to the UA string when being built for Ubuntu
    - update debian/rules
  * Temporarily disable ipdl tests due to build failures. These aren't
    enabled upstream, anyway
    - update debian/config/mozconfig.in
  * Always set the update channel - not setting it at build-time on release
    builds breaks the extensions.checkCompatibility pref. The only things
    using it at runtime are nsBlocklistService, Test Pilot (beta + aurora)
    and the about dialog (where the channel is hidden anyway)
    - update debian/rules
    - update debian/firefox.install.in
  * Fix LP: #898883 - IPC xpcshell tests hang the buildd's. Give all
    xpcshell tests an X display, as plugin-container won't work without one
    - update debian/build/testsuite.mk
  * Turn on all IPC xpcshell tests again
    - update debian/build/testsute.mk
  * Drop the default-apps xml file - there is already one provided by
    gnome-control-center, so ours duplicates this. We never used to install
    it for Firefox 3.6
    - remove debian/firefox.xml.in
    - update debian/firefox-gnome-support.install.in
    - update debian/rules
  * Ship Test Pilot as a distribution addon, like upstream. This means
    that the addon manager can update it. It does also mean that it will
    remain installed in users profiles if they try the beta or aurora
    builds, but the Feedback button is disabled on release builds
    - update debian/firefox.install.in
    - fixes LP: #913357
  * Drop patches fixed upstream
    - remove debian/patches/fix-cursor-handling.patch
    - update debian/patches/series
  * Call xvfb-run with "-a" in case there are other servers running on the
    builder
    - update debian/build/testsuite.mk
  * Really fix LP: #898883 - IPC xpcshell tests hang the build. What was
    actually happening is plugin-container would fail to start because all
    available X connections had been used up by many instances of dbus-launch,
    spawned each time an xpcshell tried to talk to the session bus. Because
    we run all of the xpcshell tests with one Xvfb instance, the buses
    accumulate until the available X connections all run out. To fix this, run
    all tests requiring a display inside dbus-launch, so we create just a
    single bus for all xpcshell tests
    - update debian/build/testsuite.mk
    - update debian/control{,.in}
  * Add Ligurian to locale blacklist, as we don't support this in Ubuntu
    - update debian/config/locales.blacklist
  * Fix LP: #918763 - Revert the temporary investigation patch for
    bmo: #621446, as it breaks GCC4.4
    - add debian/patches/revert-bmo621446-investigation.patch
    - update debian/patches/series
  * Refresh patches
    - update debian/patches/ubuntu-ua-string-changes.patch
    - update debian/patches/mozilla-kde.patch
    - update debian/patches/firefox-kde.patch
  * Fix LP: #915895 - Just set autoDisableScopes to 0. Other distributions
    are already doing this, and we already made this feature pretty much
    useless by allowing extensions in the application directory, so that our
    language packs aren't disabled by default
    - update debian/vendor.js
  * Drop the solid white separators from the addressbar autocomplete dropdown,
    and increase padding so that it doesn't look so bad with dark themes
    - add debian/patches/autocomplete-theme-tweak.patch
    - update debian/patches/series
  * Fix LP: #926495 - Add patch based on one from bmo: #691898 to enable
    building on ppc again
    - add debian/patches/fix-build-failure-without-yarr-jit.patch
    - update debian/patches/series
  * Fix LP: #926495 - Disable the SPS profiler on unsupported architectures
    - add debian/patches/no-sps-profiler-on-unsupported-archs.patch
    - update debian/patches/series
  * Add a missing include in gfx/angle/src/compiler/Types.h (backported
    from Aurora)
    - add debian/patches/fix-missing-stl-include-in-angle.patch
    - update debian/patches/series
 -- Chris Coulson <chris.coulson@canonical.com>   Sat, 10 Mar 2012 19:28:01 +0000

Changed in firefox (Ubuntu Lucid):
status:	New → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-15:

#19

Download full text (4.4 KiB)

This bug was fixed in the package firefox - 11.0+build1-0ubuntu0.10.10.2

---------------
firefox (11.0+build1-0ubuntu0.10.10.2) maverick-security; urgency=low

* New upstream stable release (FIREFOX_11_0_BUILD1)
- see LP: #951250 for USN information

  * Rebuilt against updated gcc to fix LP: #931637
  * Ensure that the crash reporter is disabled if rebuilt by Ubuntu
    derivatives, as there will be no crash symbols for those
    - update debian/rules
  * Only add "Ubuntu" to the UA string when being built for Ubuntu
    - update debian/rules
  * Temporarily disable ipdl tests due to build failures. These aren't
    enabled upstream, anyway
    - update debian/config/mozconfig.in
  * Always set the update channel - not setting it at build-time on release
    builds breaks the extensions.checkCompatibility pref. The only things
    using it at runtime are nsBlocklistService, Test Pilot (beta + aurora)
    and the about dialog (where the channel is hidden anyway)
    - update debian/rules
    - update debian/firefox.install.in
  * Fix LP: #898883 - IPC xpcshell tests hang the buildd's. Give all
    xpcshell tests an X display, as plugin-container won't work without one
    - update debian/build/testsuite.mk
  * Turn on all IPC xpcshell tests again
    - update debian/build/testsute.mk
  * Drop the default-apps xml file - there is already one provided by
    gnome-control-center, so ours duplicates this. We never used to install
    it for Firefox 3.6
    - remove debian/firefox.xml.in
    - update debian/firefox-gnome-support.install.in
    - update debian/rules
  * Ship Test Pilot as a distribution addon, like upstream. This means
    that the addon manager can update it. It does also mean that it will
    remain installed in users profiles if they try the beta or aurora
    builds, but the Feedback button is disabled on release builds
    - update debian/firefox.install.in
    - fixes LP: #913357
  * Drop patches fixed upstream
    - remove debian/patches/fix-cursor-handling.patch
    - update debian/patches/series
  * Call xvfb-run with "-a" in case there are other servers running on the
    builder
    - update debian/build/testsuite.mk
  * Really fix LP: #898883 - IPC xpcshell tests hang the build. What was
    actually happening is plugin-container would fail to start because all
    available X connections had been used up by many instances of dbus-launch,
    spawned each time an xpcshell tried to talk to the session bus. Because
    we run all of the xpcshell tests with one Xvfb instance, the buses
    accumulate until the available X connections all run out. To fix this, run
    all tests requiring a display inside dbus-launch, so we create just a
    single bus for all xpcshell tests
    - update debian/build/testsuite.mk
    - update debian/control{,.in}
  * Add Ligurian to locale blacklist, as we don't support this in Ubuntu
    - update debian/config/locales.blacklist
  * Fix LP: #918763 - Revert the temporary investigation patch for
    bmo: #621446, as it breaks GCC4.4
    - add debian/patches/revert-bmo621446-investigation.patch
    - update debian/patches/series
  * Refresh patches
    - update debian/patches/ubuntu-ua...

This bug was fixed in the package firefox - 11.0+build1-0ubuntu0.10.10.2

---------------
firefox (11.0+build1-0ubuntu0.10.10.2) maverick-security; urgency=low

* New upstream stable release (FIREFOX_11_0_BUILD1)
    - see LP: #951250 for USN information

* Rebuilt against updated gcc to fix LP: #931637
  * Ensure that the crash reporter is disabled if rebuilt by Ubuntu
    derivatives, as there will be no crash symbols for those
    - update debian/rules
  * Only add "Ubuntu" to the UA string when being built for Ubuntu
    - update debian/rules
  * Temporarily disable ipdl tests due to build failures. These aren't
    enabled upstream, anyway
    - update debian/config/mozconfig.in
  * Always set the update channel - not setting it at build-time on release
    builds breaks the extensions.checkCompatibility pref. The only things
    using it at runtime are nsBlocklistService, Test Pilot (beta + aurora)
    and the about dialog (where the channel is hidden anyway)
    - update debian/rules
    - update debian/firefox.install.in
  * Fix LP: #898883 - IPC xpcshell tests hang the buildd's. Give all
    xpcshell tests an X display, as plugin-container won't work without one
    - update debian/build/testsuite.mk
  * Turn on all IPC xpcshell tests again
    - update debian/build/testsute.mk
  * Drop the default-apps xml file - there is already one provided by
    gnome-control-center, so ours duplicates this. We never used to install
    it for Firefox 3.6
    - remove debian/firefox.xml.in
    - update debian/firefox-gnome-support.install.in
    - update debian/rules
  * Ship Test Pilot as a distribution addon, like upstream. This means
    that the addon manager can update it. It does also mean that it will
    remain installed in users profiles if they try the beta or aurora
    builds, but the Feedback button is disabled on release builds
    - update debian/firefox.install.in
    - fixes LP: #913357
  * Drop patches fixed upstream
    - remove debian/patches/fix-cursor-handling.patch
    - update debian/patches/series
  * Call xvfb-run with "-a" in case there are other servers running on the
    builder
    - update debian/build/testsuite.mk
  * Really fix LP: #898883 - IPC xpcshell tests hang the build. What was
    actually happening is plugin-container would fail to start because all
    available X connections had been used up by many instances of dbus-launch,
    spawned each time an xpcshell tried to talk to the session bus. Because
    we run all of the xpcshell tests with one Xvfb instance, the buses
    accumulate until the available X connections all run out. To fix this, run
    all tests requiring a display inside dbus-launch, so we create just a
    single bus for all xpcshell tests
    - update debian/build/testsuite.mk
    - update debian/control{,.in}
  * Add Ligurian to locale blacklist, as we don't support this in Ubuntu
    - update debian/config/locales.blacklist
  * Fix LP: #918763 - Revert the temporary investigation patch for
    bmo: #621446, as it breaks GCC4.4
    - add debian/patches/revert-bmo621446-investigation.patch
    - update debian/patches/series
  * Refresh patches
    - update debian/patches/ubuntu-ua-string-changes.patch
    - update debian/patches/mozilla-kde.patch
    - update debian/patches/firefox-kde.patch
  * Fix LP: #915895 - Just set autoDisableScopes to 0. Other distributions
    are already doing this, and we already made this feature pretty much
    useless by allowing extensions in the application directory, so that our
    language packs aren't disabled by default
    - update debian/vendor.js
  * Drop the solid white separators from the addressbar autocomplete dropdown,
    and increase padding so that it doesn't look so bad with dark themes
    - add debian/patches/autocomplete-theme-tweak.patch
    - update debian/patches/series
  * Fix LP: #926495 - Add patch based on one from bmo: #691898 to enable
    building on ppc again
    - add debian/patches/fix-build-failure-without-yarr-jit.patch
    - update debian/patches/series
  * Fix LP: #926495 - Disable the SPS profiler on unsupported architectures
    - add debian/patches/no-sps-profiler-on-unsupported-archs.patch
    - update debian/patches/series
  * Add a missing include in gfx/angle/src/compiler/Types.h (backported
    from Aurora)
    - add debian/patches/fix-missing-stl-include-in-angle.patch
    - update debian/patches/series
 -- Chris Coulson <chris.coulson@canonical.com>   Sat, 10 Mar 2012 19:25:32 +0000

Changed in firefox (Ubuntu Maverick):
status:	New → Fix Released

Revision history for this message

clemenstimpler (mir-faellt-gar-nix-ein) wrote on 2012-03-16:

#20

Build 11.0+build1-0ubuntu0.10.04.2 fixes the bug for me - thanks a lot for the quick fix!

Revision history for this message

In Mozilla Bugzilla #694594, Matt (mdinger-bugzilla) wrote on 2012-03-16:

#56

Gcc states this is fixed for 4.4.7 and launchpad also states fixed because of gcc's fix but I still see the crash with firefox 11 in ubuntu. Is anyone else still seeing this? I expected it would be fixed with the gcc fix.

See bug 725619 for context regarding ubuntu and this crash.

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52430
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/931637

Revision history for this message

In Mozilla Bugzilla #694594, Mozilla-bugs-micahscomputing (mozilla-bugs-micahscomputing) wrote on 2012-03-16:

#57

Which version of Firefox 11 on Ubuntu are you seeing this with? We've already had a report of someone experiencing a crash that's now fixed.

Revision history for this message

mmalmeida (mmalmeida) wrote on 2012-03-16:

#21

Unfortunately the bug wasn't fixed with the most recent update.

I've just tested it and got a firefox crash twice. You can see the crash reports in:

https://crash-stats.mozilla.com/report/index/8aecb253-e6ea-475c-9d06-d03152120316
https://crash-stats.mozilla.com/report/index/2064d731-18ad-446a-adb8-ca1202120316

Revision history for this message

mmalmeida (mmalmeida) wrote on 2012-03-16:

#22

Also, the steps described in comment #6 produced the crash with the report https://crash-stats.mozilla.com/report/pending/144d8eee-0384-4766-bdd7-d88942120316

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2012-03-16:

#23

I just tested it and it works fine here. Perhaps you're experiencing a different issue? I even disassembled the new binary and the issue I found, as detailed on the upstream bug report ,appears to be fixed now.

Bug Watch Updater (bug-watch-updater) on 2012-03-16

Changed in firefox:
importance:	Unknown → Critical
status:	Unknown → Confirmed

Revision history for this message

mmalmeida (mmalmeida) wrote on 2012-03-16:

#58

@Chris: like I said, I've tried out the test case described in https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/931637/comments/6 and the result is the crash. So the consequence of the crash is the same. I don't know if the origin is...

Revision history for this message

mmalmeida (mmalmeida) wrote on 2012-03-16:

#59

In addition, on the same machine, if I run a clean firefox downloaded from mozilla's site (ie, unpackage it to a directory and running it from the command line with " ./firefox -p testeBugs -no-remote") I get no crash following comment #6's test case.

Revision history for this message

In Mozilla Bugzilla #694594, Matt (mdinger-bugzilla) wrote on 2012-03-17:

#60

Yes but apparently it is not fixed for everyone. Oddly, I see the crash on all web pages ("www.google.com") except some built in pages such as "about:crashes".

I did successfully build a standard firefox build from hg tip locally and it did not crash. I used gcc 4.4.4-14ubuntu5.1 which had the gcc fix included so I am not sure why the mozillateam build does not work properly.

I was going to check further but my computer overheats when compiling so I will leave it as is.

Firefox 11
Ubuntu 10.10
mozillateam
firefox-stable

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-20:

#61

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gcc-4.4 (Ubuntu Oneiric):
status:	New → Confirmed

Revision history for this message

Alexey Molchanov (alexey-molchanov) wrote on 2012-03-20:

#62

I've to support @wild_oscar, latest updates didn't solve the problem for me.
Now I'm using firefox 11.0+build1-0ubuntu0.10.10.2 on Ubuntu 10.10 x86_64 and firefox still crashes each time I try test case described at https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/931637/comments/6 , see my latest crash report at https://crash-stats.mozilla.com/report/index/04a7ded2-29e7-4e6f-b200-23de52120320.
Also firefox crashes almost instantly after switching to the DOM tab in Firebug, so recent updates didn't improve anything related to this bug.

Revision history for this message

In Mozilla Bugzilla #694594, Dhylands-i (dhylands-i) wrote on 2012-04-19:

#63

I'm seeing the same problem with the 4.4.3 ARM compiler. I only see the problem in debug builds. I'm seeing the problem in B2G, and its 100% reproducible.

The following JavaScript triggers the JS_ASSERT(mLength <= mReserved); in the Vector<T,N,AP>::reserve(size_t request) function.

<pre>
28: function getSdkVersion() {
29: Cu.import("resource://gre/modules/ctypes.jsm");
30: try {
31: let cutils = ctypes.open("libcutils.so");
32: let cbuf = ctypes.char.array(4096)();
33: let c_property_get = cutils.declare("property_get", ctypes.default_abi,
34: ctypes.int, // return value: length
35: ctypes.char.ptr, // key
36: ctypes.char.ptr, // value
37: ctypes.char.ptr); // default
38: let property_get = function (key, defaultValue) {
39: if (defaultValue === undefined) {
40: defaultValue = null;
41: }
42: c_property_get(key, cbuf, defaultValue);
43: return cbuf.readString();
44: }
45: return parseInt(property_get("ro.build.version.sdk"));
46: } catch(e) {
47: // Eat it. Hopefully we're on a non-Gonk system ...
48: //
49: // XXX we should check that
50: return 0;
51: }
52: }
</pre>

and the JSStack looks like:

<pre>
(gdb) call DumpJSStack()
0 getSdkVersion() ["jar:file:///system/b2g/omni.ja!/components/WifiWorker.js":37]
    this = undefined
1 anonymous() ["jar:file:///system/b2g/omni.ja!/components/WifiWorker.js":54]
    this = undefined
2 <TOP LEVEL> ["jar:file:///system/b2g/omni.ja!/components/WifiWorker.js":27]
    this = [object BackstagePass @ 0x41b11200 (native @ 0x40a62fc4)]
</pre>

Revision history for this message

Ben Turner (ben-turner) wrote on 2012-04-23:

#64

Also getting this problem for a long time now (and still ongoing) with Ubuntu 10.10 (Maverick) and FF9,10 & 11

I'm running firefox 11.0+build1-0ubuntu0.10.10.2 on on Ubuntu 10.10 x86_64 and can crash firefox by typing:
* CTRL+SHIFT+K
* print

It crashes everytime when I get to "i", as also noted by @pdescham49

Revision history for this message

mmalmeida (mmalmeida) wrote on 2012-05-04:

#65

I have the following packages in Maverick 10.10:

firefox 11.0+build1-0ubuntu0.10.10.2
gcc 4:4.4.4-1ubuntu2

I still see this issue, so the fix doesn't seem to be working.

Any update on the subject?

Revision history for this message

In Mozilla Bugzilla #694594, Dhylands-i (dhylands-i) wrote on 2012-06-11:

#66

Created attachment 632053
Workaround which only affects DEBUG builds

This is a slightly different workaround which only affects DEBUG builds.

Revision history for this message

In Mozilla Bugzilla #694594, R-luke-h (r-luke-h) wrote on 2012-06-11:

#67

Comment on attachment 632053
Workaround which only affects DEBUG builds

Review of attachment 632053:
-----------------------------------------------------------------

::: js/public/Vector.h
@@ +565,5 @@
> STATIC_POSTCONDITION(!return || newCap >= curLength + lengthInc)
> +#ifdef DEBUG
> +// By making this method not inline for debug builds, it sidesteps
> +// the compiler generating incorrect code. See bug 694594.
> +JS_NEVER_INLINE bool

Surrounding comments use /* */. Also, I think you could say, more succinctly:

/* ARM compiler bug workaround, see bug 694594. */

Revision history for this message

In Mozilla Bugzilla #694594, Dhylands-i (dhylands-i) wrote on 2012-06-12:

#68

Created attachment 632144
Workaround which only affects DEBUG builds v2

Redid comment. The problem actually affects both ARM and x86

Revision history for this message

In Mozilla Bugzilla #694594, Ryanvm (ryanvm) wrote on 2012-06-12:

#69

https://hg.mozilla.org/integration/mozilla-inbound/rev/b9cf42e0e76d

Revision history for this message

In Mozilla Bugzilla #694594, Bmo-edmorley (bmo-edmorley) wrote on 2012-06-13:

#70

https://hg.mozilla.org/mozilla-central/rev/b9cf42e0e76d

Bug Watch Updater (bug-watch-updater) on 2012-06-14

Changed in firefox:
status:	Confirmed → Fix Released

Revision history for this message

pdescham49 (pdescham49) wrote on 2012-06-14: Re: [Bug 931637] Re: Firefox 10.0.1 crashes when trying to enter a command on the Web Console

#71

Download full text (5.6 KiB)

I still get intermittent crashes In FF 9-11 on ubuntu when I play with the
dom inspector. Granted it's in Firebug I'll see if I can get it to crash
with some of the native FF debugging tools.

Paul

On Sun, Apr 22, 2012 at 10:22 PM, Ben Turner <email address hidden>wrote:

> Also getting this problem for a long time now (and still ongoing) with
> Ubuntu 10.10 (Maverick) and FF9,10 & 11
>
> I'm running firefox 11.0+build1-0ubuntu0.10.10.2 on on Ubuntu 10.10 x86_64
> and can crash firefox by typing:
> * CTRL+SHIFT+K
> * print
>
> It crashes everytime when I get to "i", as also noted by @pdescham49
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/931637
>
> Title:
> Firefox 10.0.1 crashes when trying to enter a command on the Web
> Console
>
> Status in The Mozilla Firefox Browser:
> Confirmed
> Status in “firefox” package in Ubuntu:
> Confirmed
> Status in “gcc-4.4” package in Ubuntu:
> Fix Released
> Status in “firefox” source package in Lucid:
> Fix Released
> Status in “gcc-4.4” source package in Lucid:
> Fix Released
> Status in “firefox” source package in Maverick:
> Fix Released
> Status in “gcc-4.4” source package in Maverick:
> Fix Released
> Status in “firefox” source package in Natty:
> Invalid
> Status in “gcc-4.4” source package in Natty:
> Invalid
> Status in “firefox” source package in Oneiric:
> Invalid
> Status in “gcc-4.4” source package in Oneiric:
> Confirmed
>
> Bug description:
> Bug first appeared last week after updating to Firefox 10 using
> Synaptic. Original symptom was crashing Firefox when navigating a site
> I'm developing (which logs a lot to console in development
> environment). Further discovery indicated that I could crash Firefox
> by clicking on the DOM tab in Firebug. At that point, I re-installed
> Firefox, created a new profile, re-installed Firebug and could still
> reproduce the crash. I created a new user on my system, repeated the
> prior steps, same result. After some searching, I found these
> discussions:
>
>
> http://groups.google.com/group/firebug/browse_thread/thread/bfb5a8b038ef2328/65171984c28775a1?show_docid=65171984c28775a1#
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=725619
>
> At which point, I tried simply opening the Web Console and typing
> print, which would crash the browser before finishing typing the
> command, even with a clean install and no plug-ins.
>
> ProblemType: Bug
> DistroRelease: Ubuntu 10.04
> Package: firefox 10.0.1+build1-0ubuntu0.10.04.1
> ProcVersionSignature: Ubuntu 2.6.32-38.83-generic 2.6.32.52+drm33.21
> Uname: Linux 2.6.32-38-generic x86_64
> NonfreeKernelModules: nvidia
> AddonCompatCheckDisabled: False
> AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21.
> AplayDevices:
> **** List of PLAYBACK Hardware Devices ****
> card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
> Subdevices: 1/1
> Subdevice #0: subdevice #0
> Architecture: amd64
> ArecordDevices:
> **** List of CAPTURE Hardware Devices ****
> card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
> Subdevices: 1/1
> Subde...

I still get intermittent crashes In FF 9-11 on ubuntu when I play with the
dom inspector. Granted it's in Firebug I'll see if I can get it to crash
with some of the native FF debugging tools.

Paul

On Sun, Apr 22, 2012 at 10:22 PM, Ben Turner <931637@bugs.launchpad.net>wrote:

> Also getting this problem for a long time now (and still ongoing) with
> Ubuntu 10.10 (Maverick) and FF9,10 & 11
>
> I'm running firefox 11.0+build1-0ubuntu0.10.10.2 on on Ubuntu 10.10 x86_64
> and can crash firefox by typing:
> * CTRL+SHIFT+K
> * print
>
> It crashes everytime when I get to "i", as also noted by @pdescham49
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/931637
>
> Title:
>  Firefox 10.0.1 crashes when trying to enter a command on the Web
>  Console
>
> Status in The Mozilla Firefox Browser:
>  Confirmed
> Status in “firefox” package in Ubuntu:
>  Confirmed
> Status in “gcc-4.4” package in Ubuntu:
>  Fix Released
> Status in “firefox” source package in Lucid:
>  Fix Released
> Status in “gcc-4.4” source package in Lucid:
>  Fix Released
> Status in “firefox” source package in Maverick:
>  Fix Released
> Status in “gcc-4.4” source package in Maverick:
>  Fix Released
> Status in “firefox” source package in Natty:
>  Invalid
> Status in “gcc-4.4” source package in Natty:
>  Invalid
> Status in “firefox” source package in Oneiric:
>  Invalid
> Status in “gcc-4.4” source package in Oneiric:
>  Confirmed
>
> Bug description:
>  Bug first appeared last week after updating to Firefox 10 using
>  Synaptic. Original symptom was crashing Firefox when navigating a site
>  I'm developing (which logs a lot to console in development
>  environment). Further discovery indicated that I could crash Firefox
>  by clicking on the DOM tab in Firebug. At that point, I re-installed
>  Firefox, created a new profile, re-installed Firebug and could still
>  reproduce the crash. I created a new user on my system, repeated the
>  prior steps, same result. After some searching, I found these
>  discussions:
>
>
> http://groups.google.com/group/firebug/browse_thread/thread/bfb5a8b038ef2328/65171984c28775a1?show_docid=65171984c28775a1#
>
>  https://bugzilla.mozilla.org/show_bug.cgi?id=725619
>
>  At which point, I tried simply opening the Web Console and typing
>  print, which would crash the browser before finishing typing the
>  command, even with a clean install and no plug-ins.
>
>  ProblemType: Bug
>  DistroRelease: Ubuntu 10.04
>  Package: firefox 10.0.1+build1-0ubuntu0.10.04.1
>  ProcVersionSignature: Ubuntu 2.6.32-38.83-generic 2.6.32.52+drm33.21
>  Uname: Linux 2.6.32-38-generic x86_64
>  NonfreeKernelModules: nvidia
>  AddonCompatCheckDisabled: False
>  AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21.
>  AplayDevices:
>   **** List of PLAYBACK Hardware Devices ****
>   card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
>     Subdevices: 1/1
>     Subdevice #0: subdevice #0
>  Architecture: amd64
>  ArecordDevices:
>   **** List of CAPTURE Hardware Devices ****
>   card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
>     Subdevices: 1/1
>     Subdevice #0: subdevice #0
>  AudioDevicesInUse:
>   USER        PID ACCESS COMMAND
>   /dev/snd/controlC0:  bjorn2    19882 F.... pulseaudio
>  BuildID: 20120209215013
>  CRDA: Error: [Errno 2] No such file or directory
>  Card0.Amixer.info:
>   Card hw:0 'Intel'/'HDA Intel at 0xf2620000 irq 17'
>     Mixer name : 'Conexant ID 5069'
>     Components : 'HDA:14f15069,17aa218b,00100302'
>     Controls      : 6
>     Simple ctrls  : 4
>  Card1.Amixer.info:
>   Card hw:1 'NVidia'/'HDA NVidia at 0xcdefc000 irq 16'
>     Mixer name : 'Nvidia ID a'
>     Components : 'HDA:10de000a,10de0101,00100100'
>     Controls      : 0
>     Simple ctrls  : 0
>  Card1.Amixer.values:
>
>  Card29.Amixer.info:
>   Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30,
> fw 6MHT39WW-1.14'
>     Mixer name : 'ThinkPad EC 6MHT39WW-1.14'
>     Components : ''
>     Controls      : 1
>     Simple ctrls  : 1
>  Card29.Amixer.values:
>   Simple mixer control 'Console',0
>     Capabilities: pswitch pswitch-joined penum
>     Playback channels: Mono
>     Mono: Playback [on]
>  Channel: release
>  Date: Mon Feb 13 13:31:40 2012
>  EtcFirefoxSyspref: Cannot parse /etc/firefox/syspref.js - [Errno 2] No
> such file or directory: '/etc/firefox/syspref.js'
>  ForcedLayersAccel: False
>  InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64
> (20100429)
>  IpRoute:
>   192.168.100.0/24 dev eth0  proto kernel  scope link  src 192.168.100.38
>   default via 192.168.100.254 dev eth0
>  Plugins: Shockwave Flash - Lib=libflashplayer.so,
> Location=/usr/lib/firefox-addons/plugins
>  ProcEnviron:
>   LANG=en_US.UTF-8
>   SHELL=/bin/bash
>  Profiles: Profile0 (Default) - LastVersion=10.0.1/20120209215013 (Running)
>  RunningIncompatibleAddons: False
>  SourcePackage: firefox
>  dmi.bios.date: 07/14/2010
>  dmi.bios.vendor: LENOVO
>  dmi.bios.version: 6NET64WW (1.27 )
>  dmi.board.name: 4318CTO
>  dmi.board.vendor: LENOVO
>  dmi.board.version: Not Available
>  dmi.chassis.asset.tag: No Asset Information
>  dmi.chassis.type: 10
>  dmi.chassis.vendor: LENOVO
>  dmi.chassis.version: Not Available
>  dmi.modalias:
> dmi:bvnLENOVO:bvr6NET64WW(1.27):bd07/14/2010:svnLENOVO:pn4318CTO:pvrThinkPadW510:rvnLENOVO:rn4318CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
>  dmi.product.name: 4318CTO
>  dmi.product.version: ThinkPad W510
>  dmi.sys.vendor: LENOVO
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/firefox/+bug/931637/+subscriptions
>

Revision history for this message

pdescham49 (pdescham49) wrote on 2012-06-14:

#72

Download full text (5.8 KiB)

Comfirmed.

CTRL-SHIFT-K

typed in print

CRASH

On Thu, Jun 14, 2012 at 9:20 AM, Paul Deschamps <email address hidden>wrote:

> I still get intermittent crashes In FF 9-11 on ubuntu when I play with the
> dom inspector. Granted it's in Firebug I'll see if I can get it to crash
> with some of the native FF debugging tools.
>
> Paul
>
>
> On Sun, Apr 22, 2012 at 10:22 PM, Ben Turner <email address hidden>wrote:
>
>> Also getting this problem for a long time now (and still ongoing) with
>> Ubuntu 10.10 (Maverick) and FF9,10 & 11
>>
>> I'm running firefox 11.0+build1-0ubuntu0.10.10.2 on on Ubuntu 10.10
>> x86_64 and can crash firefox by typing:
>> * CTRL+SHIFT+K
>> * print
>>
>> It crashes everytime when I get to "i", as also noted by @pdescham49
>>
>> --
>> You received this bug notification because you are subscribed to the bug
>> report.
>> https://bugs.launchpad.net/bugs/931637
>>
>> Title:
>> Firefox 10.0.1 crashes when trying to enter a command on the Web
>> Console
>>
>> Status in The Mozilla Firefox Browser:
>> Confirmed
>> Status in “firefox” package in Ubuntu:
>> Confirmed
>> Status in “gcc-4.4” package in Ubuntu:
>> Fix Released
>> Status in “firefox” source package in Lucid:
>> Fix Released
>> Status in “gcc-4.4” source package in Lucid:
>> Fix Released
>> Status in “firefox” source package in Maverick:
>> Fix Released
>> Status in “gcc-4.4” source package in Maverick:
>> Fix Released
>> Status in “firefox” source package in Natty:
>> Invalid
>> Status in “gcc-4.4” source package in Natty:
>> Invalid
>> Status in “firefox” source package in Oneiric:
>> Invalid
>> Status in “gcc-4.4” source package in Oneiric:
>> Confirmed
>>
>> Bug description:
>> Bug first appeared last week after updating to Firefox 10 using
>> Synaptic. Original symptom was crashing Firefox when navigating a site
>> I'm developing (which logs a lot to console in development
>> environment). Further discovery indicated that I could crash Firefox
>> by clicking on the DOM tab in Firebug. At that point, I re-installed
>> Firefox, created a new profile, re-installed Firebug and could still
>> reproduce the crash. I created a new user on my system, repeated the
>> prior steps, same result. After some searching, I found these
>> discussions:
>>
>>
>> http://groups.google.com/group/firebug/browse_thread/thread/bfb5a8b038ef2328/65171984c28775a1?show_docid=65171984c28775a1#
>>
>> https://bugzilla.mozilla.org/show_bug.cgi?id=725619
>>
>> At which point, I tried simply opening the Web Console and typing
>> print, which would crash the browser before finishing typing the
>> command, even with a clean install and no plug-ins.
>>
>> ProblemType: Bug
>> DistroRelease: Ubuntu 10.04
>> Package: firefox 10.0.1+build1-0ubuntu0.10.04.1
>> ProcVersionSignature: Ubuntu 2.6.32-38.83-generic 2.6.32.52+drm33.21
>> Uname: Linux 2.6.32-38-generic x86_64
>> NonfreeKernelModules: nvidia
>> AddonCompatCheckDisabled: False
>> AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21.
>> AplayDevices:
>> **** List of PLAYBACK Hardware Devices ****
>> card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
>> Subdevices: 1/1
>> ...

Comfirmed.

CTRL-SHIFT-K

typed in print

CRASH

On Thu, Jun 14, 2012 at 9:20 AM, Paul Deschamps <pdescham49@gmail.com>wrote:

> I still get intermittent crashes In FF 9-11 on ubuntu when I play with the
> dom inspector. Granted it's in Firebug I'll see if I can get it to crash
> with some of the native FF debugging tools.
>
> Paul
>
>
> On Sun, Apr 22, 2012 at 10:22 PM, Ben Turner <931637@bugs.launchpad.net>wrote:
>
>> Also getting this problem for a long time now (and still ongoing) with
>> Ubuntu 10.10 (Maverick) and FF9,10 & 11
>>
>> I'm running firefox 11.0+build1-0ubuntu0.10.10.2 on on Ubuntu 10.10
>> x86_64 and can crash firefox by typing:
>> * CTRL+SHIFT+K
>> * print
>>
>> It crashes everytime when I get to "i", as also noted by @pdescham49
>>
>> --
>> You received this bug notification because you are subscribed to the bug
>> report.
>> https://bugs.launchpad.net/bugs/931637
>>
>> Title:
>>  Firefox 10.0.1 crashes when trying to enter a command on the Web
>>  Console
>>
>> Status in The Mozilla Firefox Browser:
>>  Confirmed
>> Status in “firefox” package in Ubuntu:
>>  Confirmed
>> Status in “gcc-4.4” package in Ubuntu:
>>  Fix Released
>> Status in “firefox” source package in Lucid:
>>  Fix Released
>> Status in “gcc-4.4” source package in Lucid:
>>  Fix Released
>> Status in “firefox” source package in Maverick:
>>  Fix Released
>> Status in “gcc-4.4” source package in Maverick:
>>  Fix Released
>> Status in “firefox” source package in Natty:
>>  Invalid
>> Status in “gcc-4.4” source package in Natty:
>>  Invalid
>> Status in “firefox” source package in Oneiric:
>>  Invalid
>> Status in “gcc-4.4” source package in Oneiric:
>>  Confirmed
>>
>> Bug description:
>>  Bug first appeared last week after updating to Firefox 10 using
>>  Synaptic. Original symptom was crashing Firefox when navigating a site
>>  I'm developing (which logs a lot to console in development
>>  environment). Further discovery indicated that I could crash Firefox
>>  by clicking on the DOM tab in Firebug. At that point, I re-installed
>>  Firefox, created a new profile, re-installed Firebug and could still
>>  reproduce the crash. I created a new user on my system, repeated the
>>  prior steps, same result. After some searching, I found these
>>  discussions:
>>
>>
>> http://groups.google.com/group/firebug/browse_thread/thread/bfb5a8b038ef2328/65171984c28775a1?show_docid=65171984c28775a1#
>>
>>  https://bugzilla.mozilla.org/show_bug.cgi?id=725619
>>
>>  At which point, I tried simply opening the Web Console and typing
>>  print, which would crash the browser before finishing typing the
>>  command, even with a clean install and no plug-ins.
>>
>>  ProblemType: Bug
>>  DistroRelease: Ubuntu 10.04
>>  Package: firefox 10.0.1+build1-0ubuntu0.10.04.1
>>  ProcVersionSignature: Ubuntu 2.6.32-38.83-generic 2.6.32.52+drm33.21
>>  Uname: Linux 2.6.32-38-generic x86_64
>>  NonfreeKernelModules: nvidia
>>  AddonCompatCheckDisabled: False
>>  AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21.
>>  AplayDevices:
>>   **** List of PLAYBACK Hardware Devices ****
>>   card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
>>     Subdevices: 1/1
>>     Subdevice #0: subdevice #0
>>  Architecture: amd64
>>  ArecordDevices:
>>   **** List of CAPTURE Hardware Devices ****
>>   card 0: Intel [HDA Intel], device 0: HDA Generic [HDA Generic]
>>     Subdevices: 1/1
>>     Subdevice #0: subdevice #0
>>  AudioDevicesInUse:
>>   USER        PID ACCESS COMMAND
>>   /dev/snd/controlC0:  bjorn2    19882 F.... pulseaudio
>>  BuildID: 20120209215013
>>  CRDA: Error: [Errno 2] No such file or directory
>>  Card0.Amixer.info:
>>   Card hw:0 'Intel'/'HDA Intel at 0xf2620000 irq 17'
>>     Mixer name : 'Conexant ID 5069'
>>     Components : 'HDA:14f15069,17aa218b,00100302'
>>     Controls      : 6
>>     Simple ctrls  : 4
>>  Card1.Amixer.info:
>>   Card hw:1 'NVidia'/'HDA NVidia at 0xcdefc000 irq 16'
>>     Mixer name : 'Nvidia ID a'
>>     Components : 'HDA:10de000a,10de0101,00100100'
>>     Controls      : 0
>>     Simple ctrls  : 0
>>  Card1.Amixer.values:
>>
>>  Card29.Amixer.info:
>>   Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30,
>> fw 6MHT39WW-1.14'
>>     Mixer name : 'ThinkPad EC 6MHT39WW-1.14'
>>     Components : ''
>>     Controls      : 1
>>     Simple ctrls  : 1
>>  Card29.Amixer.values:
>>   Simple mixer control 'Console',0
>>     Capabilities: pswitch pswitch-joined penum
>>     Playback channels: Mono
>>     Mono: Playback [on]
>>  Channel: release
>>  Date: Mon Feb 13 13:31:40 2012
>>  EtcFirefoxSyspref: Cannot parse /etc/firefox/syspref.js - [Errno 2] No
>> such file or directory: '/etc/firefox/syspref.js'
>>  ForcedLayersAccel: False
>>  InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64
>> (20100429)
>>  IpRoute:
>>   192.168.100.0/24 dev eth0  proto kernel  scope link  src 192.168.100.38
>>   default via 192.168.100.254 dev eth0
>>  Plugins: Shockwave Flash - Lib=libflashplayer.so,
>> Location=/usr/lib/firefox-addons/plugins
>>  ProcEnviron:
>>   LANG=en_US.UTF-8
>>   SHELL=/bin/bash
>>  Profiles: Profile0 (Default) - LastVersion=10.0.1/20120209215013
>> (Running)
>>  RunningIncompatibleAddons: False
>>  SourcePackage: firefox
>>  dmi.bios.date: 07/14/2010
>>  dmi.bios.vendor: LENOVO
>>  dmi.bios.version: 6NET64WW (1.27 )
>>  dmi.board.name: 4318CTO
>>  dmi.board.vendor: LENOVO
>>  dmi.board.version: Not Available
>>  dmi.chassis.asset.tag: No Asset Information
>>  dmi.chassis.type: 10
>>  dmi.chassis.vendor: LENOVO
>>  dmi.chassis.version: Not Available
>>  dmi.modalias:
>> dmi:bvnLENOVO:bvr6NET64WW(1.27):bd07/14/2010:svnLENOVO:pn4318CTO:pvrThinkPadW510:rvnLENOVO:rn4318CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
>>  dmi.product.name: 4318CTO
>>  dmi.product.version: ThinkPad W510
>>  dmi.sys.vendor: LENOVO
>>
>> To manage notifications about this bug go to:
>> https://bugs.launchpad.net/firefox/+bug/931637/+subscriptions
>>
>
>

Adolfo Jayme Barrientos (fitojb) on 2013-06-27

no longer affects:	firefox (Ubuntu Natty)
no longer affects:	firefox (Ubuntu Oneiric)
no longer affects:	gcc-4.4 (Ubuntu Natty)
no longer affects:	gcc-4.4 (Ubuntu Oneiric)

Revision history for this message

pdescham49 (pdescham49) wrote on 2014-02-10: Invitation to connect on LinkedIn

#73

LinkedIn
------------

Bug,

I'd like to add you to my professional network on LinkedIn.

- Paul

Paul Deschamps
Corporate Systems Developer at QNX Software Systems
Ottawa, Canada Area

Confirm that you know Paul Deschamps:
https://www.linkedin.com/e/-q6i8oz-hrhziv2z-2x/isd/20007315972/CnibuRoR/?hs=false&tok=2kYK4n6K9q1681

--
You are receiving Invitation to Connect emails. Click to unsubscribe:
http://www.linkedin.com/e/-q6i8oz-hrhziv2z-2x/z8bfwdl555HaKsVz-45sXNx5LSA7Emp8vcouniC/goo/931637%40bugs%2Elaunchpad%2Enet/20061/I6448785860_1/?hs=false&tok=0VVCDYHK5q1681

Paul White (paulw2u) on 2018-08-19

Changed in firefox (Ubuntu):
status:	Confirmed → Fix Released

	Status	Importance	Assigned to
Mozilla Firefox	Fix Released	Critical	mozilla-bugs #694594
firefox (Ubuntu)	Fix Released	Undecided	Unassigned
Lucid	Fix Released	Undecided	Unassigned
Maverick	Fix Released	Undecided	Unassigned
gcc-4.4 (Ubuntu)	Fix Released	Undecided	Unassigned
Lucid	Fix Released	Undecided	Unassigned
Maverick	Fix Released	Undecided	Unassigned

Ubuntu
firefox package

Firefox 10.0.1 crashes when trying to enter a command on the Web Console

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntufirefox package

Firefox 10.0.1 crashes when trying to enter a command on the Web Console

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
firefox package