MASTER firefox crash [with munmap ()] -- libflashplayer.so

[Nicolas_Raoul]

 ... on logout, may be flashplugin-nonfree

Package: Firefox on an up-to-date Feisty.

Firefox sometimes crashes when logging out while it is still running.
I notice this regularly when logging out while this Flash+AJAX web page is open and playing music:
http://www.jamendo.com/fr/jamplayerweb/

Steps to reproduce (not always reproducible):
1) Open Firefox by clicking on its icon.
2) Load the cited web page.
3) Click on the "Play" button in the page.
4) Enjoy the music ;-)
5) In the Ubuntu menu, click on "Quit..." and choose "Shut down".
6) Next time you open a session, apport tells there was a crash and propose to report a bug.

Cheers,
Nicolas.

ProblemType: Crash
Architecture: i386
Date: Tue Mar 20 00:39:05 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/lib/firefox/firefox-bin
Package: firefox 2.0.0.2+1-0ubuntu1
PackageArchitecture: i386
ProcCmdline: /usr/lib/firefox/firefox-bin https://launchpad.net/bugs/89955 -a firefox
ProcCwd: /home/nico
ProcEnviron:
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 LANGUAGE=en_US:en
Signal: 11
SourcePackage: firefox
StacktraceTop:
 ?? () from /lib/ld-linux.so.2
 raise () from /lib/tls/i686/cmov/libpthread.so.0
 ?? ()
 ?? ()
 ?? ()
Uname: Linux aikawa 2.6.20-12-generic #2 SMP Sun Mar 18 03:07:14 UTC 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev scanner video

[Apport retracing service (apport)]

StacktraceTop:_dl_sysinfo_int80 () from /lib/ld-linux.so.2
?? ()
?? ()
?? ()
?? ()

[Alexander Sack (asac)]

On Tue, Mar 20, 2007 at 01:05:59PM -0000, Apport retracing service wrote:
>
> ** Attachment added: "ThreadStacktrace.txt (retraced)"
> http://librarian.launchpad.net/6874239/%3Cfdopen%3E
>

Yes, retrace is not good. Maybe hmjf can take a look.

 - Alexander

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Retrace done:
...
#4 0xb7e06460 in pthread_mutex_lock () from /lib/tls/i686/cmov/libpthread.so.0
#5 0xafb92858 in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so
#6 0xadd52024 in ?? ()
#7 0x09347998 in ?? ()
#8 0xb77d6136 in munmap () from /lib/tls/i686/cmov/libc.so.6
#9 0xb004412c in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so
#10 0x00000000 in ?? ()
--- end of stack trace ---
...

Tagging as mt-confirm for further processing

Looks a flashplugin-nonfree issue

[Nicolas_Raoul (nicolas-raoul)]

It does not happen all the time but maybe half.
I will try to run Firefox in Valgrind or gdb.

Needs info ?
I am available for any info/test anyone may want to have :-)
I will keep posting if I find anything worth, but don't hesitate to ask !

Every time I get the same bug, I let apport create a new bug with many attached files, and mark it as a duplicate of this one. This way, the stacks and various files are available. Is it a reasonable behavior, or am flooding Launchpad ?

Cheers,
Nicolas

[Nicolas_Raoul (nicolas-raoul)]

I had http://www.jamendo.com/fr/jamplayerweb/ open, which uses AJAX for the UI and Flash for the audio output.

I logged out without closing Firefox first.

[Nicolas_Raoul (nicolas-raoul)]

I am trying to reproduce the crash when Firefox is running with Valgrind, with no luck so far, I could not reproduce it.

I suspect that launching firefox from an X terminal changes the behavior of the whole thing, maybe the X terminal gets terminated too soon for the bug to happen or something. I need this terminal to give Firefox its Valgrind settings.

So I tried added a "&" at the end of the command line, not better.
I tried with "nohup command &":

nohup "G_SLICE=always-malloc G_DEBUG=gc-friendly valgrind -v --tool=memcheck --leak-check=full --num-callers=12 --log-file=valgrind.log /usr/bin/firefox" &

but it does not work:
nohup: cannot run command `G_SLICE=always-malloc G_DEBUG=gc-friendly valgrind -v --tool=memcheck --leak-check=full --num-callers=12 --log-file=valgrind.log /usr/bin/firefox': No such file or directory

I tried encapsulating the command in "" {} () no luck so far :-(
Anybody has any idea how to run a command in Valgrind so that it does not get terminated when X closes the terminal ?

How I do now is: I type CTRL+ALT+F1 to get a terminal out of X, redirect the DISPLAY variable to :0.0, run /usr/bin/firefox in its Valgrind command line, and then I come back to X11, open http://www.jamendo.com/fr/jamplayerweb/, play some music and log out. I tried this twice, no crash so far :-(

I will be working in Malta from tomorrow, and in Poland the week after, so I probably won't be as responsive as usual, but I will try my best !

Happy bug hunting,
Nicolas.

[John Vivirito (gnomefreak)]

can you try getting a backtrace instead of a valgrind. try with these instructions at: https://wiki.ubuntu.com/MozillaTeam/Bugs

[Nicolas_Raoul (nicolas-raoul)]

Following the instructions on that page, I installed the debugging symbols. Then I reproduced the bug and here it is: #95131
The files attached with that bug seem much more interesting than the last ones I provided. This thread stack trace seems especially useful:

Thread 1 (process 6733):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb7e264f1 in raise () from /lib/tls/i686/cmov/libpthread.so.0
#2 0x08057836 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:206
 unblock_sigs = {__val = {1024, 0 <repeats 31 times>}}
 oldact = <value optimized out>
#3 <signal handler called>
#4 0xb7e20460 in pthread_mutex_lock ()
   from /lib/tls/i686/cmov/libpthread.so.0
#5 0xb0291858 in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so
#6 0xaf0dd024 in ?? ()
#7 0x01000000 in ?? ()
#8 0xb77f0136 in munmap () from /lib/tls/i686/cmov/libc.so.6
#9 0xb074312c in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so
#10 0x00000000 in ?? ()

[Nicolas_Raoul (nicolas-raoul)]

Following the instructions on that page, I installed the debugging symbols. Then I reproduced the bug and here it is: #95131
The files attached with that bug seem much more interesting than the last ones I provided. This thread stack trace seems especially useful:

Thread 1 (process 6733):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb7e264f1 in raise () from /lib/tls/i686/cmov/libpthread.so.0
#2 0x08057836 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:206
 unblock_sigs = {__val = {1024, 0 <repeats 31 times>}}
 oldact = <value optimized out>
#3 <signal handler called>
#4 0xb7e20460 in pthread_mutex_lock ()
   from /lib/tls/i686/cmov/libpthread.so.0
#5 0xb0291858 in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so
#6 0xaf0dd024 in ?? ()
#7 0x01000000 in ?? ()
#8 0xb77f0136 in munmap () from /lib/tls/i686/cmov/libc.so.6
#9 0xb074312c in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so
#10 0x00000000 in ?? ()

Thanks,
Nicolas.

[Nicolas_Raoul (nicolas-raoul)]

Sorry for the duplicated message :-/
Just consider the last one, anyone in the Know please delete the previous one.
Nicolas.

[John Vivirito (gnomefreak)]

that makes me lean towards flash bug. I will add a job for flash to this bug.

[Nicolas_Raoul (nicolas-raoul)]

I haven't got this crash for a while (one month or two I would say), even when logging out while playing music at the above-mentioned website. Maybe the bug haven't been fixed and it is just that the circumstances around are not the same anymore, I don't know.
The duplicates seems to suggest that the bug still exists, though.

[Oddround (oddround)]

Hello,

My example was at post initial install. Most likely my ATI Radeon 7000 card
which is known for it's problems on all types of O.S. This has been replaced
with a more stable nVidia 4600 and I have had the same problem at install
but no problems since.

If Ubuntu had not automatically logged the error I would not have known.

This was the only bug I had and it occurred at initial install and never
since.
Most likely the updates have cleaned up the problem.
I have several of my family using this system and they have not reported any
problem.

X700 on my Semperon machine will not work with any Ubuntu.
It is definitely a video card driver problem. Live doesn't work either and
this is very unusual.

Ever seen anything like this?
My impression is "All my bad experiences have been with ATI but nVidia
always works o.k."
I have no manufacturer preferences.

What about you?

Andy

>From: Nicolas_Raoul <email address hidden>
>Reply-To: Bug 94021 <email address hidden>
>To: <email address hidden>
>Subject: [Bug 94021] Does not crash anymore for me
>Date: Wed, 25 Apr 2007 07:36:10 -0000
>
>I haven't got this crash for a while (one month or two I would say), even
>when logging out while playing music at the above-mentioned website. Maybe
>the bug haven't been fixed and it is just that the circumstances around are
>not the same anymore, I don't know.
>The duplicates seems to suggest that the bug still exists, though.
>
>--
>MASTER firefox crash [with munmap ()] -- libflashplayer.so
>https://bugs.launchpad.net/bugs/94021
>You received this bug notification because you are a direct subscriber
>of a duplicate bug.

_________________________________________________________________
Solve the Conspiracy and win fantastic prizes.
http://www.theconspiracygame.co.uk/

[Nicolas_Raoul (nicolas-raoul)]

Hi Andy,
I fail to see how your problem is related to Firefox, I guess that this page is not the right place to post...
Anyway, good luck with your problem !
Nicolas.

[John Vivirito (gnomefreak)]

Andy please file a new bug report for your problem as your problem seems more related to the ati drivers.

[Alexander Sack (asac)]

lets see if firefox 3 gets dupes for this.

[Alexander Sack (asac)]

firefox 2 certainly wont see a fix for this anymore.

[Alexander Sack (asac)]

flash plugin certainly contributes to this, but we cannot fix it there as its closed source. keep it confirmed anyway.

[Nicolas_Raoul (nicolas-raoul)]

I am the original poster of this bug.
I have not seen this bug for a very very long time.
There are a lot of duplicates but most of them occurred early last year.

Therefore, I guess the whole bug can be considered as fixed.

--- Nicolas Raoul http://nrw.free.fr

The last 3 duplicates are very recent (today), but why on Earth are they "private" ? Did you create them, Alexander ?

[John Vivirito (gnomefreak)]

They are marked as private because there might be some info in the crash report that is personal. Any crash report bug with report attached using Apport is marked as private by apport. We can release it once it is known no private data is in it.

Is anyone still seeing this crash with latest firefox and flash in Ubuntu repos?

[John Vivirito (gnomefreak)]

Why are we keeping this open? just to catch dups? other wise if we cant fix the issue than no need to keep open. If i understand if firefox is open firefox crashes when logging out. I dont see how we can support something that you really shouldnt do. before shutdown all apps should be closed. the reason its crashing is beecause ubuntu sort of kills firefox since you didnt, and that is why when you start back up it calls a crash.

[Alexander Sack (asac)]

havent seen new dupes for ages here ... closing as john suggested.