Bug 1264634

Summary: [Offscreen surfaces and OMTC] Firefox crashes on English and German wikipedia page for Uruguay
Product: [Fedora] Fedora Reporter: Christian Stadelmann <fedora>
Component: firefoxAssignee: Martin Stransky <stransky>
Status: CLOSED UPSTREAM QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 22CC: fedora, gecko-bugs-nobody, jhorak, pjasicek, stransky
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-10-21 09:28:24 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
gdb output following the steps described in https://fedoraproject.org/wiki/Debugging_guidelines_for_Mozilla_products#Application_crash none

Description Christian Stadelmann 2015-09-19 16:18:48 UTC
Created attachment 1075215 [details]
gdb output following the steps described in https://fedoraproject.org/wiki/Debugging_guidelines_for_Mozilla_products#Application_crash

Description of problem:
I am running Firefox with layers.use-image-offscreen-surfaces and layers.offmainthreadcomposition.enabled set to true as proposed in https://lists.fedoraproject.org/pipermail/devel/2015-August/213645.html
When browsing specific pages firefox crashes.

Version-Release number of selected component (if applicable):
firefox-40.0.3-1.fc22.x86_64
Fedora with packages from updates-testing

How reproducible:
On a specific profile setup every time I open https://en.wikipedia.org/wiki/Uruguay or https://de.wikipedia.org/wiki/Uruguay . On a fresh profile I am not able to reproduce this at all

Steps to Reproduce:
1. open https://en.wikipedia.org/wiki/Uruguay or https://de.wikipedia.org/wiki/Uruguay

Actual results:
Firefox crashes

Expected results:
Firefox should not crash

Additional info:
see attached log file

Comment 1 Martin Stransky 2015-09-22 20:11:47 UTC
I don't see any crash in the attached backtrace - can you please try again? There should be a message about the crash, usually "Segmentation Fault" or so.

Comment 2 Christian Stadelmann 2015-09-22 21:44:20 UTC
Sorry, I can't reproduce this any more.

It definitely was a crash. I didn't set a breakpoint but gdb stopped anyway telling me something of a SIGSEGV (I think, not sure though; Note to self: write that down the next time or start logging when firefox starts). After that I retrieved the backtrace attached above. Then I told gdb to continue and firefox immediately crashed showing the mozilla crash reporter. I reproduced this several times that day.

Comment 3 Martin Stransky 2015-09-23 08:04:00 UTC
okay, thanks anyway.

Comment 4 Christian Stadelmann 2015-10-20 23:50:47 UTC
I am running into this issue again with a fresh firefox profile with some configuration moved in from the old firefox profile. This time it crashes on loading https://de.wiktionary.org/wiki/Wiktionary:Hauptseite and https://en.wiktionary.org/wiki/Wiktionary:Main_Page . Anything I can help?

I tried running firefox inside valgrind following the steps on https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Valgrind :

$ G_SLICE=always-malloc valgrind --smc-check=all-non-file --vex-iropt-register-updates=allregs-at-mem-access --show-mismatched-frees=no --read-inline-info=yes /usr/bin/firefox

It displays nothing useful except this last block:
==4492== HEAP SUMMARY:
==4492==     in use at exit: 44,954 bytes in 1,308 blocks
==4492==   total heap usage: 4,163 allocs, 2,855 frees, 182,667 bytes allocated
==4492== 
==4492== LEAK SUMMARY:
==4492==    definitely lost: 0 bytes in 0 blocks
==4492==    indirectly lost: 0 bytes in 0 blocks
==4492==      possibly lost: 0 bytes in 0 blocks
==4492==    still reachable: 44,954 bytes in 1,308 blocks
==4492==         suppressed: 0 bytes in 0 blocks
==4492== Rerun with --leak-check=full to see details of leaked memory
==4492== 
==4492== For counts of detected and suppressed errors, rerun with: -v
==4492== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
10678 2232
Assertion failure: !mRunningSyncSections, at /builddir/build/BUILD/firefox-41.0.2/mozilla-release/widget/nsBaseAppShell.cpp:356
#01: ???[/usr/lib64/firefox/libxul.so +0x1a048b8]
#02: ???[/usr/lib64/firefox/libxul.so +0x9421c5]
#03: NS_InvokeByIndex[/usr/lib64/firefox/libxul.so +0x9492e3]
#04: ???[/usr/lib64/firefox/libxul.so +0xd0824b]
#05: ???[/usr/lib64/firefox/libxul.so +0xd0f44c]
#06: ??? (???:???)

Comment 6 Martin Stransky 2015-10-21 09:28:24 UTC
Okay, let's track it upstream - https://bugzilla.mozilla.org/show_bug.cgi?id=1191713

Comment 7 Christian Stadelmann 2015-10-23 15:49:40 UTC
*** Bug 1266950 has been marked as a duplicate of this bug. ***