Bug 195642

Summary: glibc detected invalid pointer
Product: [Fedora] Fedora Reporter: simon
Component: firefoxAssignee: Christopher Aillon <caillon>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 5CC: mcepl, mcepl, stransky, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: firefox-2.0.0.5-1.fc7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-07-22 08:37:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Backtrace from firefox none

Description simon 2006-06-16 10:34:19 UTC
Description of problem:
I just updated to the latest firefox rpm (1.5.0.4). I ran firefox from the
command line (just firefox). It went through its automatic extension check and
then I manually updated my extensions (no updates) and themes (one update to the
current theme). I then quit firefox to restart for the theme update to take
place. In the terminal I launched firefox from I noticed there was a backtrace.
I've attached the bt to this report.

Subsequent runs of firefox have not yielded any more stack traces. So presumably
its an artifact of the update.

Version-Release number of selected component (if applicable):
firefox-1.5.0.4-1.2.fc5

How reproducible:
Once 

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Theme was "Mostly Crystal" version 1.5.0.15. This was upgraded to version 1.5.0.17.

Comment 1 simon 2006-06-16 10:34:19 UTC
Created attachment 131033 [details]
Backtrace from firefox

Comment 2 simon 2006-06-16 17:17:16 UTC
I have just tried this on another machine and reproduced the results. This was
again updating from the previous rpm, checking for both extensions and themes
(and updating the mostly crystal theme). When I quit firefox, the backtrace appears.

Comment 3 Tethys 2007-01-17 17:17:31 UTC
I just got exactly the same firefox-1.5.0.7-1.fc5, again on exit after updating
some extensions (flashblock, cookie button, live http headers):

mrburns:~% /usr/bin/firefox
*** glibc detected *** /usr/lib64/firefox-1.5.0.7/firefox-bin: free(): invalid
pointer: 0x0000000001921ce8 ***
======= Backtrace: =========
/lib64/libc.so.6[0x30ad76d313]
/lib64/libc.so.6(__libc_free+0x84)[0x30ad76d494]
/usr/lib64/firefox-1.5.0.7/libmozjs.so(js_FinalizeStringRT+0x21)[0x2aaaaab25e7a]
/usr/lib64/firefox-1.5.0.7/libmozjs.so[0x2aaaaaad44ec]
/usr/lib64/firefox-1.5.0.7/libmozjs.so(JS_HashTableEnumerateEntries+0x60)[0x2aaaaaaee1a2]
/usr/lib64/firefox-1.5.0.7/libmozjs.so(js_FinishAtomState+0x31)[0x2aaaaaad455a]
/usr/lib64/firefox-1.5.0.7/libmozjs.so(JS_Finish+0x15)[0x2aaaaaacfb02]
/usr/lib64/firefox-1.5.0.7/components/libxpconnect.so[0x2aaaaff00bff]
/usr/lib64/firefox-1.5.0.7/components/libxpconnect.so[0x2aaaaff00da4]
/usr/lib64/firefox-1.5.0.7/components/libxpconnect.so[0x2aaaafefe9b6]
/usr/lib64/firefox-1.5.0.7/components/libxpconnect.so[0x2aaaafeecbda]
/usr/lib64/firefox-1.5.0.7/components/libxpconnect.so[0x2aaaafeec68d]
/usr/lib64/firefox-1.5.0.7/components/libcaps.so[0x2aaaaf3e6501]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so[0x2aaaaadc7f07]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so(_ZN5nsDll8ShutdownEv+0x13)[0x2aaaaadfc7ab]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so[0x2aaaaadfa7d1]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so[0x2aaaaadfa834]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so[0x2aaaaadcdef1]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so(PL_DHashTableEnumerate+0x6b)[0x2aaaaadc56a8]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so(_ZN11nsHashtable9EnumerateEPFiP9nsHashKeyPvS2_ES2_+0x36)[0x2aaaaadce052]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so[0x2aaaaadfa735]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so(_ZN22nsComponentManagerImpl15UnloadLibrariesEP17nsIServiceManageri+0x69)[0x2aaaaadf4c19]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so(_ZN22nsComponentManagerImpl8ShutdownEv+0x8e)[0x2aaaaadf73f0]
/usr/lib64/firefox-1.5.0.7/libxpcom_core.so(NS_ShutdownXPCOM_P+0x270)[0x2aaaaadc88ba]
/usr/lib64/firefox-1.5.0.7/firefox-bin[0x4075c0]
/usr/lib64/firefox-1.5.0.7/firefox-bin[0x40b7d1]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x30ad71c784]
/usr/lib64/firefox-1.5.0.7/firefox-bin(__gxx_personality_v0+0xb1)[0x406be9]
======= Memory map: ========
00400000-0041b000 r-xp 00000000 fd:03 1276166                           
/usr/lib64/firefox-1.5.0.7/firefox-bin
0051b000-0051d000 rw-p 0001b000 fd:03 1276166                           
/usr/lib64/firefox-1.5.0.7/firefox-bin
0051d000-01fa0000 rw-p 0051d000 00:00 0                                  [heap]
40a01000-40a02000 ---p 40a01000 00:00 0
40a02000-41402000 rw-p 40a02000 00:00 0
41402000-41403000 ---p 41402000 00:00 0
41403000-41e03000 rw-p 41403000 00:00 0
42804000-42805000 ---p 42804000 00:00 0
42805000-43205000 rw-p 42805000 00:00 0
30ad500000-30ad51a000 r-xp 00000000 fd:00 152184                        
/lib64/ld-2.4.so
30ad619000-30ad61a000 r--p 00019000 fd:00 152184                        
/lib64/ld-2.4.so
30ad61a000-30ad61b000 rw-p 0001a000 fd:00 152184                        
/lib64/ld-2.4.so
30ad700000-30ad83f000 r-xp 00000000 fd:00 152224                        
/lib64/libc-2.4.so
30ad83f000-30ad93e000 ---p 0013f000 fd:00 152224                        
/lib64/libc-2.4.so
30ad93e000-30ad942000 r--p 0013e000 fd:00 152224                        
/lib64/libc-2.4.so
30ad942000-30ad943000 rw-p 00142000 fd:00 152224                        
/lib64/libc-2.4.so
30ad943000-30ad948000 rw-p 30ad943000 00:00 0
30ada00000-30ada80000 r-xp 00000000 fd:00 152974                        
/lib64/libm-2.4.so
30ada80000-30adb7f000 ---p 00080000 fd:00 152974                        
/lib64/libm-2.4.so
30adb7f000-30adb80000 r--p 0007f000 fd:00 152974                        
/lib64/libm-2.4.so
30adb80000-30adb81000 rw-p 00080000 fd:00 152974                        
/lib64/libm-2.4.so
30adc00000-30adc02000 r-xp 00000000 fd:00 152972                        
/lib64/libdl-2.4.so
30adc02000-30add02000 ---p 00002000 fd:00 152972                        
/lib64/libdl-2.4.so
30add02000-30add03000 r--p 00002000 fd:00 152972                        
/lib64/libdl-2.4.so
30add03000-30add04000 rw-p 00003000 fd:00 152972

Not easily reproducible, as all of my extensions are now up to date.

I've since upgraded to firefox-1.5.0.9-1.fc5. Will see if it happens again next
time my extensions need updating.

Comment 4 Martin Stransky 2007-04-12 14:53:45 UTC
Please check if it happens again. And attach a bactrace from gdb, how-to is here
- http://people.redhat.com/stransky/mozilla/

Comment 5 Matěj Cepl 2007-07-18 17:28:58 UTC
Fedora Core 5 is no longer supported, could you please reproduce this with the
updated version of the currently supported distribution (Fedora Core 6, or
Fedora 7, or Rawhide)? If this issue turns out to still be reproducible, please
let us know in this bug report.  If after a month's time we have not heard back
from you, we will have to close this bug as CANTFIX.

Setting status to NEEDINFO, and awaiting information from the reporter.

Thanks in advance.


Comment 6 simon 2007-07-22 08:37:08 UTC
I've not been able to reproduce this bug using firefox 2.0, so I'll close the bug.