Bug 445026

Summary: 64bit Firefox 3 beta 5 crashes on http://www.cnn.com/services/podcasting/
Product: [Fedora] Fedora Reporter: Pavel Roskin <plroskin>
Component: firefoxAssignee: Gecko Maintainer <gecko-bugs-nobody>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: low    
Version: 9CC: mcepl, poelstra, stransky
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
URL: http://www.cnn.com/services/podcasting/
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-10-24 15:14:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pavel Roskin 2008-05-02 19:18:35 UTC 
Description of problem:
Firefox 3 beta 5 crashes on http://www.cnn.com/services/podcasting/

Version-Release number of selected component (if applicable):
firefox-3.0-0.60.beta5.fc9

How reproducible:
always

Steps to Reproduce:
1. Run Firefox
2. Open http://www.cnn.com/services/podcasting/
  
Actual results:
Firefox dumps core and exits

Expected results:
Firefox displays the page

Additional info:

PATH=/usr/lib64/firefox-3.0b5:/usr/lib64/firefox-3.0b5
    
LIBRARY_PATH=/usr/lib64/firefox-3.0b5:/usr/lib64/firefox-3.0b5/components:/usr/lib64/firefox-3.0b5
       SHLIB_PATH=/usr/lib64/firefox-3.0b5:/usr/lib64/firefox-3.0b5
          LIBPATH=/usr/lib64/firefox-3.0b5:/usr/lib64/firefox-3.0b5
       ADDON_PATH=/usr/lib64/firefox-3.0b5
      MOZ_PROGRAM=/usr/lib64/firefox-3.0b5/firefox
      MOZ_TOOLKIT=
        moz_debug=1
     moz_debugger=
which: no ddd in
(/usr/lib64/qt-3.3/bin:/usr/kerberos/bin:/usr/lib64/ccache:/home/proski/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin)
/usr/bin/gdb /usr/lib64/firefox-3.0b5/firefox -x /tmp/mozargs.isJzCU
GNU gdb Fedora (6.8-1.fc9)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
Missing separate debuginfo for /usr/lib64/firefox-3.0b5/firefox
Try: yum --enablerepo='*-debuginfo' install
/usr/lib/debug/.build-id/0c/6e7bf1a11f3a9f443c152f635cc272e1b62da7.debug
(no debugging symbols found)
(gdb) r
Starting program: /usr/lib64/firefox-3.0b5/firefox 
[Thread debugging using libthread_db enabled]
[New Thread 0x7fd770e69700 (LWP 29690)]
[New Thread 0x413a6950 (LWP 29694)]
[New Thread 0x41ba7950 (LWP 29695)]
[New Thread 0x40949950 (LWP 29696)]
[New Thread 0x423a8950 (LWP 29697)]
[New Thread 0x42ba9950 (LWP 29698)]
[New Thread 0x433aa950 (LWP 29699)]
[New Thread 0x43bab950 (LWP 29700)]
[New Thread 0x443ac950 (LWP 29701)]
[Thread 0x433aa950 (LWP 29699) exited]
[Thread 0x43bab950 (LWP 29700) exited]
[Thread 0x443ac950 (LWP 29701) exited]
[New Thread 0x433aa950 (LWP 29706)]
[New Thread 0x43bab950 (LWP 29709)]
[Thread 0x40949950 (LWP 29696) exited]
[Thread 0x433aa950 (LWP 29706) exited]
[New Thread 0x433aa950 (LWP 29804)]
[New Thread 0x40949950 (LWP 29806)]
[New Thread 0x443ac950 (LWP 29807)]
[Thread 0x443ac950 (LWP 29807) exited]
[New Thread 0x443ac950 (LWP 29808)]
[Thread 0x40949950 (LWP 29806) exited]
Detaching after fork from child process 29809.
Loading stream:
http://widgets.clearspring.com/o/46b9e1daf2fc4836/46b9e1daf2fc4836/-/-/-PUR/http%3A%2F%2Fwww.cnn.com%2Fservices%2Fpodcasting%2F/

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fd770e69700 (LWP 29690)]
cairo_draw_with_xlib (cr=<value optimized out>, callback=<value optimized out>,
closure=<value optimized out>, 
    dpy=<value optimized out>, width=<value optimized out>, height=<value
optimized out>, is_opaque=Could not find the frame base for "cairo_draw_with_xlib".
)
    at cairo-xlib-utils.c:329
329         Drawable drawable = RootWindow (dpy, screen_index);
Missing separate debuginfos, use: debuginfo-install keyutils.x86_64
(gdb) where
#0  cairo_draw_with_xlib (cr=<value optimized out>, callback=<value optimized
out>, closure=<value optimized out>, 
    dpy=<value optimized out>, width=<value optimized out>, height=<value
optimized out>, is_opaque=Could not find the frame base for "cairo_draw_with_xlib".
)
    at cairo-xlib-utils.c:329
#1  0x0000003b05051138 in gfxXlibNativeRenderer::Draw (this=<value optimized
out>, dpy=<value optimized out>, 
    ctx=<value optimized out>, width=<value optimized out>, height=<value
optimized out>, flags=<value optimized out>, 
    output=<value optimized out>) at gfxXlibNativeRenderer.cpp:101
#2  0x0000003b049ea47c in nsPluginInstanceOwner::Paint (this=<value optimized
out>, aRenderingContext=<value optimized out>, 
    aDirtyRect=<value optimized out>) at nsObjectFrame.cpp:4019
#3  0x0000003b049ea4c8 in nsObjectFrame::PaintPlugin (this=<value optimized
out>, aRenderingContext=<value optimized out>, 
    aDirtyRect=<value optimized out>) at nsObjectFrame.cpp:1389
#4  0x0000003b049ea551 in PaintPlugin (aFrame=<value optimized out>, aCtx=<value
optimized out>, 
    aDirtyRect=<value optimized out>, aPt=<value optimized out>) at
nsObjectFrame.cpp:1085
#5  0x0000003b049d98de in nsDisplayGeneric::Paint (this=<value optimized out>,
aBuilder=<value optimized out>, 
    aCtx=<value optimized out>, aDirtyRect=<value optimized out>) at
../base/nsDisplayList.h:838
#6  0x0000003b0498f3c0 in nsDisplayList::Paint (this=<value optimized out>,
aBuilder=<value optimized out>, 
    aCtx=<value optimized out>, aDirtyRect=<value optimized out>) at
nsDisplayList.cpp:294
#7  0x0000003b0498f44e in nsDisplayClip::Paint (this=<value optimized out>,
aBuilder=<value optimized out>, 
    aCtx=<value optimized out>, aDirtyRect=<value optimized out>) at
nsDisplayList.cpp:691
#8  0x0000003b0498f3c0 in nsDisplayList::Paint (this=<value optimized out>,
aBuilder=<value optimized out>, 
    aCtx=<value optimized out>, aDirtyRect=<value optimized out>) at
nsDisplayList.cpp:294
#9  0x0000003b0499eced in nsLayoutUtils::PaintFrame (aRenderingContext=<value
optimized out>, aFrame=<value optimized out>, 
    aDirtyRegion=<value optimized out>, aBackground=<value optimized out>) at
nsLayoutUtils.cpp:875
#10 0x0000003b049a6022 in PresShell::Paint (this=<value optimized out>,
aView=<value optimized out>, 
    aRenderingContext=<value optimized out>, aDirtyRegion=<value optimized out>)
at nsPresShell.cpp:5436
#11 0x0000003b04c025b8 in nsViewManager::RenderViews (this=<value optimized
out>, aView=<value optimized out>, 
    aRC=<value optimized out>, aRegion=<value optimized out>) at
nsViewManager.cpp:614
#12 0x0000003b04c02c12 in nsViewManager::Refresh (this=<value optimized out>,
aView=<value optimized out>, 
    aContext=<value optimized out>, aRegion=<value optimized out>,
aUpdateFlags=<value optimized out>)
    at nsViewManager.cpp:502
#13 0x0000003b04c0361c in nsViewManager::DispatchEvent (this=<value optimized
out>, aEvent=<value optimized out>, 
    aStatus=<value optimized out>) at nsViewManager.cpp:1140
#14 0x0000003b04bfe249 in HandleEvent (aEvent=<value optimized out>) at
nsView.cpp:168
#15 0x0000003b04f4c20d in nsCommonWidget::DispatchEvent (this=<value optimized
out>, aEvent=<value optimized out>, 
    aStatus=<value optimized out>) at nsCommonWidget.cpp:158
#16 0x0000003b04f479c3 in nsWindow::OnExposeEvent (this=<value optimized out>,
aWidget=<value optimized out>, 
    aEvent=<value optimized out>) at nsWindow.cpp:1763
#17 0x0000003b04f48096 in expose_event_cb (widget=<value optimized out>,
event=<value optimized out>) at nsWindow.cpp:4512
#18 0x0000003af4987f2a in _gtk_marshal_BOOLEAN__BOXED (closure=Could not find
the frame base for "_gtk_marshal_BOOLEAN__BOXED".
) at gtkmarshalers.c:84
#19 0x0000003af1c0b6dd in IA__g_closure_invoke (closure=<value optimized out>,
return_value=<value optimized out>, 
    n_param_values=<value optimized out>, param_values=<value optimized out>,
invocation_hint=<value optimized out>)
    at gclosure.c:490
#20 0x0000003af1c1f6c1 in signal_emit_unlocked_R (node=<value optimized out>,
detail=<value optimized out>, 
    instance=<value optimized out>, emission_return=<value optimized out>,
instance_and_params=<value optimized out>)
---Type <return> to continue, or q <return> to quit---
    at gsignal.c:2440
#21 0x0000003af1c20a1f in IA__g_signal_emit_valist (instance=<value optimized
out>, signal_id=<value optimized out>, 
    detail=<value optimized out>, var_args=<value optimized out>) at gsignal.c:2209
#22 0x0000003af1c210e3 in IA__g_signal_emit (instance=<value optimized out>,
signal_id=<value optimized out>, 
    detail=<value optimized out>) at gsignal.c:2243
#23 0x0000003af4af4df5 in gtk_widget_event_internal (widget=Could not find the
frame base for "gtk_widget_event_internal".
) at gtkwidget.c:4678
#24 0x0000003af4af4a65 in IA__gtk_widget_send_expose (widget=Could not find the
frame base for "IA__gtk_widget_send_expose".
) at gtkwidget.c:4510
#25 0x0000003af49850a6 in IA__gtk_main_do_event (event=Could not find the frame
base for "IA__gtk_main_do_event".
) at gtkmain.c:1518
#26 0x0000003af503d183 in gdk_window_process_updates_internal (window=Could not
find the frame base for "gdk_window_process_updates_internal".
) at gdkwindow.c:2378
#27 0x0000003af503d2cb in IA__gdk_window_process_all_updates () at gdkwindow.c:2444
#28 0x0000003af503cf57 in gdk_window_update_idle (data=Could not find the frame
base for "gdk_window_update_idle".
) at gdkwindow.c:2288
#29 0x0000003af501a656 in gdk_threads_dispatch (data=Could not find the frame
base for "gdk_threads_dispatch".
) at gdk.c:470
#30 0x0000003aee43749b in IA__g_main_context_dispatch (context=<value optimized
out>) at gmain.c:2009
#31 0x0000003aee43ac7d in g_main_context_iterate (context=<value optimized out>,
block=<value optimized out>, 
    dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2642
#32 0x0000003aee43ae3b in IA__g_main_context_iteration (context=<value optimized
out>, may_block=<value optimized out>)
    at gmain.c:2705
#33 0x0000003b04f5fea1 in nsBaseAppShell::DoProcessNextNativeEvent (this=<value
optimized out>, 
    mayWait=<value optimized out>) at nsBaseAppShell.cpp:151
#34 0x0000003b04f60052 in nsBaseAppShell::OnProcessNextEvent (this=<value
optimized out>, thr=<value optimized out>, 
    mayWait=<value optimized out>, recursionDepth=<value optimized out>) at
nsBaseAppShell.cpp:278
#35 0x0000003b05016a4b in nsThread::ProcessNextEvent (this=<value optimized
out>, mayWait=<value optimized out>, 
    result=<value optimized out>) at nsThread.cpp:497
#36 0x0000003b04fe82f6 in NS_ProcessNextEvent_P (thread=<value optimized out>,
mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#37 0x0000003b04f6010d in nsBaseAppShell::Run (this=<value optimized out>) at
nsBaseAppShell.cpp:170
#38 0x0000003b04e235bd in nsAppStartup::Run (this=<value optimized out>) at
nsAppStartup.cpp:181
#39 0x0000003b0481f73b in XRE_main (argc=<value optimized out>, argv=<value
optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3154
#40 0x0000000000401665 in __gxx_personality_v0 () at
../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#41 0x0000003aeb41e32a in __libc_start_main (main=<value optimized out>,
argc=<value optimized out>, 
    ubp_av=<value optimized out>, init=<value optimized out>, fini=<value
optimized out>, rtld_fini=<value optimized out>, 
    stack_end=Could not find the frame base for "__libc_start_main".
) at libc-start.c:220
#42 0x0000000000401159 in __gxx_personality_v0 () at
../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#43 0x00007fff78e90f08 in ?? ()
#44 0x000000000000001c in ?? ()
#45 0x0000000000000001 in ?? ()
#46 0x00007fff78e92390 in ?? ()
#47 0x0000000000000000 in ?? ()
(gdb)
Comment 1 John Poelstra 2008-05-03 05:11:04 UTC 
interesting... works fine on 32bit version
Comment 2 Matěj Cepl 2008-05-03 11:24:27 UTC 
Actually, it doesn't crash to me (even with x86_64), but it certainly takes ages
comparing to i386.
Comment 3 Martin Stransky 2008-05-05 12:25:46 UTC 
I can't reproduce it on x86_64...
Comment 4 Pavel Roskin 2008-05-12 12:03:23 UTC 
Try reloading the page.  Now I see that Firefox doesn't always crash from the
first attempt.
Comment 5 Bug Zapper 2008-05-14 10:33:10 UTC 
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 6 petrosyan 2008-06-24 06:46:11 UTC 
I am not able to reproduce this bug with firefox-3.0-1.fc9.x86_64

Is anybody able to reproduce this bug with the latest Firefox?
Comment 7 Pavel Roskin 2008-06-24 17:33:10 UTC 
I confirm that the current Firefox (firefox-3.0-1.fc9.x86_64) doesn't crash on
the same system where I observed the original crash.
Comment 8 Martin Stransky 2008-10-24 15:14:51 UTC 
Okay, closing as currentrelease...