Bug 904168

Summary: [abrt] xulrunner-18.0-6.fc18: mozalloc_abort: Process /usr/lib64/xulrunner/plugin-container was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Antoine Cotten <hello>
Component: xulrunnerAssignee: Martin Stransky <stransky>
Status: CLOSED CANTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: caillon+fedoraproject, gecko-bugs-nobody, hello, john.j5live, pradhanphy, stransky, walters, zalewski.marek
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:6ede6d3f9eb26281c95a62085845648b63877599
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-29 14:44:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Antoine Cotten 2013-01-25 16:30:37 UTC
Description of problem:
Tried to play the Facebook game called "SpotIt!" on Firefox. It happens everytime.

Version-Release number of selected component:
xulrunner-18.0-6.fc18

Additional info:
backtrace_rating: 3
cmdline:        /usr/lib64/xulrunner/plugin-container /usr/lib64/flash-plugin/libflashplayer.so -greomni /usr/lib64/xulrunner/omni.ja -appomni /usr/lib64/firefox/omni.ja 2116 true plugin
crash_function: mozalloc_abort
executable:     /usr/lib64/xulrunner/plugin-container
kernel:         3.7.2-204.fc18.x86_64
remote_result:  695948
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 mozalloc_abort at /usr/src/debug/xulrunner-18.0/mozilla-release/memory/mozalloc/mozalloc_abort.cpp:23
 #1 Abort at /usr/src/debug/xulrunner-18.0/mozilla-release/xpcom/base/nsDebugImpl.cpp:423
 #2 NS_DebugBreak_P at /usr/src/debug/xulrunner-18.0/mozilla-release/xpcom/base/nsDebugImpl.cpp:410
 #3 X11Error at /usr/src/debug/xulrunner-18.0/mozilla-release/toolkit/xre/nsX11ErrorHandler.cpp:157
 #5 handle_error at xcb_io.c:212
 #6 handle_response at xcb_io.c:324
 #7 _XEventsQueued at xcb_io.c:363
 #8 XPending at Pending.c:55
 #9 gdk_check_xpending at gdkevents-x11.c:159
 #10 gdk_event_prepare at gdkevents-x11.c:2361

Potential duplicate: bug 711839

Comment 1 Antoine Cotten 2013-01-25 16:30:41 UTC
Created attachment 687547 [details]
File: backtrace

Comment 2 Antoine Cotten 2013-01-25 16:30:45 UTC
Created attachment 687548 [details]
File: cgroup

Comment 3 Antoine Cotten 2013-01-25 16:30:48 UTC
Created attachment 687549 [details]
File: core_backtrace

Comment 4 Antoine Cotten 2013-01-25 16:30:51 UTC
Created attachment 687550 [details]
File: dso_list

Comment 5 Antoine Cotten 2013-01-25 16:30:53 UTC
Created attachment 687551 [details]
File: environ

Comment 6 Antoine Cotten 2013-01-25 16:30:55 UTC
Created attachment 687552 [details]
File: limits

Comment 7 Antoine Cotten 2013-01-25 16:30:57 UTC
Created attachment 687553 [details]
File: maps

Comment 8 Antoine Cotten 2013-01-25 16:30:59 UTC
Created attachment 687554 [details]
File: open_fds

Comment 9 Antoine Cotten 2013-01-25 16:31:02 UTC
Created attachment 687555 [details]
File: proc_pid_status

Comment 10 Antoine Cotten 2013-01-25 16:31:05 UTC
Created attachment 687556 [details]
File: var_log_messages

Comment 11 Martin Stransky 2013-02-07 13:16:41 UTC
This is an automated bug processing. If you can reproduce the reported bug, please reopen it and assign directly to me (stransky). Thanks!

Comment 12 Antoine Cotten 2013-03-05 15:56:47 UTC
It actually still happens on Firefox with xulrunner, I don't have the issue with Chrome browser and it's "PeppperFlash" native plugin.

URL of the game: http://apps.facebook.com/spot-it/

Comment 13 Antoine Cotten 2013-03-05 16:05:03 UTC
Sorry Martin I can not edit the bug assignee myself, it's locked on Gecko Maintainer.

Comment 14 Martin Stransky 2013-03-15 17:27:00 UTC
This is an automated bug update. If you can reproduce the crash (do you have a reproduction steps, the crash occurs reliably), please reopen the bug. Thanks!

Comment 15 Antoine Cotten 2013-03-15 17:38:40 UTC
The reproduction steps are quite easy:

1) Open firefox browser (my version: firefox.x86_64 19.0.2-1.fc18)
2) Visit this URL http://apps.facebook.com/spot-it/ (facebook account needed)
3) The flash app loads up to 50%
4) xulrunner gets killed by SIGNAL 11 (my version: xulrunner.x86_64 19.0.2-1.fc18)
5) Adobe Flash plugin gets killed (my version: flash-plugin.x86_64 11.2.202.275-release)

This is definitely a xulrunner issue. The app itself seems fine, no crash happens on IE9/10 (Win7/8), Chrome (Linux, Win7/8, OSX) not Firefox 19 for Win & OSX.

Comment 16 Antoine Cotten 2013-03-18 14:09:01 UTC
This one is hard to reproduce if you do not have a VMware vSphere environment, but it also happens in vSphere 5.1 web client (it's a Flash interface) whenever you try to download a file from a datastore.

SELinux is off on my machineby the way.

Comment 17 Martin Stransky 2013-03-18 14:21:48 UTC
It says ABORT: X_ChangeWindowAttributes: BadWindow (invalid Window parameter), looks like a bad combination of a flash-plugin and the VMware vSphere environmet. Can you reproduce it with an upstream binary firefox, downloaded from mozilla.com?

Comment 18 Antoine Cotten 2013-03-18 16:12:53 UTC
Martin, I have just tried the upstream 19.0.2.x86_64 version of Firefox as you suggested, and the same thing happened with both vSphere client and Spot It! Facebook game. I have submitted crash reports for both of them.

Comment 19 Antoine Cotten 2013-03-18 16:23:14 UTC
For Spot It! game, the error message is:

###!!! ABORT: X_ChangeWindowAttributes: BadWindow (invalid Window parameter): file /builds/slave/rel-m-rel-l64_bld-000000000000/build/toolkit/xre/nsX11ErrorHandler.cpp, line 157


For vSphere the message is different:

2013-03-18 17:15:27.874 [/build/mts/release/bora-774810/bora/apps/vmplayer/plugin-common/settings.cpp:100]: Using settings file "/home/cotten/.vmrc-plugin-settings.js"
2013-03-18 17:15:33.857 [/build/mts/release/bora-774810/bora/apps/vmplayer/npplugin/common/ScriptableObject.cc:315]: Failed to get the plugin's NPObject: 9
2013-03-18 17:15:33.857 [/build/mts/release/bora-774810/bora/apps/vmplayer/npplugin/common/VmrcPlugin.cc:2624]: Failed to call onProcessNotification


I should maybe open a new bug, but for both of them Xulrunner receives a SIGNAL 11 and a message similar to this shows up in my audit.log:

type=ANOM_ABEND msg=audit(1363623581.875:560): auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4520 comm="plugin-containe" reason="memory violation" sig=11

Comment 20 Martin Stransky 2013-08-29 14:44:08 UTC
The selinux message looks like a bug in flash player. I'm afraid we can't fix crashes in flash, it's a closed source software.