I am sorry, but we would need instead of using "bt" in gdb to use

thread apply all backtrace

Also, try firefox -safe-mode to eliminate a possibility that the problem is somewhere in the extensions you have loaded (although firefox shouldn't crash anyway).

Thanks a lot

The segfault also persists in safe-mode:
$ firefox -safe-mode
/usr/lib/firefox-3.0.1/run-mozilla.sh: line 131: 12023 Segmentation fault      "$prog" ${1+"$@"}

Here's the backtrace that you requested from a segfault:

####################
[New Thread 0xb318cb90 (LWP 11758)]
[Thread 0xb318cb90 (LWP 11758) exited]

Program received signal SIGSEGV, Segmentation fault.
0x008ce8be in NSSRWLock_LockRead_Util () from /lib/libnssutil3.so
Missing separate debuginfos, use: debuginfo-install ORBit2.i386 alsa-lib.i386 audiofile.i386 avahi.i386 bzip2.i386 cyrus-sasl.i386 dbus-glib.i386 dbus.i386 e2fsprogs.i386 esound.i386 expat.i386 fontconfig.i386 freetype.i386 gail.i386 gnome-keyring.i386 hunspell.i386 keyutils.i386 krb5.i386 lcms.i386 libICE.i386 libSM.i386 libX11.i386 libXScrnSaver.i386 libXau.i386 libXcomposite.i386 libXcursor.i386 libXdmcp.i386 libXext.i386 libXfixes.i386 libXft.i386 libXi.i386 libXinerama.i386 libXrandr.i386 libXrender.i386 libXt.i386 libart_lgpl.i386 libbonobo.i386 libbonoboui.i386 libcap.i386 libcroco.i386 libflashsupport.i386 libgnome.i386 libgnomecanvas.i386 libgnomeui.i386 libgsf.i386 libidn.i386 libjpeg.i386 libpng.i386 librsvg2.i386 libselinux.i386 libxcb.i386 libxml2.i386 nss.i386 openldap.i386 openssl.i686 pixman.i386 popt.i386 pulseaudio.i386 sqlite.i386 zlib.i386
(gdb) thread apply all backtrace

Thread 12 (Thread 0xb69eeb90 (LWP 11726)):
#0  0x00110416 in __kernel_vsyscall ()
#1  0x00dc8ed2 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x00703dbe in pt_TimedWait (cv=<value optimized out>, ml=<value optimized out>, timeout=Could not find the frame base for "pt_TimedWait".
)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:280
#3  0x00704be0 in PR_WaitCondVar (cvar=<value optimized out>, timeout=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:407
#4  0x0570e017 in nsHostResolver::GetHostToLookup (this=<value optimized out>, result=Could not find the frame base for "nsHostResolver::GetHostToLookup(nsHostRecord**)".
)
    at nsHostResolver.cpp:595
#5  0x0570e724 in nsHostResolver::ThreadFunc (arg=<value optimized out>) at nsHostResolver.cpp:690
#6  0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#7  0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#8  0x001ef20e in clone () from /lib/libc.so.6

Thread 11 (Thread 0xb4a55b90 (LWP 11725)):
#0  0x00110416 in __kernel_vsyscall ()
#1  0x00dc8ba5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x00704c57 in PR_WaitCondVar (cvar=<value optimized out>, timeout=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:405
#3  0x00704cd7 in PR_Wait (mon=Could not find the frame base for "PR_Wait".
) at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:584
#4  0x05ed531d in nsEventQueue::GetEvent (this=<value optimized out>, mayWait=<value optimized out>, 
    result=<value optimized out>) at ../../dist/include/xpcom/nsAutoLock.h:340
#5  0x05ed61c8 in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.h:112
#6  0x05ea3188 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#7  0x05ed6aa0 in nsThread::ThreadFunc (arg=<value optimized out>) at nsThread.cpp:254
#8  0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#9  0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#10 0x001ef20e in clone () from /lib/libc.so.6

Thread 10 (Thread 0xb278bb90 (LWP 11724)):
#0  0x00110416 in __kernel_vsyscall ()
#1  0x00dc8ed2 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x00703dbe in pt_TimedWait (cv=<value optimized out>, ml=<value optimized out>, timeout=Could not find the frame base for "pt_TimedWait".
)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:280
#3  0x00704be0 in PR_WaitCondVar (cvar=<value optimized out>, timeout=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:407
#4  0x00704cd7 in PR_Wait (mon=Could not find the frame base for "PR_Wait".
) at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:584
#5  0x05ed8337 in nsThreadPool::Run (this=<value optimized out>)
    at ../../dist/include/xpcom/nsAutoLock.h:340
#6  0x05ed61f2 in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:510
#7  0x05ea3188 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#8  0x05ed6aa0 in nsThread::ThreadFunc (arg=<value optimized out>) at nsThread.cpp:254
#9  0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#10 0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#11 0x001ef20e in clone () from /lib/libc.so.6

Thread 6 (Thread 0xb55ecb90 (LWP 11707)):
#0  0x00110416 in __kernel_vsyscall ()
#1  0x00dc8ba5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x00704c57 in PR_WaitCondVar (cvar=<value optimized out>, timeout=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:405
#3  0x05cf1f3d in nsCertVerificationThread::Run (this=<value optimized out>)
    at nsCertVerificationThread.cpp:138
#4  0x05cf06e2 in nsPSMBackgroundThread::nsThreadRunner (arg=Could not find the frame base for "nsPSMBackgroundThread::nsThreadRunner(void*)".
) at nsPSMBackgroundThread.cpp:44
#5  0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#6  0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#7  0x001ef20e in clone () from /lib/libc.so.6

Thread 5 (Thread 0xb5fedb90 (LWP 11706)):
---Type <return> to continue, or q <return> to quit---
#0  0x00110416 in __kernel_vsyscall ()
#1  0x00dc8ba5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x00704c57 in PR_WaitCondVar (cvar=<value optimized out>, timeout=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:405
#3  0x05cf0dcd in nsSSLThread::Run (this=<value optimized out>) at nsSSLThread.cpp:964
#4  0x05cf06e2 in nsPSMBackgroundThread::nsThreadRunner (arg=Could not find the frame base for "nsPSMBackgroundThread::nsThreadRunner(void*)".
) at nsPSMBackgroundThread.cpp:44
#5  0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#6  0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#7  0x001ef20e in clone () from /lib/libc.so.6

Thread 3 (Thread 0xb748bb90 (LWP 11704)):
#0  0x00110416 in __kernel_vsyscall ()
#1  0x00dc8ed2 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x00703dbe in pt_TimedWait (cv=<value optimized out>, ml=<value optimized out>, timeout=Could not find the frame base for "pt_TimedWait".
)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:280
#3  0x00704be0 in PR_WaitCondVar (cvar=<value optimized out>, timeout=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptsynch.c:407
#4  0x05ed984a in TimerThread::Run (this=<value optimized out>) at TimerThread.cpp:345
#5  0x05ed61f2 in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:510
#6  0x05ea3188 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#7  0x05ed6aa0 in nsThread::ThreadFunc (arg=<value optimized out>) at nsThread.cpp:254
#8  0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#9  0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#10 0x001ef20e in clone () from /lib/libc.so.6

Thread 2 (Thread 0xb7e8cb90 (LWP 11703)):
#0  0x00110416 in __kernel_vsyscall ()
#1  0x001e4a57 in __poll (fds=<value optimized out>, nfds=<value optimized out>, 
    timeout=<value optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:87
#2  0x00706b34 in _pr_poll_with_poll (pds=<value optimized out>, npds=<value optimized out>,
    timeout=<value optimized out>) at ../../../mozilla/nsprpub/pr/src/pthreads/ptio.c:3895
#3  0x05703f59 in nsSocketTransportService::Poll (this=<value optimized out>, 
    wait=<value optimized out>, interval=Could not find the frame base for "nsSocketTransportService::Poll(int, unsigned int*)".
) at nsSocketTransportService2.cpp:349
#4  0x0570446e in nsSocketTransportService::DoPollIteration (this=<value optimized out>, 
    wait=<value optimized out>) at nsSocketTransportService2.cpp:644
#5  0x0570472a in nsSocketTransportService::OnProcessNextEvent (this=<value optimized out>, 
    thread=<value optimized out>, mayWait=<value optimized out>, depth=<value optimized out>)
    at nsSocketTransportService2.cpp:523
#6  0x05ed6196 in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:497
#7  0x05ea3188 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#8  0x05704185 in nsSocketTransportService::Run (this=<value optimized out>)
    at nsSocketTransportService2.cpp:565
#9  0x05ed61f2 in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:510
#10 0x05ea3188 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#11 0x05ed6aa0 in nsThread::ThreadFunc (arg=<value optimized out>) at nsThread.cpp:254
#12 0x0070af51 in _pt_root (arg=<value optimized out>)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:221
#13 0x00dc532f in start_thread (arg=<value optimized out>) at pthread_create.c:297
#14 0x001ef20e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb808d6d0 (LWP 11679)):
#0  0x008ce8be in NSSRWLock_LockRead_Util () from /lib/libnssutil3.so
#1  0x0532b2cd in SECMOD_GetReadLock () from /lib/libnss3.so
#2  0x05341a37 in PK11_GetAllTokens () from /lib/libnss3.so
#3  0x05342160 in PK11_GetBestSlotMultiple () from /lib/libnss3.so
#4  0x053421ec in PK11_GetBestSlot () from /lib/libnss3.so
#5  0x0534229e in PK11_RandomUpdate () from /lib/libnss3.so
#6  0x05cf8641 in nsNSSComponent::RandomUpdate (this=<value optimized out>, 
    entropy=<value optimized out>, bufLen=<value optimized out>) at nsNSSComponent.cpp:1943
#7  0x05ce89a8 in nsEntropyCollector::RandomUpdate (this=<value optimized out>,
    new_entropy=<value optimized out>, bufLen=<value optimized out>) at nsEntropyCollector.cpp:68
#8  0x05abfbdf in nsGlobalWindow::PreHandleEvent (this=Could not find the frame base for "nsGlobalWindow::PreHandleEvent(nsEventChainPreVisitor&)".
) at nsGlobalWindow.cpp:2189
#9  0x059d274b in nsEventTargetChainItem::PreHandleEvent (this=<value optimized out>, 
    aVisitor=<value optimized out>) at nsEventDispatcher.cpp:186
#10 0x059d2e08 in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, 
    aPresContext=<value optimized out>, aEvent=<value optimized out>, 
    aDOMEvent=<value optimized out>, aEventStatus=<value optimized out>, 
    aCallback=<value optimized out>) at nsEventDispatcher.cpp:468
#11 0x0583175e in PresShell::HandleEventInternal (this=<value optimized out>, 
    aEvent=<value optimized out>, aView=<value optimized out>, aStatus=<value optimized out>)
    at nsPresShell.cpp:5921
#12 0x05831efd in PresShell::HandlePositionedEvent (this=<value optimized out>, aView=Could not find the frame base for "PresShell::HandlePositionedEvent(nsIView*, nsIFrame*, nsGUIEvent*, nsEventStatus*)".
)
    at nsPresShell.cpp:5809
#13 0x05832307 in PresShell::HandleEvent (this=<value optimized out>, aView=<value optimized out>, 
    aEvent=<value optimized out>, aEventStatus=<value optimized out>) at nsPresShell.cpp:5669
#14 0x05aaab2a in nsViewManager::HandleEvent (this=Could not find the frame base for "nsViewManager::HandleEvent(nsView*, nsPoint, nsGUIEvent*, int)".
) at nsViewManager.cpp:1382
#15 0x05aac8a3 in nsViewManager::DispatchEvent (this=<value optimized out>, 
    aEvent=<value optimized out>, aStatus=<value optimized out>) at nsViewManager.cpp:1337
#16 0x05aa7594 in HandleEvent (aEvent=<value optimized out>) at nsView.cpp:168
#17 0x05e03404 in nsCommonWidget::DispatchEvent (this=<value optimized out>, aEvent=Could not find the frame base for "nsCommonWidget::DispatchEvent(nsGUIEvent*, nsEventStatus&)".
)
    at nsCommonWidget.cpp:158
#18 0x05dfdbf0 in nsWindow::OnMotionNotifyEvent (this=<value optimized out>, aWidget=Could not find the frame base for "nsWindow::OnMotionNotifyEvent(_GtkWidget*, _GdkEventMotion*)".
)
    at nsWindow.cpp:2023
#19 0x05dfddbd in motion_notify_event_cb (widget=Could not find the frame base for "motion_notify_event_cb".
) at nsWindow.cpp:4640
#20 0x04e573f6 in _gtk_marshal_BOOLEAN__BOXED (closure=Could not find the frame base for "_gtk_marshal_BOOLEAN__BOXED".
) at gtkmarshalers.c:84
#21 0x049d412b in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>) at gclosure.c:490
#22 0x049e8995 in signal_emit_unlocked_R (node=<value optimized out>, detail=<value optimized out>, 
    instance=<value optimized out>, emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:2440
#23 0x049e9d58 in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, var_args=<value optimized out>)
    at gsignal.c:2209
#24 0x049ea336 in IA__g_signal_emit (instance=Could not find the frame base for "IA__g_signal_emit".
) at gsignal.c:2243
#25 0x04fc8d84 in gtk_widget_event_internal (widget=Could not find the frame base for "gtk_widget_event_internal".
) at gtkwidget.c:4678
#26 0x04fc88ac in IA__gtk_widget_event (widget=Could not find the frame base for "IA__gtk_widget_event".
) at gtkwidget.c:4478
#27 0x04e559b3 in IA__gtk_propagate_event (widget=Could not find the frame base for "IA__gtk_propagate_event".
) at gtkmain.c:2336
#28 0x04e5449d in IA__gtk_main_do_event (event=Could not find the frame base for "IA__gtk_main_do_event".
) at gtkmain.c:1556
#29 0x04c94fc0 in gdk_event_dispatch (source=Could not find the frame base for "gdk_event_dispatch".
) at gdkevents-x11.c:2351
#30 0x046ad0d8 in IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2012
#31 0x046b0783 in g_main_context_iterate (context=<value optimized out>, 
    block=<value optimized out>, dispatch=<value optimized out>, self=Could not find the frame base for "g_main_context_iterate".
) at gmain.c:2645
#32 0x046b0941 in IA__g_main_context_iteration (context=<value optimized out>, 
    may_block=<value optimized out>) at gmain.c:2708
#33 0x05e01af0 in nsAppShell::ProcessNextNativeEvent (this=Could not find the frame base for "nsAppShell::ProcessNextNativeEvent(int)".
) at nsAppShell.cpp:144
#34 0x05e18700 in nsBaseAppShell::DoProcessNextNativeEvent (this=Could not find the frame base for "nsBaseAppShell::DoProcessNextNativeEvent(int)".
) at nsBaseAppShell.cpp:151
#35 0x05e18897 in nsBaseAppShell::OnProcessNextEvent (this=<value optimized out>, 
    thr=<value optimized out>, mayWait=<value optimized out>, recursionDepth=Could not find the frame base for "nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)".
)
    at nsBaseAppShell.cpp:296
#36 0x05ed6196 in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>) at nsThread.cpp:497
#37 0x05ea3188 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at nsThreadUtils.cpp:227
#38 0x05e189e0 in nsBaseAppShell::Run (this=<value optimized out>) at nsBaseAppShell.cpp:170
#39 0x05cccce8 in nsAppStartup::Run (this=<value optimized out>) at nsAppStartup.cpp:181
#40 0x0569cd71 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, 
    aAppData=<value optimized out>) at nsAppRunner.cpp:3170
#41 0x08049169 in main (argc=1, argv=0xbfcaac14) at nsXULStub.cpp:364

####################################

It appears not having nspluginwrapper installed causes this bug to happen much more frequently (almost every page load causes firefox to crash).  Reinstalling nspluginwrapper has greatly reduced the number of crashes however that leads to BZ# 459011.

Created attachment 344639 [details]
Backtrace

Kai can you have a look, whether this is NSS, or Firefox, please?

Happens here for F11 Firefox.

Reproducer:

Go to: https://testopia.devel.redhat.com/bugzilla/tr_show_case.cgi?case_id=8681
Press second button (the middle one) in the right white text field right after the word "chosen", it stacks for 5s and then crashes.

firefox-3.5-0.20.beta4.fc11.x86_64
xulrunner-1.9.1-0.20.beta4.fc11.x86_64
nss-3.12.3-4.fc11.x86_64
nspr-4.7.3-5.fc11.x86_64

dhcp-lab-124 ccpp-1242745137-20486 # for i in cmdline kernel package release time uid; do cat $i; echo; done
/usr/lib64/firefox-3.5b4/firefox 
2.6.29.3-140.fc11.x86_64
firefox-3.5-0.20.beta4.fc11
Fedora release 11 (Leonidas)
1242745137
500

The stacks in comment 0 and in comment 2 point to some NSS function crashing.

But the stack attached is not in NSS, it's in thread 1, around using clipboard and html editor?

Two different crashes?

Comment 0 was filed against Fedora 9, Firefox 3.0.1, NSS 3.12.0, which are quite old by now, a lot has changed since then.

I'd like to hear feedback from the reporter, whether the bug still occurrs with the more recent versions, Firefox 3.0.10, NSS 3.12.2

Thanks


Regarding the stack attached in comment 5, I think it's a different crash, NOT related to NSS.

Thanks Kai, filled bug 501685 instead.

This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Reporter, could you please reply to the question in comment 7? If you won't reply in one month, I will have to close this bug as INSUFFICIENT_DATA. Thank you.

Sorry, this is Fedora 9, so it is not a month ... unless you can reproduce this in more recent version of Fedora, this bug is almost dead.

Fedora 9 changed to end-of-life (EOL) status on 2009-07-10. Fedora 9 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.

stupid bugzilla spamming me with needinfo emails, on a bug that's been closed for over a decade.