This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 494700 - firefox crash while setting cookie
firefox crash while setting cookie
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: firefox (Show other bugs)
10
All Linux
low Severity medium
: ---
: ---
Assigned To: Gecko Maintainer
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-04-07 16:04 EDT by Steve Tyler
Modified: 2009-04-30 12:26 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-30 12:26:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
gdb backtrace with symbols (21.09 KB, text/plain)
2009-04-07 16:06 EDT, Steve Tyler
no flags Details
gdb backtrace with symbols -- firefox-3.0.10-1.fc10.i386 (18.31 KB, text/plain)
2009-04-30 07:33 EDT, Steve Tyler
no flags Details
gdb backtrace with symbols -- crash while in safe-mode (18.82 KB, text/plain)
2009-04-30 08:14 EDT, Steve Tyler
no flags Details

  None (edit)
Description Steve Tyler 2009-04-07 16:04:13 EDT
Description of problem:
Firefox crashed while setting a cookie.
I have Firefox configured to always ask before setting a cookie,
and the crash, IIRC, occurred after I clicked "Allow for Session" or "Deny".

Version-Release number of selected component (if applicable):
firefox-3.0.8-1.fc10.i386

How reproducible:
Not sure.

Additional info:
Attached gdb backtrace captured by following instructions in Bug 491765.

Package info to follow.
Comment 1 Steve Tyler 2009-04-07 16:06:29 EDT
Created attachment 338591 [details]
gdb backtrace with symbols
Comment 2 Steve Tyler 2009-04-07 16:10:48 EDT
$ rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin* | sort
alsa-plugins-pulseaudio-1.0.18-2.fc10.i386
anaconda-yum-plugins-1.0-3.fc10.noarch
flash-plugin-10.0.22.87-release.i386
gedit-plugins-2.22.3-2.fc10.i386
gnumeric-plugins-extras-1.8.2-6.fc10.i386
gstreamer-plugins-bad-0.10.9-1.fc10.i386
gstreamer-plugins-base-0.10.21-2.fc10.i386
gstreamer-plugins-flumpegdemux-0.10.15-4.fc10.i386
gstreamer-plugins-good-0.10.13-1.fc10.i386
gstreamer-plugins-ugly-0.10.10-2.fc10.i386
mozilla-filesystem-1.9-2.fc10.i386
PackageKit-gstreamer-plugin-0.3.14-1.fc10.i386
PackageKit-yum-plugin-0.3.14-1.fc10.i386
plymouth-plugin-label-0.6.0-0.2008.11.17.3.fc10.i386
plymouth-plugin-solar-0.6.0-0.2008.11.17.3.fc10.i386
plymouth-system-plugin-0.6.0-0.2008.11.17.3.fc10.i386
setroubleshoot-plugins-2.0.12-1.fc10.noarch
totem-mozplugin-2.24.3-1.fc10.i386
xulrunner-1.9.0.8-1.fc10.i386
xulrunner-debuginfo-1.9.0.8-1.fc10.i386
Comment 3 Martin Stransky 2009-04-08 02:32:27 EDT
Dou you have any reproducer? Steps how we can replicate the crash?
Comment 4 Steve Tyler 2009-04-08 16:36:16 EDT
(In reply to comment #3)
> Dou you have any reproducer? Steps how we can replicate the crash?  

I had the same crash again and believe these are the steps.

1. Configure Firefox to always ask before accepting cookies:
    Accept cookies from sites: yes
    Accept third-party cookies: no
    Keep until: "ask me every time"
2. Before each test run, clear all private data and
    remove all sites from the list of Cookies:Exceptions.
3. Browse to http://www.oregonlive.com/
4. A "Confirm setting cookie" dialog appears.
    Check "Use my choice ...", if not already checked.
    Click "Allow for Session" for the first cookie.
5. Click "Deny" for the second cookie.
   At this point Firefox sometimes crashes.

With a clean Firefox configuration, FF does not crash,
but there is a difference.
After accepting the first cookie, a stack of three more
"Confirm setting cookie" dialogs appears.
IIRC, this stack did not appear in the case when FF crashed.

I also have these FF extensions installed:
Ablock Plus 1.0.1
Clone Window 0.2.9
Flashblock 1.5.9
SQLite Manager 0.4.8
Comment 5 Steve Tyler 2009-04-08 17:08:34 EDT
(In reply to comment #4)
> With a clean Firefox configuration, FF does not crash,

With a cleanish config, I just had FF crash again and in the same way
(confirmed by looking at the gdb backtrace from the core file).
By "cleanish", I mean the above extensions are installed,
and the toolbar config is modified.

This time, after clicking "Accept" as above,
a stack of two "Confirm" dialogs appeared, and,
before the third dialog appeared,
I clicked "Deny" and then FF crashed.

Usually the three "Confirm" dialogs are stacked too quickly
to click on the first or second one.
Comment 6 Matěj Cepl 2009-04-29 18:12:06 EDT
Cannot reproduce here ... could you reproduce it with firefox running in the safe mode (i.e., run firefox -safe-mode from the terminal emulator)?

Thanks
Comment 7 Steve Tyler 2009-04-30 07:31:16 EDT
(In reply to comment #6)
> Cannot reproduce here ... could you reproduce it with firefox running in the
> safe mode (i.e., run firefox -safe-mode from the terminal emulator)?
> 
> Thanks  

Got it to crash again (*not* in safe-mode -- will try that next).

$ rpm -qa '*xulrun*' '*firefox*' '*mozilla*' '*flash*' '*plugin*' | sort
alsa-plugins-pulseaudio-1.0.18-2.fc10.i386
anaconda-yum-plugins-1.0-3.fc10.noarch
firefox-3.0.10-1.fc10.i386
firefox-debuginfo-3.0.10-1.fc10.i386
flash-plugin-10.0.22.87-release.i386
gedit-plugins-2.22.3-2.fc10.i386
gnumeric-plugins-extras-1.8.2-6.fc10.i386
gstreamer-plugins-bad-0.10.9-1.fc10.i386
gstreamer-plugins-base-0.10.21-2.fc10.i386
gstreamer-plugins-flumpegdemux-0.10.15-4.fc10.i386
gstreamer-plugins-good-0.10.13-1.fc10.i386
gstreamer-plugins-ugly-0.10.10-2.fc10.i386
mozilla-filesystem-1.9-2.fc10.i386
PackageKit-gstreamer-plugin-0.3.15-2.fc10.i386
PackageKit-yum-plugin-0.3.15-2.fc10.i386
plymouth-plugin-label-0.6.0-0.2008.11.17.3.fc10.i386
plymouth-plugin-solar-0.6.0-0.2008.11.17.3.fc10.i386
plymouth-system-plugin-0.6.0-0.2008.11.17.3.fc10.i386
setroubleshoot-plugins-2.0.12-1.fc10.noarch
totem-mozplugin-2.24.3-1.fc10.i386
xulrunner-1.9.0.10-1.fc10.i386
xulrunner-debuginfo-1.9.0.10-1.fc10.i386
Comment 8 Steve Tyler 2009-04-30 07:33:59 EDT
Created attachment 341909 [details]
gdb backtrace with symbols -- firefox-3.0.10-1.fc10.i386
Comment 9 Steve Tyler 2009-04-30 08:14:37 EDT
Created attachment 341913 [details]
gdb backtrace with symbols -- crash while in safe-mode

$ firefox -safe-mode
/usr/lib/firefox-3.0.10/run-mozilla.sh: line 131:  5742 Segmentation fault      (core dumped) "$prog" ${1+"$@"}
Comment 10 Steve Tyler 2009-04-30 08:26:26 EDT
(In reply to comment #9)
> Created an attachment (id=341913) [details]
> gdb backtrace with symbols -- crash while in safe-mode
> 
> $ firefox -safe-mode
> /usr/lib/firefox-3.0.10/run-mozilla.sh: line 131:  5742 Segmentation fault     
> (core dumped) "$prog" ${1+"$@"}  

FWIW, it took 12 attempts to get firefox to crash.

$ history | fgrep 'firefox -safe-mode' | fgrep -v history | wc -l
12
Comment 11 Martin Stransky 2009-04-30 10:08:20 EDT
The bug looks familiar, firefox tries to addref already deleted object. The reference comes from GTK widget which is waiting for destruction. This bug is fixed in 3.1 so it should be fixed in Fedora 11.
Comment 12 Matěj Cepl 2009-04-30 12:26:10 EDT
OK, so it will be fixed in the next release of Fedora.

Note You need to log in before you can comment on or make changes to this bug.