Bug 6299 - Firefox crash maginea website
: Firefox crash maginea website
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: RPM Packages
: Cauldron
: x86_64 Linux
: High Severity: critical
: ---
Assigned To: Olivier Blin
:
: http://www.maginea.com/fr/fr/
:
:
:
:
  Show dependency treegraph
 
Reported: 2012-06-02 23:19 CEST by Philippe Flat
Modified: 2012-10-26 23:02 CEST (History)
8 users (show)

See Also:
Source RPM: firefox 13.0-4.mga3
CVE:
Status comment:


Attachments

Description Philippe Flat 2012-06-02 23:19:54 CEST
Description of problem:

After opening the maginea website, each time I want to do something in this site Firefox crash.
No problem with Konqueror.
Cauldron, X86_64, KDE up to date

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.open the website
2.move the mouse to go to a menu
3.Firefox crash
Comment 1 Philippe Flat 2012-06-03 19:38:48 CEST
I have the same problem on dailymotion: the crash appears when the mouse is on the video window and when the mouse moves.
I have lauched Firefox in a terminal, here is the message:
[philippe@localhost ~]$ firefox
WARNING: pipe error (3): Connexion ré-initialisée par le correspondant: file /home/iurt/rpm/BUILD/mozilla-release/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 419
Erreur de segmentation
[philippe@localhost ~]$
Comment 2 Olivier Blin 2012-06-03 21:27:24 CEST
Same here, it seems to happen when using a Flash plugin.

Maybe a symbol clash between libmozjs and internal firefox js?

Backtrace:
(gdb) bt
#0  0x00007fffcc8845c0 in ?? ()
#1  0x00007fffbdb318e9 in getProperty (receiver=0x7fffc0b977c0, vp=0x7fffffff93b0, id=<optimized out>, cx=0x7fffcd539900, this=0x7fffc0b977c0)
    at jsobj.h:1229
#2  getProperty (vp=0x7fffffff93b0, id=<optimized out>, cx=0x7fffcd539900, this=0x7fffc0b977c0) at jsobj.h:1233
#3  fun_hasInstance (cx=0x7fffcd539900, obj=0x7fffc0b977c0, v=0x7fffffff9640, bp=0x7fffffff943c) at jsfun.cpp:1937
#4  0x00007ffff5db08d8 in js::LooselyEqual (cx=0x7fffcd539900, lval=<optimized out>, rval=<optimized out>, result=0x7fffffff993f)
    at /usr/src/debug/mozilla-release/js/src/jsinterp.cpp:757
#5  0x00007ffff5db4640 in js::Interpret (cx=0x7fffcd539900, entryFrame=0x7fffdf1000a8, interpMode=js::JSINTERP_NORMAL)
    at /usr/src/debug/mozilla-release/js/src/jsinterp.cpp:2236
#6  0x00007ffff5dbf6b6 in js::InvokeKernel (cx=0x7fffcd539900, args=..., construct=<optimized out>)
    at /usr/src/debug/mozilla-release/js/src/jsinterp.cpp:529
#7  0x00007ffff5dbfc1e in Invoke (construct=js::NO_CONSTRUCT, args=..., cx=0x7fffcd539900) at /usr/src/debug/mozilla-release/js/src/jsinterp.h:172
#8  js::Invoke (cx=0x7fffcd539900, thisv=..., fval=..., argc=1, argv=<optimized out>, rval=0x7fffffff9e80)
    at /usr/src/debug/mozilla-release/js/src/jsinterp.cpp:561
#9  0x00007ffff5d4909c in JS_CallFunctionValue (cx=<optimized out>, obj=<optimized out>, fval=..., argc=<optimized out>, argv=<optimized out>, 
    rval=<optimized out>) at /usr/src/debug/mozilla-release/js/src/jsapi.cpp:5432
#10 0x00007ffff56d57db in nsXPCWrappedJSClass::CallMethod (this=<optimized out>, wrapper=<optimized out>, methodIndex=3, info=0x7fffe2f5ba18, 
    nativeParams=<optimized out>) at /usr/src/debug/mozilla-release/js/xpconnect/src/XPCWrappedJSClass.cpp:1518
#11 0x00007ffff56cf897 in nsXPCWrappedJS::CallMethod (this=0x7fffc87cda80, methodIndex=3, info=0x7fffe2f5ba18, params=0x7fffffffa170)
    at /usr/src/debug/mozilla-release/js/xpconnect/src/XPCWrappedJS.cpp:617
#12 0x00007ffff5b97bb6 in PrepareAndDispatch (self=0x7fffc5525c60, methodIndex=<optimized out>, args=<optimized out>, gpregs=0x7fffffffa250, fpregs=
    0x7fffffffa280) at /usr/src/debug/mozilla-release/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:153
#13 0x00007ffff5b970f3 in SharedStub () from /usr/lib64/firefox-13.0/libxul.so
#14 0x00007ffff5253de3 in nsEventListenerManager::HandleEventInternal (this=0x7fffc87cdb00, aPresContext=0x7fffbbbe9800, aEvent=0x7fffffffa540, 
    aDOMEvent=0x7fffffffa490, aCurrentTarget=0x7fffcc24c9b0, aFlags=6, aEventStatus=0x7fffffffa498, aPusher=0x7fffffffa4b0)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventListenerManager.cpp:800
#15 0x00007ffff52713e4 in HandleEvent (aEventStatus=0x7fffffffa498, aCurrentTarget=<optimized out>, aDOMEvent=0x7fffffffa490, 
    aEvent=<optimized out>, aPresContext=<optimized out>, this=<optimized out>, aPusher=0x7fffffffa4b0, aFlags=6)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventListenerManager.h:169
#16 HandleEvent (aPusher=0x7fffffffa4b0, aFlags=6, aVisitor=..., this=0x7fffdf54b3b8, aMayHaveNewListenerManagers=<optimized out>)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventDispatcher.cpp:216
#17 HandleEvent (aPusher=0x7fffffffa4b0, aMayHaveNewListenerManagers=<optimized out>, aFlags=6, aVisitor=..., this=0x7fffdf54b3b8)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventDispatcher.cpp:298
#18 nsEventTargetChainItem::HandleEventTargetChain (this=0x7fffdf54b348, aVisitor=..., aFlags=6, aCallback=0x7fffffffa5d0, 
    aMayHaveNewListenerManagers=<optimized out>, aPusher=0x7fffffffa4b0)
---Type <return> to continue, or q <return> to quit---
    at /usr/src/debug/mozilla-release/content/events/src/nsEventDispatcher.cpp:348
#19 0x00007ffff527221f in nsEventDispatcher::Dispatch (aTarget=<optimized out>, aPresContext=0x7fffbbbe9800, aEvent=0x7fffffffa540, aDOMEvent=0x0, 
    aEventStatus=0x7fffffffa5ec, aCallback=0x7fffffffa5d0, aTargets=0x0)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventDispatcher.cpp:682
#20 0x00007ffff525a6e6 in nsEventStateManager::DispatchMouseEvent (this=0x7fffc4c6bf20, aEvent=<optimized out>, aMessage=<optimized out>, 
    aTargetContent=0x7fffcc24c9b0, aRelatedContent=0x7fffc9065800) at /usr/src/debug/mozilla-release/content/events/src/nsEventStateManager.cpp:3805
#21 0x00007ffff525c003 in nsEventStateManager::NotifyMouseOut (this=0x7fffc4c6bf20, aEvent=0x7fffffffac00, aMovingInto=0x7fffc9065800)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventStateManager.cpp:3916
#22 0x00007ffff525c797 in nsEventStateManager::NotifyMouseOver (this=0x7fffc4c6bf20, aEvent=0x7fffffffac00, aContent=0x7fffc9065800)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventStateManager.cpp:3964
#23 0x00007ffff525cf63 in nsEventStateManager::GenerateMouseEnterExit (this=0x7fffc4c6bf20, aEvent=0x7fffffffac00)
    at /usr/src/debug/mozilla-release/content/events/src/nsEventStateManager.cpp:4003
#24 0x00007ffff525f870 in nsEventStateManager::PreHandleEvent (this=0x7fffc4c6bf20, aPresContext=0x7fffbbbe9800, aEvent=0x7fffffffac00, 
    aTargetFrame=0x7fffc5863788, aStatus=0x7fffffffab8c) at /usr/src/debug/mozilla-release/content/events/src/nsEventStateManager.cpp:1148
#25 0x00007ffff4fab354 in PresShell::HandleEventInternal (this=0x7fffc57407e0, aEvent=0x7fffffffac00, aStatus=0x7fffffffab8c)
    at /usr/src/debug/mozilla-release/layout/base/nsPresShell.cpp:6542
#26 0x00007ffff4faec0e in PresShell::HandlePositionedEvent (this=0x7fffc57407e0, aTargetFrame=<optimized out>, aEvent=0x7fffffffac00, aEventStatus=
    0x7fffffffab8c) at /usr/src/debug/mozilla-release/layout/base/nsPresShell.cpp:6230
#27 0x00007ffff4faf06e in PresShell::HandleEvent (this=0x7fffdd3f3220, aFrame=0x7fffc5863788, aEvent=0x7fffffffac00, 
    aDontRetargetEvents=<optimized out>, aEventStatus=0x7fffffffab8c) at /usr/src/debug/mozilla-release/layout/base/nsPresShell.cpp:6057
#28 0x00007ffff53a5319 in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0x7fffffffac00, aView=0x7fffd5c39de0, aStatus=0x7fffffffab8c)
    at /usr/src/debug/mozilla-release/view/src/nsViewManager.cpp:908
#29 0x00007ffff4fa2c1a in PresShell::DispatchSynthMouseMove (this=0x7fffc57407e0, aEvent=<optimized out>, aFlushOnHoverChange=true)
    at /usr/src/debug/mozilla-release/layout/base/nsPresShell.cpp:3549
#30 0x00007ffff4fa9e51 in PresShell::ProcessSynthMouseMoveEvent (this=0x7fffdd3f3220, aFromScroll=false)
    at /usr/src/debug/mozilla-release/layout/base/nsPresShell.cpp:5315
#31 0x00007ffff4fb2989 in nsRefreshDriver::Notify (this=0x7fffdd3f3040, aTimer=<optimized out>)
    at /usr/src/debug/mozilla-release/layout/base/nsRefreshDriver.cpp:368
#32 0x00007ffff4fb30f5 in nsRefreshDriver::Notify (this=<optimized out>, aTimer=<optimized out>)
    at /usr/src/debug/mozilla-release/layout/base/nsRefreshDriver.cpp:338
#33 0x00007ffff5b87c69 in nsTimerImpl::Fire (this=0x7fffb44d2380) at /usr/src/debug/mozilla-release/xpcom/threads/nsTimerImpl.cpp:511
#34 0x00007ffff5b87ea0 in nsTimerEvent::Run (this=<optimized out>) at /usr/src/debug/mozilla-release/xpcom/threads/nsTimerImpl.cpp:591
#35 0x00007ffff5b841ee in nsThread::ProcessNextEvent (this=0x7fffe810fc10, mayWait=<optimized out>, result=0x7fffffffafef)
    at /usr/src/debug/mozilla-release/xpcom/threads/nsThread.cpp:657
#36 0x00007ffff5b4aa0a in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=true) at /usr/src/debug/obj/xpcom/build/nsThreadUtils.cpp:245
---Type <return> to continue, or q <return> to quit---
#37 0x00007ffff5a9fdf6 in mozilla::ipc::MessagePump::Run (this=0x7fffe8152f80, aDelegate=0x7ffff6ded180)
    at /usr/src/debug/mozilla-release/ipc/glue/MessagePump.cpp:134
#38 0x00007ffff5baf262 in RunInternal (this=<optimized out>) at /usr/src/debug/mozilla-release/ipc/chromium/src/base/message_loop.cc:208
#39 RunHandler (this=<optimized out>) at /usr/src/debug/mozilla-release/ipc/chromium/src/base/message_loop.cc:201
#40 MessageLoop::Run (this=<optimized out>) at /usr/src/debug/mozilla-release/ipc/chromium/src/base/message_loop.cc:175
#41 0x00007ffff59c31c0 in nsBaseAppShell::Run (this=0x7fffe2fc1be0) at /usr/src/debug/mozilla-release/widget/xpwidgets/nsBaseAppShell.cpp:189
#42 0x00007ffff582584e in nsAppStartup::Run (this=0x7fffe2fd6290) at /usr/src/debug/mozilla-release/toolkit/components/startup/nsAppStartup.cpp:295
#43 0x00007ffff4dbdb44 in XRE_main (argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>)
    at /usr/src/debug/mozilla-release/toolkit/xre/nsAppRunner.cpp:3703
#44 0x0000000000401fc5 in do_main (argv=0x7fffffffdb38, argc=2) at /usr/src/debug/mozilla-release/browser/app/nsBrowserApp.cpp:190
#45 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/mozilla-release/browser/app/nsBrowserApp.cpp:277
Comment 3 Philippe Flat 2012-06-05 22:24:41 CEST
I had the same problem today on a phoronix page (without flash).
The URL is : http://www.phoronix.com/scan.php?page=article&item=intel_ivy_tuning&num=1.
the problem appears when scrolling down.
Comment 4 Manuel Hiebel 2012-06-22 13:54:23 CEST
bug still valid ? (yes I'am lot sorry O:) )
there was a fix for some weeks iirc
Comment 5 Philippe Flat 2012-06-22 22:05:31 CEST
I have tried the fix given by Colin (libproxy) and it's OK.
Thanks
Comment 6 Olivier Blin 2012-06-24 16:36:16 CEST
Which fix?
If it is only about uninstalling lib64proxy-mozjs, this is not a fix, that's a mere workaround.
Default installations will still have this bug, reopening.
Comment 7 Olivier Blin 2012-06-25 00:50:51 CEST
openSUSE bug references:
https://bugzilla.novell.com/show_bug.cgi?id=759123
https://bugzilla.mozilla.org/show_bug.cgi?id=763185

They chose to disable libmozjs support in libproxy to fix it, but this means we would have to pull a huge webkit live on live CDs (to satisfy libproxy deps).

I have tried to build libxul.so with -Bsymbolic -Bsymbolic-functions linker flags, but it seems some exported symbols are still clashing between libxul.so and libmozjs185.so (pulled by libproxy).
Comment 8 Olivier Blin 2012-09-08 20:38:36 CEST
Working on it
Comment 9 Olivier Blin 2012-09-08 20:58:17 CEST
Fixed in libproxy-0.4.7-9.mga3

I have finally obsoleted the mozjs plugin, like OpenSUSE did.

Thomas: it will pull the additional libjavascriptcoregtk library on KDE live CDs, but that's better (smaller) than the previous builds which pulled the whole libwebkitgtk.
Comment 10 Olivier Blin 2012-09-08 20:59:27 CEST
https://bugzilla.mozilla.org/show_bug.cgi?id=423334 might also be related
Comment 11 Manuel Hiebel 2012-10-26 23:02:16 CEST
*** Bug 7237 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.