Ubuntu
flashplugin-nonfree package

Firefox 3.5 and above crash on full screen flash video

Bug #333127 reported by Sridhar Ratnakumar
336
This bug affects 52 people
Affects Status Importance Assigned to Milestone
Mozilla Firefox
Fix Released
Critical
firefox-3.5 (Fedora)
Fix Released
Medium
firefox-3.5 (Ubuntu)
Fix Released
High
Unassigned
flashplugin-nonfree (Ubuntu)
Invalid
Undecided
Unassigned

Bug Description

It worked before until I upgraded to Jaunty.

Youtube.com (or any other flash video) full screen crashes firefox! stdout is shown below:

~ $ firefox-3.1
Initialized TabTracker
Initializing TabStore!!
Initializing TabStore!!
*** glibc detected *** /usr/lib/firefox-3.1b3pre/firefox-3.1: free(): invalid pointer: 0xa8767e00 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7c93604]
/lib/tls/i686/cmov/libc.so.6(cfree+0x96)[0xb7c955b6]
/usr/lib/libGL.so.1[0xa44a7365]
======= Memory map: ========
08048000-0805a000 r-xp 00000000 08:01 704542 /usr/lib/firefox-3.1b3pre/firefox-3.1
0805a000-0805b000 r-xp 00011000 08:01 704542 /usr/lib/firefox-3.1b3pre/firefox-3.1
0805b000-0805c000 rwxp 00012000 08:01 704542 /usr/lib/firefox-3.1b3pre/firefox-3.1
0805c000-0805d000 rwxp 0805c000 00:00 0
a00ed000-a0e05000 r-xp 00000000 08:01 41813 /usr/lib/libGLcore.so.180.29
a0e05000-a0ff7000 rwxp 00d17000 08:01 41813 /usr/lib/libGLcore.so.180.29
a0ff7000-a1003000 rwxp a0ff7000 00:00 0
a1003000-a1004000 ---p a1003000 00:00 0
a1004000-a1804000 rwxp a1004000 00:00 0
a1804000-a1826000 r-xp a1804000 00:00 0
a1826000-a2100000 rwxp a1826000 00:00 0
a213f000-a2142000 r-xp a213f000 00:00 0
a2142000-a234d000 rwxp a2142000 00:00 0
a234d000-a234e000 r-xp a234d000 00:00 0
a234e000-a441a000 rwxp a234e000 00:00 0
a4446000-a44d3000 r-xp 00000000 08:01 41812 /usr/lib/libGL.so.180.29
a44d3000-a44f1000 rwxp 0008d000 08:01 41812 /usr/lib/libGL.so.180.29
a44f1000-a5c00000 rwxp a44f1000 00:00 0
a5cb2000-a5cb3000 ---p a5cb2000 00:00 0
a5cb3000-a64b3000 rwxp a5cb3000 00:00 0
a64b3000-a64b4000 ---p a64b3000 00:00 0
a64b4000-a6cb4000 rwxp a64b4000 00:00 0
a6cb4000-a6de6000 r-xp 00000000 08:01 49554 /usr/lib/i686/cmov/libcrypto.so.0.9.8
a6de6000-a6de7000 ---p 00132000 08:01 49554 /usr/lib/i686/cmov/libcrypto.so.0.9.8
a6de7000-a6def000 r-xp 00132000 08:01 49554 /usr/lib/i686/cmov/libcrypto.so.0.9.8
a6def000-a6dfc000 rwxp 0013a000 08:01 49554 /usr/lib/i686/cmov/libcrypto.so.0.9.8
a6dfc000-a7300000 rwxp a6dfc000 00:00 0
a7306000-a7339000 r-xp 00000000 08:01 707115 /usr/share/fonts/truetype/msttcorefonts/Arial_Italic.ttf
a7339000-a73b9000 rwxp a7339000 00:00 0
a73b9000-a73db000 r-xp 00000000 08:01 707102 /usr/share/fonts/truetype/msttcorefonts/Verdana_Bold.ttf
a73db000-a73fd000 r-xp 00000000 08:01 1270031 /usr/lib/libk5crypto.so.3.1
a73fd000-a73fe000 r-xp 00022000 08:01 1270031 /usr/lib/libk5crypto.so.3.1
a73fe000-a73ff000 rwxp 00023000 08:01 1270031 /usr/lib/libk5crypto.so.3.1
a73ff000-a7400000 ---p a73ff000 00:00 0
a7400000-ad500000 rwxp a7400000 00:00 0
ad50f000-ad59e000 r-xp 00000000 08:01 1270034 /usr/lib/libkrb5.so.3.3
ad59e000-ad5a0000 r-xp 0008e000 08:01 1270034 /usr/lib/libkrb5.so.3.3
ad5a0000-ad5a1000 rwxp 00090000 08:01 1270034 /usr/lib/libkrb5.so.3.3
ad5a1000-ad5b7000 r-xp 00000000 08:01 1269944 /usr/lib/libsasl2.so.2.0.22
ad5b7000-ad5b8000 r-xp 00015000 08:01 1269944 /usr/lib/libsasl2.so.2.0.22
ad5b8000-ad5b9000 rwxp 00016000 08:01 1269944 /usr/lib/libsasl2.so.2.0.22
ad5b9000-ad5fb000 r-xp 00000000 08:01 2637847 /usr/lib/i686/cmov/libssl.so.0.9.8
ad5fb000-ad5fc000 r-xp 00041000 08:01 2637847 /usr/lib/i686/cmov/libssl.so.0.9.8
ad5fc000-ad5ff000 rwxp 00042000 08:01 2637847 /usr/lib/i686/cmov/libssl.so.0.9.8
ad5ff000-ad600000 ---p ad5ff000 00:00 0
ad600000-ae000000 rwxp ad600000 00:00 0
ae011000-ae03a000 r-xp 00000000 08:01 1270027 /usr/lib/libgssapi_krb5.so.2.2
ae03a000-ae03b000 r-xp 00028000 08:01 1270027 /usr/lib/libgssapi_krb5.so.2.2
ae03b000-ae03c000 rwxp 00029000 08:01 1270027 /usr/lib/libgssapi_krb5.so.2.2
ae03c000-ae07c000 r-xp 00000000 08:01 1269949 /usr/lib/libldap_r-2.4.so.2.4.0
ae07c000-ae07d000 ---p 00040000 08:01 1269949 /usr/lib/libldap_r-2.4.so.2.4.0
ae07d000-ae07e000 r-xp 00040000 08:01 1269949 /usr/lib/libldap_r-2.4.so.2.4.0
ae07e000-ae07f000 rwxp 00041000 08:01 1269949 /usr/lib/libldap_r-2.4.so.2.4.0
ae07f000-ae080000 rwxp ae07f000 00:00 0
ae080000-ae08c000 r-xp 00000000 08:01 1269948 /usr/lib/liblber-2.4.so.2.4.0
ae08c000-ae08d000 r-xp 0000b000 08:01 1269948 /usr/lib/liblber-2.4.so.2.4.0
ae08d000-ae08e000 rwxp 0000c000 08:01 1269948 /usr/lib/liblber-2.4.so.2.4.0
ae08e000-ae0be000 r-xp 00000000 08:01 45112 /usr/lib/libidn.so.11.5.39
ae0be000-ae0bf000 ---p 00030000 08:01 45112 /usr/lib/libidn.so.11.5.39
ae0bf000-ae0c0000 r-xp 00030000 08:01 45112 /usr/lib/libidn.so.11.5.39
ae0c0000-ae0c1000 rwxp 00031000 08:01 45112 /usr/lib/libidn.so.11.5.39
ae0c1000-ae0fd000 r-xp 00000000 08:01 43810 /usr/lib/libcurl.so.4.1.0
ae0fd000-ae0fe000 r-xp 0003c000 08:01 43810 /usr/lib/libcurl.so.4.1.0
ae0fe000-ae0ff000 rwxp 0003d000 08:01 43810 /usr/lib/libcurl.so.4.1.0
ae0ff000-ae100000 ---p ae0ff000 00:00 0
ae100000-aea00000 rwxp ae100000 00:00 0
aea0d000-aea30000 r-xp 00000000 08:01 707134 /usr/share/fonts/truetype/msttcorefonts/Verdana.ttf
aea30000-aea76000 r-xp 00000000 08:01 707116 /usr/share/fonts/truetype/msttcorefonts/Arial_Bold.ttf
aea76000-aeaff000 r-xp 00000000 08:01 74031 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Bold.ttf
aeaff000-aeb00000 ---p aeaff000 00:00 0
aeb00000-af500000 rwxp aeb00000 00:00 0
af508000-af54c000 r-xp 00000000 08:01 707118 /usr/share/fonts/truetype/msttcorefonts/Arial.ttf
af54c000-af590000 r-xp 00000000 08:01 1925125 /home/srid/code/dotfiles/.fonts/Monaco_Linux.ttf
af590000-b0590000 rwxp af590000 00:00 0
b0590000-b0ee2000 r-xp 00000000 08:01 164101 /usr/lib/flashplugin-nonfree/libflashplayer.so
b0ee2000-b0f16000 rwxp 00951000 08:01 164101 /usr/lib/flashplugin-nonfree/libflashplayer.so
b0f16000-b1100000 rwxp b0f16000 00:00 0
b1118000-b1140000 r-xp 00000000 08:01 706364 /home/srid/.mozilla/firefox-3.1/idqso8bx.default/extensions/{3112ca9c-de6d-4884-a869-9855de68056c}/libraries/libgoogletoolbar-ff3.so
b1140000-b1143000 rwxp 00027000 08:01 706364 /home/srid/.mozilla/firefox-3.1/idqso8bx.default/extensions/{3112ca9c-de6d-4884-a869-9855de68056c}/libraries/libgoogletoolbar-ff3.so
b1143000-b1174000 r-xp 00000000 08:01 45438 /usr/lib/libcroco-0.6.so.3.0.1
b1174000-b1177000 rwxp 00030000 08:01 45438 /usr/lib/libcroco-0.6.so.3.0.1
b1177000-b11aa000 r-xp 00000000 08:01 1270229 /usr/lib/libgsf-1.so.114.0.11
b11aa000-b11ab000 ---p 00033000 08:01 1270229 /usr/lib/libgsf-1.so.114.0.11
b11ab000-b11ad000 r-xp 00033000 08:01 1270229 /usr/lib/libgsf-1.so.114.0.11
b11ad000-b11ae000 rwxp 00035000 08:01 1270229 /usr/lib/libgsf-1.so.114.0.11
b11ae000-b11af000 rwxp b11ae000 00:00 0
b11af000-b11e0000 r-xp 00000000 08:01 1270231 /usr/lib/librsvg-2.so.2.22.3
b11e0000-b11e1000 r-xp 00030000 08:01 1270231 /usr/lib/librsvg-2.so.2.22.3
b11e1000-b11e2000 rwxp 00031000 08:01 1270231 /usr/lib/librsvg-2.so.2.22.3
b11e2000-b1534000 r-xp 00000000 08:01 98450 /usr/share/icons/hicolor/icon-theme.cache
b1534000-b1c00000 r-xp 00000000 08:01 336869 /usr/share/icons/gnome/icon-theme.cache
b1c00000-b1f00000 rwxp b1c00000 00:00 0
b1f09000-b1f0b000 r-xp 00000000 08:01 2719839 /lib/libkeyutils-1.2.so
b1f0b000-b1f0c000 r-xp 00001000 08:01 2719839 /lib/libkeyutils-1.2.so
b1f0c000-b1f0d000 rwxp 00002000 08:01 2719839 /lib/libkeyutils-1.2.so
b1f0d000-b1f1c000 r-xp 00000000 08:01 2719764 /lib/libbz2.so.1.0.4
b1f1c000-b1f1d000 r-xp 0000f000 08:01 2719764 /lib/libbz2.so.1.0.4
b1f1d000-b1f1e000 rwxp 00010000 08:01 2719764 /lib/libbz2.so.1.0.4
b1f20000-b1f27000 r-xp 00000000 08:01 1270035 /usr/lib/libkrb5support.so.0.1
b1f27000-b1f28000 r-xp 00006000 08:01 1270035 /usr/lib/libkrb5support.so.0.1
b1f28000-b1f29000 rwxp 00007000 08:01 1270035 /usr/lib/libkrb5support.so.0.1
b1f29000-b1f31000 rwxp b1f29000 00:00 0
b1f31000-b1f77000 r-xp 00000000 08:01 2146426 /usr/lib/nss/libnssckbi.so
b1f77000-b1f7f000 r-xp 00045000 08:01 2146426 /usr/lib/nss/libnssckbi.so
b1f7f000-b1f83000 rwxp 0004d000 08:01 2146426 /usr/lib/nss/libnssckbi.so
b1f83000-b1fc7000 r-xp 00000000 08:01 2146423 /usr/lib/nss/libfreebl3.so
b1fc7000-b1fc8000 r-xp 00043000 08:01 2146423 /usr/lib/nss/libfreebl3.so
b1fc8000-b1fc9000 rwxp 00044000 08:01 2146423 /usr/lib/nss/libfreebl3.so
b1fc9000-b1ffd000 r-xp 00000000 08:01 2146424 /usr/lib/nss/libsoftokn3.so
b1ffd000-b1ffe000 r-xp 00034000 08:01 2146424 /usr/lib/nss/libsoftokn3.so
b1ffe000-b1fff000 rwxp 00035000 08:01 2146424 /usr/lib/nss/libsoftokn3.so
b1fff000-b2000000 ---p b1fff000 00:00 0
b2000000-b3200000 rwxp b2000000 00:00 0
b3202000-b3204000 r-xp 00000000 08:01 2719837 /lib/libcom_err.so.2.1
b3204000-b32050Aborted (core dumped)
~ $

See original description
Revision history for this message
In , cornel (cornel-redhat-bugs) wrote :
Download full text (4.3 KiB)

Description of problem:
while watching a video clip on youtube, when i try to see it full screen firefox crashes.

Version-Release number of selected component (if applicable):

# rpm -qa | grep xulrun
xulrunner-1.9.0.4-1.fc10.i386

# rpm -qa | grep firefox
firefox-3.0.4-1.fc10.i386

# rpm -qa | grep mozilla
mozilla-vlc-0.9.8a-1.fc10.i386
mozilla-filesystem-1.9-2.fc10.i386

# rpm -qa | grep flash
flashrom-0-0.14.20081103svn3723.fc9.i386
libflashsupport-000-0.5.svn20070904.i386
flash-plugin-9.0.124.0-release.i386

How reproducible:

Steps to Reproduce:
1.go to youtube.com
2.open one vide clip
3.after it starts playing, make it full screen

Actual results:
firefox crashes

Expected results:
the clip becomes full screen

Additional info:

at running firefox from terminal i got this:

$ firefox

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

(firefox:5905): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed
The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadLength (poly request too large or internal Xlib length erro'.
  (Details: serial 30874 error_code 16 request_code 144 minor_code 17)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)
/usr/lib/firefox-3.0.4/run-mozilla.sh: line 131: 5905 Segmentation fault "$prog" ${1+"$@"}

then i've searched bugzilla and found this bug:

https://bugzilla.redhat.com/show_bug.cgi?id=470780

but it was for rhel x86_64 so i decided to open another bug for f10 x86 :)

additional info requested there:

# rpm -qa | grep plugin
audacious-plugins-freeworld-wma-1.4.5-2.fc10.i386
mail-notification-evolution-plugin-5.4-4.fc10.i386
audacious-plugins-amidi-1.5.1-2.fc10.i386
plymouth-plugin-pulser-0.6.0-0.2008.11.17.3.fc10.i386
PackageKit-gstreamer-plugin-0.3.12-1.fc10.i386
gstreamer-plugins-good-0.10.11-1.fc10.i386
gstreamer-plugins-flumpegdemux-0.10.15-4.fc10.i386
gutenprint-plugin-5.0.2-3.fc10.i386
plymouth-system-plugin-0.6.0-0.2008.11.17.3.fc10.i386
audacious-plugins-wavpack-1.5.1-2.fc10.i386
gstreamer-plugins-schroedinger-1.0.5-3.fc10.i386
plymouth-plugin-solar-0.6.0-0.2008.11.17.3.fc10.i38...

Read more...

Revision history for this message
In , Matěj (matj-redhat-bugs) wrote :

Thanks for the bug report. We have reviewed the information you have provided above, and there is some additional information we require that will be helpful in our diagnosis of this issue.

First of all, could we get output of the command

 rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin*

Please also install firefox-debuginfo (debuginfo-install is from
yum-utils package).

 debuginfo-install firefox

Then run firefox with a parameter -g. That will start firefox running inside of gdb debugger. Then use command run and do whatever you did to make firefox crash. When it happens, you should go back to the gdb and run

 (gdb) thread apply all backtrace

This produces usually many screens of the text. Copy all of them into a text editor and attach the file to the bug as an uncompressed attachment.

We will review this issue again once you've had a chance to attach this information.

Thanks in advance.

Revision history for this message
In , cornel (cornel-redhat-bugs) wrote :

Created attachment 327465
gdb output

Revision history for this message
In , cornel (cornel-redhat-bugs) wrote :

strange: the output is different as user or as root :)

$ rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin*
xulrunner-1.9.0.4-1.fc10.i386
xulrunner-debuginfo-1.9.0.4-1.fc10.i386
mozilla-vlc-0.9.8a-1.fc10.i386
mozilla-filesystem-1.9-2.fc10.i386

# rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin*
audacious-plugins-freeworld-wma-1.4.5-2.fc10.i386
mail-notification-evolution-plugin-5.4-4.fc10.i386
audacious-plugins-amidi-1.5.1-2.fc10.i386
xulrunner-1.9.0.4-1.fc10.i386
plymouth-plugin-pulser-0.6.0-0.2008.11.17.3.fc10.i386
PackageKit-gstreamer-plugin-0.3.12-1.fc10.i386
gstreamer-plugins-good-0.10.11-1.fc10.i386
gstreamer-plugins-flumpegdemux-0.10.15-4.fc10.i386
gutenprint-plugin-5.0.2-3.fc10.i386
plymouth-system-plugin-0.6.0-0.2008.11.17.3.fc10.i386
xulrunner-debuginfo-1.9.0.4-1.fc10.i386
flashrom-0-0.14.20081103svn3723.fc9.i386
firefox-debuginfo-3.0.4-1.fc10.i386
audacious-plugins-wavpack-1.5.1-2.fc10.i386
gstreamer-plugins-schroedinger-1.0.5-3.fc10.i386
plymouth-plugin-solar-0.6.0-0.2008.11.17.3.fc10.i386
mozilla-vlc-0.9.8a-1.fc10.i386
PackageKit-yum-plugin-0.3.12-1.fc10.i386
gstreamer-plugins-bad-0.10.9-1.fc10.i386
purple-plugin_pack-pidgin-xmms-2.4.0-1.fc10.i386
libflashsupport-000-0.5.svn20070904.i386
audacious-plugins-freeworld-mp3-1.4.5-2.fc10.i386
audacious-plugins-freeworld-alac-1.4.5-2.fc10.i386
anaconda-yum-plugins-1.0-3.fc10.noarch
gstreamer-plugins-farsight-0.12.9-3.fc10.i386
gstreamer-plugins-base-0.10.21-2.fc10.i386
mythplugins-0.21-14.fc10.i386
p7zip-plugins-4.58-1.fc10.i386
gstreamer-plugins-ugly-0.10.9-2.fc10.i386
plymouth-plugin-spinfinity-0.6.0-0.2008.11.17.3.fc10.i386
setroubleshoot-plugins-2.0.12-1.fc10.noarch
audacious-plugins-1.5.1-2.fc10.i386
audacious-plugins-freeworld-mms-1.4.5-2.fc10.i386
alsa-plugins-pulseaudio-1.0.18-1.rc3.fc10.i386
audacious-plugins-vortex-1.5.1-2.fc10.i386
firefox-3.0.4-1.fc10.i386
plymouth-plugin-fade-in-0.6.0-0.2008.11.17.3.fc10.i386
purple-plugin_pack-2.4.0-1.fc10.i386
audacious-plugins-freeworld-tta-1.4.5-2.fc10.i386
mozilla-filesystem-1.9-2.fc10.i386
purple-plugin_pack-pidgin-2.4.0-1.fc10.i386
flash-plugin-9.0.124.0-release.i386
gstreamer-plugins-bad-extras-0.10.9-1.fc10.i386
audacious-plugins-freeworld-aac-1.4.5-2.fc10.i386
libextractor-plugins-flac-0.5.20b-2.fc10.i386
plymouth-plugin-label-0.6.0-0.2008.11.17.3.fc10.i386

Revision history for this message
In , Matěj (matj-redhat-bugs) wrote :

Warren, any thoughts? The backtrace confuses me completely.

Sridhar Ratnakumar (srid)
description: updated
Revision history for this message
Grey Nicholson (greytheearthling) wrote :

This also affects Firefox 3.1 and 3.2 running on Ubuntu 8.10.

http://crash-stats.mozilla.com/report/index/ef80473b-290b-492f-869e-423982090301 is an example crash report using Mozilla's latest 3.1, but the same thing happens with Mozilla's latest 3.2 and with ~ubuntu-mozilla-daily's firefox-3.1 and firefox-3.2.

Revision history for this message
lorenzo squarza (lorenzo-squarza) wrote :
Download full text (8.2 KiB)

Here the same, ubuntu 8.10

*** glibc detected *** /usr/lib/firefox-3.1b3/firefox-3.1: munmap_chunk(): invalid pointer: 0xa4727fa0 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7dcd454]
/usr/lib/libGL.so.1[0xaa6cbfc5]
======= Memory map: ========
08048000-0805a000 r-xp 00000000 08:01 16630158 /usr/lib/firefox-3.1b3/firefox-3.1
0805a000-0805b000 r--p 00011000 08:01 16630158 /usr/lib/firefox-3.1b3/firefox-3.1
0805b000-0805c000 rw-p 00012000 08:01 16630158 /usr/lib/firefox-3.1b3/firefox-3.1
0805c000-0805d000 rw-p 0805c000 00:00 0
a3889000-a4451000 r-xp 00000000 08:01 14598621 /usr/lib/libGLcore.so.177.82
a4451000-a45f5000 rwxp 00bc8000 08:01 14598621 /usr/lib/libGLcore.so.177.82
a45f5000-a4600000 rwxp a45f5000 00:00 0
a4600000-a4b00000 rw-p a4600000 00:00 0
a4ba8000-a5ba8000 rw-p a4ba8000 00:00 0
a5ba8000-a5ba9000 ---p a5ba8000 00:00 0
a5ba9000-a63a9000 rwxp a5ba9000 00:00 0
a63a9000-a63aa000 ---p a63a9000 00:00 0
a63aa000-a6baa000 rwxp a63aa000 00:00 0
a6baa000-a6bab000 ---p a6baa000 00:00 0
a6bab000-a73ab000 rwxp a6bab000 00:00 0
a73ab000-a73ac000 ---p a73ab000 00:00 0
a73ac000-a7bac000 rwxp a73ac000 00:00 0
a7bac000-a7bad000 ---p a7bac000 00:00 0
a7bad000-a83ad000 rwxp a7bad000 00:00 0
a83ad000-a83ae000 ---p a83ad000 00:00 0
a83ae000-a8bae000 rwxp a83ae000 00:00 0
a8bae000-a8daf000 rw-s 00000000 00:15 161197 /dev/shm/pulse-shm-3650678892
a8daf000-a8dfd000 r-xp 00000000 08:01 14598736 /usr/lib/libpulse.so.0.4.1
a8dfd000-a8dfe000 r--p 0004d000 08:01 14598736 /usr/lib/libpulse.so.0.4.1
a8dfe000-a8dff000 rw-p 0004e000 08:01 14598736 /usr/lib/libpulse.so.0.4.1
a8dff000-a8e00000 ---p a8dff000 00:00 0
a8e00000-a9600000 rwxp a8e00000 00:00 0
a9600000-a9900000 rw-p a9600000 00:00 0
a994c000-a99e1000 r--p 00000000 08:01 14747542 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
a99e1000-a9a6a000 r--p 00000000 08:01 14747541 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Bold.ttf
a9a6a000-a9a6b000 ---p a9a6a000 00:00 0
a9a6b000-aa26b000 rwxp a9a6b000 00:00 0
aa26b000-aa300000 r--p 00000000 08:01 14747542 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
aa300000-aa600000 rw-p aa300000 00:00 0
aa67b000-aa702000 r-xp 00000000 08:01 14598620 /usr/lib/libGL.so.177.82
aa702000-aa71c000 rwxp 00087000 08:01 14598620 /usr/lib/libGL.so.177.82
aa71c000-aa71e000 rwxp aa71c000 00:00 0
aa71e000-aa850000 r-xp 00000000 08:01 14630916 /usr/lib/i686/cmov/libcrypto.so.0.9.8
aa850000-aa851000 ---p 00132000 08:01 14630916 /usr/lib/i686/cmov/libcrypto.so.0.9.8
aa851000-aa859000 r--p 00132000 08:01 14630916 /usr/lib/i686/cmov/libcrypto.so.0.9.8
aa859000-aa866000 rw-p 0013a000 08:01 14630916 /usr/lib/i686/cmov/libcrypto.so.0.9.8
aa866000-aa86a000 rw-p aa866000 00:00 0
aa86a000-aa8f9000 r-xp 00000000 08:01 14600321 /usr/lib/libkrb5.so.3.3
aa8f9000-aa8fb000 r--p 0008e000 08:01 14600321 /usr/lib/libkrb5.so.3.3
aa8fb000-aa8fc000 rw-p 00090000 08:01 14600321 /usr/lib/libkrb5.so.3.3
aa8fc000-aa8fd000 ---p aa8fc000 00:00 0
aa8fd000-ab0fd000 rwxp aa8fd000 00:00 0
ab0fd000-ab0fe000 ---p ab0fd000 00:00 0
ab0fe000-ab8fe000 rwxp ab0fe000 00:00 0
ab8fe000-ab8ff000 ---p ab8fe000 00:00 0
ab8ff00...

Read more...

Revision history for this message
Grey Nicholson (greytheearthling) wrote :

Progress! With the latest jaunty, full-screening a Flash video now causes Firefox >3.0.* to *hang* instead of crashing.

Alexander Sack (asac)
affects: firefox-3.1 (Ubuntu) → firefox-3.5 (Ubuntu)
Revision history for this message
In , Brian (brian-redhat-bugs) wrote :

Since this crash is very repeatable for me, I am adding some info.

I am including my gdb backtrace. Looks like the experimental malloc code in the newer glibc is crashing out here.

$ rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin*
gstreamer-plugins-ugly-0.10.11-1.fc11.i586
konq-plugins-4.2.2-1.fc11.i586
PackageKit-yum-plugin-0.4.6-2.fc11.i586
xulrunner-debuginfo-1.9.1-0.11.beta3.fc11.i586
alsa-plugins-pulseaudio-1.0.18-3.fc11.i586
xulrunner-1.9.1-0.11.beta3.fc11.i586
plymouth-plugin-label-0.7.0-0.2009.03.10.3.fc11.i586
gstreamer-plugins-base-0.10.22-2.fc11.i586
anaconda-yum-plugins-1.0-4.fc11.noarch
firefox-debuginfo-3.1-0.11.beta3.fc11.i586
firefox-3.1-0.11.beta3.fc11.i586
flash-plugin-10.0.22.87-release.i386
setroubleshoot-plugins-2.0.15-1.fc11.noarch
mozilla-filesystem-1.9-4.fc11.i586
plymouth-plugin-spinfinity-0.7.0-0.2009.03.10.3.fc11.i586
$

Revision history for this message
In , Brian (brian-redhat-bugs) wrote :

Created attachment 339247
Backtrace of firefox crash, note malloc blowing up

Revision history for this message
In , Brian (brian-redhat-bugs) wrote :

additionally, this has been repeated by several others in #fedora-qa

Revision history for this message
In , Brian (brian-redhat-bugs) wrote :

I also would like to suggest increasing the priority of this bug, as many, many users use flash.

Revision history for this message
Julian Alarcon (julian-alarcon) wrote : Re: Firefox 3.1 and above crash on full screen flash video

I also have this problem.. Using the PPA from daily builds, and the official repo packages.

Changed in firefox-3.5 (Ubuntu):
assignee: nobody → Mozilla Bugs (mozilla-bugs)
status: New → Confirmed
Revision history for this message
Eder Bastos (riskbreaker927) wrote :

I've had this problem on 3 setups:

Dell inspiron mini 9, ubuntu intrepid, firefox 3.1
Dell inspiron mini 9, ubuntu jaunty, firefox 3.5
Custom desktop, ubuntu jaunty, firefox 3.5.

If I watch the same video in Firefox 3.0, it works fine. This is an FF3.5 issue.

Bug Watch Updater (bug-watch-updater)
Changed in firefox-3.5 (Fedora):
status: Unknown → In Progress
Revision history for this message
Julian Alarcon (julian-alarcon) wrote :

Small workaround:

While you are loading the video without fullscreen, right click with the mouse on the video -> Configuration -> Visualization -> And turn off hardware acceleration.

Pro: Your Firefox will not crash
Con: The performance will drop (cause you will use software acceleration)

So, maybe is a Flash bug or a nVidia bug, because everybody with this types of cards have the problem.. Can somebody confirm the bug with another graphic card??

Some additional info: http://forums.mozillazine.org/viewtopic.php?f=38&t=1004005

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Unknown → Confirmed
Revision history for this message
perlluver (plaufcan) wrote :

Tested with Nvidia GForce 5400, using driver 173.14.16. Did not experience crash when changing to or from full screen.

Revision history for this message
DeepMagic (deepmagiccy) wrote :

I have no problem with fullscreen Flash video using Firefox 3.5b4 on ATI video hardware, so it may be an nVidia issue.

Revision history for this message
Julian Alarcon (julian-alarcon) wrote :

More curious and additional info.

When using fullscreen in Youtube site, Firefox (3.5+) crash.. But in embedded videos may or may not crash.

I don't know if this is just my case, can you check this?

Embedded video (crash):
http://www.puntogeek.com/2009/05/10/como-nace-un-n97/

Embedded video (OK):
http://ubuntulife.wordpress.com/2009/05/10/blood-the-last-vampire-trailer/

I'm using Accelerated Hardware function enabled.

With Vimeo videos, using direct links, works fine:
http://vimeo.com/4368246

But, embedded videos always crash
http://www.changethethought.com/the-tarantino-mixtape/

Hint: When I right-click on the flash player in the pages that works fine, the Config menu option of flash player is disabled.

I have a nVidia video card (6200 AGP), Firefox 3.5 (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b5pre) Gecko/20090509 Ubuntu/9.04 (jaunty) Shiretoko/3.5b5pre) using PPA from ubuntu mozilla daily, nVidia driver v180.44, Flash Player (flashplugin-installer v10.0.22.87ubuntu2) on Ubuntu 9.04 Jaunty Jackalope with Compiz enabled.

Revision history for this message
Julian Alarcon (julian-alarcon) wrote :

Mmm, so, the problem is always in PC's with nVidia cards (and proprietary drivers), tested with a computer with a Intel Video Card, and works fine... So... if the problems is nVidia drivers.. Why this bug don't appears in Firefox 3.0.x??

I also tested the last Opera 10 alpha (13 May 2009).
Version
10.00 Alpha
Build
4345
Platform
Linux
System
i686, 2.6.28-11-generic
Qt library
4.5.1

And, what do you think?? It works... Also test Epiphany from official repos, and also works... So.. Where is the problem, in nVidia Drivers (180.44) or Firefox 3.5???

Revision history for this message
In , Mozilla (mozilla) wrote :

(This is related to bug 473428)

Apparently the jemalloc integration can cause confusion for in process library functions if libraries are usually not using jemalloc but referencing malloc() and free() through the processes memory map. (Sorry I'm not a low level expert).

Here is a bugreport mentioning two examples:
https://bugzilla.novell.com/show_bug.cgi?id=503151

And an explanation I found is:
https://bugzilla.novell.com/show_bug.cgi?id=477061#c11
which led me to this bugreport.

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Confirmed → Invalid
Revision history for this message
In , Mozilla (mozilla) wrote :

According to
https://bugzilla.novell.com/show_bug.cgi?id=503151#c5
this is nothing which need to be fixed from mozilla.

Here's the explanation from the above comment:
(and NSS is the glibc's Name Service Switch not Network Security Services)

"
We currently do not support custom malloc() implementation in NSS due to our
patch to open NSS modules deep-bound (that is meant to protect the main process
from library namespace pollution by libraries the NSS module depends on - e.g.
Thunderbird depended on one kind of OpenLDAP library, while nss_ldap depended
on an entirely incompatible one). This causes the main process to use the
custom malloc(), but the NSS module to use the stock free().
"

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Invalid → Confirmed
Revision history for this message
Julian Alarcon (julian-alarcon) wrote : Re: Firefox 3.1 and above crash on full screen flash video

Kevin Brosnan gave us a workaround:

There is a workaround which is to create a script that does the following.
#!/bin/sh
export LD_PRELOAD=/usr/lib/libGL.so.1
/path/to/firefox

In the case of Firefox 3. package from PPA, the file /usr/lib/firefox-3.5pre/firefox.sh should be modified adding:

export LD_PRELOAD=/usr/lib/libGL.so.1

I modified it, and works!!!!

Additional to this, the problem seems to be from nVidia drivers, so, only people with nVidia cards have this problem . This already was reported:

http://www.nvnews.net/vbulletin/showthread.php?p=1997651

Revision history for this message
dariocaruso (ing.gonzo) wrote :

have the same problem on my desktop with nvidia

Revision history for this message
jeroenl (jeroenl) wrote :

@Julián Alarcón: Great that works. I use now 3.5 RC2 from PPA and when I put:
export LD_PRELOAD=/usr/lib/libGL.so.1
to /usr/lib/firefox-3.5/firefox.sh (after DROPPED=abandoned) it works.

But why? When I check /usr/lib/libGL.so.1 I see it's a symlink to /usr/lib/libGL.so.180.44 - and that's the same version number as my nvidia driver.

When I check my Xorg.0.log I see this:
(II) LoadModule: "glx"
(II) Loading /usr/lib/xorg/modules/extensions//libglx.so
(II) Module glx: vendor="NVIDIA Corporation"
 compiled for 4.0.2, module version = 1.0.0
 Module class: X.Org Server Extension
(II) NVIDIA GLX Module 180.44 Mon Mar 23 15:29:02 PST 2009
(II) Loading extension GLX

/usr/lib/xorg/modules/extensions//libglx.so is a symlink to libglx.so.180.44 in the same directory. Again the same version number as my nvidia driver.

So I understand that /usr/lib/xorg/modules/extensions/libglx.so.180.44 is the one that is used normally ans now for firefox 3.5 RC2 I use /usr/lib/libGL.so.180.44. What is exactly the difference and is the latter one providing hardware acceleration? If not, than it will be the same workaround when people disable hardware acceleration using their Flash settings.

Hopefully this will be fixed asap.

Revision history for this message
In , Karlt (karlt) wrote :

I'm reopening this, because as well as the name service switch module loading issues (which show up as bug 473428, https://bugzilla.novell.com/show_bug.cgi?id=503151 and https://bugs.gentoo.org/show_bug.cgi?id=252302), the same issue is affecting the Flash plugin (bug 469439).

Revision history for this message
In , Kairo-kairo (kairo-kairo) wrote :

*** Bug 500163 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Karlt (karlt) wrote :

Excepts from what Ulrich Drepper says about the RTLD_DEEPBIND flag he added:
("How To Write Shared Libraries", August 20, 2006,
http://people.redhat.com/drepper/dsohowto.pdf)

  this feature should only be used if it cannot be avoided. There are several
  reasonse for this:

    The change in the scope affects all symbols and all
    the DSOs which are loaded. Some symbols might
    have to be interposed by definitions in the global
    scope which now will not happen.

    Already loaded DSOs are not affected which could
    cause unconsistent results depending on whether
    the DSO is already loaded (it might be dynamically
    loaded, so there is even a race condition).

    ...

  The RTLD_DEEPBIND flag should really only be used as
  a last resort. Fixing the application to not depend on the
  flag's functionality is the much better solution.

The inconsistency that RTLD_DEEPBIND causes with jemalloc is that dynamic libraries opened with RTLD_DEEPBIND will use libc's malloc while libc is still using jemalloc. A libc function may return a pointer to something that should be passed to free, and the dynamic library will call libc's free, but libc used jemalloc to allocate the memory.

I raised a question on this behavior here:
http://sourceware.org/ml/libc-alpha/2009-06/msg00168.html

But it looks like we can make libc's free (and malloc, etc) use jemalloc:
http://www.gnu.org/s/libc/manual/html_node/Hooks-for-Malloc.html

Revision history for this message
Jesus Gamio (jgamio) wrote : Re: Firefox 3.1 and above crash on full screen flash video

I have Jaunty and the two versions firefox 3.0.11 (Works fine) firefox 3.5 (crash). I have nvidia driver I will check the workaround

Revision history for this message
dariocaruso (ing.gonzo) wrote :

same problem on karmic koala and nvidia closed driver

Revision history for this message
In , Karlt (karlt) wrote :

Created attachment 386244
hook jemalloc into glibc's malloc

I wonder whether we ever build against glibc and expect to run against a different glibc.

I hoping this will fix the bug but I'm not able to test right now.

The jemalloc dependency in the build system is broken so
OBJ-DIR/browser/app/firefox-bin must be explicitly removed to pick up the changes.

Revision history for this message
Jordan Hall (jordan-hall) wrote : Re: Firefox 3.1 and above crash on full screen flash video

After downloading Firefox 3.5 (stable) from the mozilla-security PPA, this bug is still present. Will a fix or the given work around be packaged with Ubuntu's build of Firefox 3.5?

Revision history for this message
In , Karlt (karlt) wrote :

Comment on attachment 386244
hook jemalloc into glibc's malloc

This doesn't work as glibc does not run__malloc_initialize_hook on free.
(The assumption is probably that glibc's malloc or similar would have been
called before free, but that's not happening here.)

Revision history for this message
In , Karlt (karlt) wrote :

Created attachment 386469
hook jemalloc into glibc's malloc (without __malloc_initialize_hook)

We shouldn't need to use __malloc_initialize_hook because the hook functions will not call glibc malloc functions. This patch uses symbol interposing to set the 4 hooks.

With this patch, the initial crash of bug 469439 is avoided, but I'm having trouble testing with my setup here. I get a different (slightly later) crash with this patch but I seem to get the same crash without jemalloc, so it may just be related to the hackish way that I've installed NVIDIA's libGL.

I'd appreciate if someone can help me by testing this patch, please?
You'll need to explicitly remove OBJ-DIR/browser/app/firefox-bin before the build.

Revision history for this message
In , Kairo-kairo (kairo-kairo) wrote :

i can confirm that without the patch, a build of SeaMonkey built on top of 1.9.2 mozilla-central code crashes at print preview while with only attachment 386469 applied in addition, print preview works fine. Nice work!

Revision history for this message
roffik (roffik) wrote : Re: Firefox 3.1 and above crash on full screen flash video

I can confirm this bug on Firefox 3.5 downloaded from official Mozilla website (in .tar.bz2), on Thinkpad T41 - ATI Mobility Radeon 7500. However, the workaround works perfectly, I added to firefox (it's a bash script) this line:
export LD_PRELOAD=/usr/lib/libGL.so.1

On my computer the symlink is set to
/usr/lib/libGL.so.1.2
Weird...

Revision history for this message
anup (anup-onenaught) wrote :

Like roffik, I also downloaded the official 3.5 from Mozilla web site, on Dell Studio 17 with ATI MOBILITY RADEON HD 3650. Workaround works too.

Revision history for this message
In , Karlt (karlt) wrote :

Thanks very much, Robert.

This also fixes bug 469439. (I managed to use the correct libnvidia-tls.so.1.)

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Confirmed → In Progress
Revision history for this message
Julian Alarcon (julian-alarcon) wrote : Re: Firefox 3.1 and above crash on full screen flash video

I tried the leaked nVidia driver version 190.09 from here:
https://launchpad.net/~nvidia-vdpau/+archive/ppa

But the problem persist.. And, if some one else can confirm the same problem in ATI card's.. the problem is not only of nVidia.

Like I mention before, the problem is not present in Intel video cards.

John Vivirito (gnomefreak)
summary: - Firefox 3.1 and above crash on full screen flash video
+ Firefox 3.5 and above crash on full screen flash video
Revision history for this message
Mr. Blonde (mr.blonde) wrote :

Ubuntu Jaunty here.

FF 3.1 works, Shiretoko crashes.

Revision history for this message
Savvas Radevic (medigeek) wrote :

I can't reproduce this bug with firefox 3.5 amd64 and the adobe 64-bit flash plugin :)

Revision history for this message
Adam Porter (alphapapa) wrote : Re: [Bug 333127] Re: Firefox 3.5 and above crash on full screen flash video

What video driver are you using?

On Wed, Jul 8, 2009 at 01:26, Savvas Radevic<email address hidden> wrote:
> I can't reproduce this bug with firefox 3.5 amd64 and the adobe 64-bit
> flash plugin :)
>
> --
> Firefox 3.5 and above crash on full screen flash video
> https://bugs.launchpad.net/bugs/333127
> You received this bug notification because you are a direct subscriber
> of the bug.
>

Revision history for this message
In , Mozilla (mozilla) wrote :

According to the feedback in https://bugzilla.novell.com/show_bug.cgi?id=503151 your patch fixes the issues we've seen.

John Vivirito (gnomefreak)
affects: firefox-3.5 (Ubuntu) → flashplugin-nonfree (Ubuntu)
Changed in flashplugin-nonfree (Ubuntu):
assignee: Mozilla Bugs (mozilla-bugs) → nobody
Revision history for this message
Mario Limonciello (superm1) wrote :

This bug only happens when using nvidia graphics drivers with firefox newer than 3.1. It was caused by a *firefox* code change as it works properly with older firefox and all other variables constant.

Revision history for this message
anup (anup-onenaught) wrote :

Like I and some others mentioned above, this also happens with ATI cards, not just nvidia.

Revision history for this message
In , Veranyon (veranyon) wrote :

I am sorry for my english, but I was sent here from here> http://bugs.archlinux.org/task/15441
I am very weak in programming, not to say that does not know any language. Just wanted to say that I have a problem with the browser when using the macromedia / adobe flash.
Ready to share any technical information that will be required.
Thanks.

Revision history for this message
In , Jst (jst) wrote :

Given that this causes problems with flash in at least some cases (bug 469439), I think we should fix this for 1.9.2 (and 1.9.1.x as well).

Revision history for this message
In , Jst (jst) wrote :

*** Bug 469439 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Karlt (karlt) wrote :

#1 Firefox 3.5.1 crash on Linux ATM

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: In Progress → Invalid
Revision history for this message
Mario Limonciello (superm1) wrote :

upstream bug 469439 is marked as a duplicate of 493541, adjusting.

Changed in firefox:
status: Invalid → Unknown
affects: nvidia-graphics-drivers-180 (Ubuntu) → firefox-3.5 (Ubuntu)
Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Unknown → Confirmed
Revision history for this message
In , Mozilla-bugs-micahscomputing (mozilla-bugs-micahscomputing) wrote :

Ubuntu Bug:
https://bugs.launchpad.net/bugs/333127

Micah Gersten (micahg)
Changed in firefox-3.5 (Ubuntu):
importance: Undecided → High
status: New → Triaged
Revision history for this message
In , Kairo-kairo (kairo-kairo) wrote :

From all I hear from the Novell/openSUSE side of things, the patch is used in builds they ship now and users cheer for it as the problems seem to be gone.

We really should get this into both 1.9.2 and 1.9.1 ASAP.

Revision history for this message
In , Benjamin Smedberg (Mozilla) [:bs] (benjamin-smedbergs) wrote :

Comment on attachment 386469
hook jemalloc into glibc's malloc (without __malloc_initialize_hook)

I don't understand the "elif !defined(malloc) bit here... can you explain the purpose of that clause?

Revision history for this message
In , Samuel-sidler+old (samuel-sidler+old) wrote :

(In reply to comment #14)
> #1 Firefox 3.5.1 crash on Linux ATM

What is this based on? I don't think it's based on our stats because the highest crash signature has four crashes in the last week...

Revision history for this message
In , Kevin Brosnan (kbrosnan) wrote :

Based on bug 469439 being marked a dupe of this. Many of the libc-2.9.so@0x2d097 crashes are crashes when fullscreening flash.

http://crash-stats.mozilla.com/report/list?product=Firefox&platform=linux&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=libc-2.9.so%400x2d097

Revision history for this message
In , Karlt (karlt) wrote :

Comment on attachment 386469
hook jemalloc into glibc's malloc (without __malloc_initialize_hook)

(In reply to comment #17)
> I don't understand the "elif !defined(malloc) bit here... can you explain the
> purpose of that clause?

I saw this code

/* Mangle standard interfaces on Darwin and Windows CE,
   in order to avoid linking problems. */
#if defined(MOZ_MEMORY_DARWIN)
#define malloc(a) moz_malloc(a)
#define valloc(a) moz_valloc(a)
#define calloc(a, b) moz_calloc(a, b)
#define realloc(a, b) moz_realloc(a, b)
#define free(a) moz_free(a)
#endif

http://hg.mozilla.org/mozilla-central/annotate/55955ee71c10/memory/jemalloc/jemalloc.c#l6126

and assumed that in some cases jemalloc does not replace the system malloc but
is used as an alternative allocator in parallel to the system malloc (used
only in cases where mixing of allocate/free implementations can be avoided).

Revision history for this message
In , Pavlov (pavlov) wrote :

(In reply to comment #20)
> (From update of attachment 386469 [details])
> (In reply to comment #17)
> > I don't understand the "elif !defined(malloc) bit here... can you explain the
> > purpose of that clause?
>
> I saw this code
>
> /* Mangle standard interfaces on Darwin and Windows CE,
> in order to avoid linking problems. */
> #if defined(MOZ_MEMORY_DARWIN)
> #define malloc(a) moz_malloc(a)
> #define valloc(a) moz_valloc(a)
> #define calloc(a, b) moz_calloc(a, b)
> #define realloc(a, b) moz_realloc(a, b)
> #define free(a) moz_free(a)
> #endif
>
> http://hg.mozilla.org/mozilla-central/annotate/55955ee71c10/memory/jemalloc/jemalloc.c#l6126
>
> and assumed that in some cases jemalloc does not replace the system malloc but
> is used as an alternative allocator in parallel to the system malloc (used
> only in cases where mixing of allocate/free implementations can be avoided).

on mac they use this zone allocator nonsense, and so malloc calls in to zone[0] basically and does an allocation. free() loops through each zone asking if it owns the allocation and then calls free on that zone. on mac with jemalloc (which we don't actually use at the moment), we setup a zone and replace the default zone with our own, so we need to define our functions as something other than malloc, etc. We still replace the system allocations.

Revision history for this message
In , Karlt (karlt) wrote :

Created attachment 390399
hook jemalloc into glibc's malloc v2.1

Thank you, Stuart for the explanation.

The behavior of this patch is the same as attachment 386469.
The difference is that preprocessor conditionals are moved around a bit to make it clearer when each section is processed.

Revision history for this message
In , Riku (riku-redhat-bugs) wrote :

Yes firefox 3.5.1 still crashes.
Program received signal SIGSEGV, Segmentation fault.
_int_free (av=<value optimized out>, p=0xa95f2b38, have_lock=0) at malloc.c:4854
4854 >= ((char *) av->top + chunksize(av->top)), 0))

https://bugzilla.mozilla.org/show_bug.cgi?id=493541

Revision history for this message
In , Matti-mversen (matti-mversen) wrote :

*** Bug 507161 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Toddandmargo (toddandmargo) wrote :

Is the patch scheduled for 3.5.2?

Revision history for this message
In , Samuel-sidler+old (samuel-sidler+old) wrote :

(In reply to comment #24)
> Is the patch scheduled for 3.5.2?

Not currently, no. A patch has not yet baked on trunk and is, therefore, not ready to land on the 1.9.1 branch.

Revision history for this message
In , Karlt (karlt) wrote :

http://hg.mozilla.org/mozilla-central/rev/dae91a0884c9

Revision history for this message
In , Karlt (karlt) wrote :

*** Bug 473428 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Kevin Brosnan (kbrosnan) wrote :

Verified - Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20090730 Minefield/3.6a1pre

Revision history for this message
In , Tyler Downer (tyler-downer) wrote :

*** Bug 507346 has been marked as a duplicate of this bug. ***

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Confirmed → Fix Released
Revision history for this message
Mario Limonciello (superm1) wrote :

Here's the fix that landed upstream: http://hg.mozilla.org/mozilla-central/rev/dae91a0884c9

Revision history for this message
Micah Gersten (micahg) wrote :

Per upstream, they want the fix to be tested on 3.6 before it's backported to 3.5. Currently looking at 3.5.3 as a possibility for this fix.

bblokar (bblokar)
Changed in firefox-3.5 (Fedora):
status: In Progress → New
status: New → In Progress
Revision history for this message
In , Kevin Brosnan (kbrosnan) wrote :

*** Bug 508375 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Timeless-bemail (timeless-bemail) wrote :

*** Bug 509310 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Samuel-sidler+old (samuel-sidler+old) wrote :

Comment on attachment 390399
hook jemalloc into glibc's malloc v2.1

Approved for 1.9.1.3. a=ss

Revision history for this message
In , Karlt (karlt) wrote :

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d919708797fa

Revision history for this message
In , Theredescorpion (theredescorpion) wrote :

(In reply to comment #33)
> http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d919708797fa

Hi, I'm from Venezuela and I have this error described here and I see that here is resolved, but I have not much experience in this and I don't know exactly what I should do to fix this problem on my machine, can you help me?

Revision history for this message
In , Karlt (karlt) wrote :

A build with the fix can be downloaded from here:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-1.9.1/

Revision history for this message
In , Theredescorpion (theredescorpion) wrote :

(In reply to comment #35)
> A build with the fix can be downloaded from here:
> http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-1.9.1/

Thanks, but that build is in english and I think that that version is not an published official version yet, so I can wait when that version to be published because I already can see the videos in fullscreen by disabling the hardware acceleration in the configuration of flash player.

Thank you for your help!!

Micah Gersten (micahg)
tags: added: fixed-3.5.3
Revision history for this message
In , Jacob (jacob-redhat-bugs) wrote :

FYI - looks like there is an mozilla fix in the pipeline: https://bugzilla.mozilla.org/show_bug.cgi?id=493541

Until then, their is a workaround: http://webupd8.blogspot.com/2009/07/how-to-fix-full-screen-flash-videos-in.html

Revision history for this message
Tristan Schmelcher (tschmelcher) wrote :

The LD_PRELOAD workaround doesn't work for me. It prevents the crash, but fullscreen still doesn't work. The Flash window stops drawing to its area of the page, as if it thinks it has entered fullscreen, but no fullscreen window appears.

Revision history for this message
In , Kevin Brosnan (kbrosnan) wrote :

*** Bug 493407 has been marked as a duplicate of this bug. ***

Revision history for this message
Gerhard Burger (burger.ga) wrote :

The LD_PRELOAD workaround also doesn't work for me. There is no such file or directory (/usr/lib/libGL.so.1) where I can point to.
I'm running Firefox 3.0.13 on a Ati Radeon HD3470 using Linux Mint.

Revision history for this message
Rykel from Singapore (rykel98) wrote :

I confirm that Flash 10 fullscreen crashes Firefox 3.5.2, both from repositories.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package firefox-3.5 - 3.5.3+build1+nobinonly-0ubuntu2

---------------
firefox-3.5 (3.5.3+build1+nobinonly-0ubuntu2) karmic; urgency=low

  * security/stability update v3.5.3 build1 (FIREFOX_3_5_3_BUILD1)
    - see USN-821-1
    - fix LP: #333127 - Firefox 3.5 and above crash on full screen flash video
    - fix LP: #236853 - firefox crashed with SIGSEGV in NSSRWLock_LockRead_Util()

  [ Alexander Sack <email address hidden> ]
  * fix LP: #422365 - apport hook fails because profiles_d is not initialized
    in add_info if no profiles.ini exist; we ensure that profiles_d gets instantiated
    as an empty map even if no profiles.ini exist.
    - update debian/apport/firefox-3.5.py
  * hook firefox-addons/searchplugins as the distribution/searchplugins
    directory to support localized distro search engines.
    - update debian/rules
  * in case localized search engines are available the main searchplugins
    directory is not scanned anymore; to fix this we provide a compatibility
    link /usr/lib/firefox-addons/searchplugins/common => /usr/lib/firefox-addons/searchplugins
    - update debian/firefox-3.5.links
  * fix localized search engine upstream code to properly deal with general.useragent.locale
    being a complex pref; also change plugin dir order to allow locale specific searchplugins
    to overlay the ones shipped in "searchplugins/common"
    - add debian/patches/fix_complex_locale_distro_searchplugins.patch
    - update debian/patches/series

  [ Jamie Strandboge <email address hidden> ]
  * add AppArmor profile (disabled by default) (LP: #382917)
    - debian/firefox-3.5.dirs: add etc/apparmor.d/disable
    - add debian/firefox-3.5.preinst.in: disable the profile on new installs
      and upgrades to this version
    - debian/firefox-3.5.postinst.in: reload profile
    - add debian/firefox-3.5.postrm.in: cleanup force-complain and disable
      directories
    - add debian/usr.bin.firefox.apparmor.in
    - debian/rules: install profile
    - add debian/README.Debian.in with note about AppArmor
    - debian/apport/firefox-3.5.py: add AppArmor information if the profile is
      not disabled
    - debian/firefox-3.5.preinst.in: allow for when apparmor is not installed

 -- Alexander Sack <email address hidden> Thu, 03 Sep 2009 10:03:08 +0200

Changed in firefox-3.5 (Ubuntu):
status: Triaged → Fix Released
Revision history for this message
In , Riku (riku-redhat-bugs) wrote :

Firefox 3.5.3 works for me!

Revision history for this message
Igor Gomes (igorgomes) wrote :

It was happening in adobe-flash too. It was a FF bug, solved in 3.5.3.

Changed in flashplugin-nonfree (Ubuntu):
status: Confirmed → Invalid
Revision history for this message
In , Matěj (matj-redhat-bugs) wrote :

Glad to hear it! Thanks for letting us know.

Bug Watch Updater (bug-watch-updater)
Changed in firefox-3.5 (Fedora):
status: In Progress → Fix Released
Revision history for this message
Garazi (garazi111) wrote :

bug always active with FF 3.5.3 on Ubuntu 9.10 beta

Revision history for this message
Garazi (garazi111) wrote :

ati mobility radeon 9600
compiz disabled

Revision history for this message
In , Toddandmargo (toddandmargo) wrote :

Is this fixed in 3.5.4?

Revision history for this message
In , Samuel-sidler+old (samuel-sidler+old) wrote :

Should have been fixed in 3.5.3 as noted by the .3-fixed entry in the status1.9.1 field.

Revision history for this message
Rex (tadex72) wrote :

FF 3.5.5 will close after loading full frame flash. One example is at www.evony.com after logging on. Running ATI Radeon HD 3200 Graphics

Revision history for this message
BUBUNTU (bubuntu-maesuzzo) wrote :
Download full text (62.2 KiB)

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.6pre) Gecko/20091116 Ubuntu/9.04 (jaunty) Shiretoko/3.5.6pre

Crashes when running a youtube video and i try to maximize it. Awful!!

[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 2.6.31-15-generic (buildd@rothera) (gcc version 4.4.1 (Ubuntu 4.4.1-4ubuntu8) ) #50-Ubuntu SMP Tue Nov 10 14:54:29 UTC 2009 (Ubuntu 2.6.31-15.50-generic)
[ 0.000000] KERNEL supported cpus:
[ 0.000000] Intel GenuineIntel
[ 0.000000] AMD AuthenticAMD
[ 0.000000] NSC Geode by NSC
[ 0.000000] Cyrix CyrixInstead
[ 0.000000] Centaur CentaurHauls
[ 0.000000] Transmeta GenuineTMx86
[ 0.000000] Transmeta TransmetaCPU
[ 0.000000] UMC UMC UMC UMC
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: 0000000000000000 - 000000000009f000 (usable)
[ 0.000000] BIOS-e820: 000000000009f000 - 00000000000a0000 (reserved)
[ 0.000000] BIOS-e820: 0000000000100000 - 00000000dd04d400 (usable)
[ 0.000000] BIOS-e820: 00000000dd04d400 - 00000000dd04f400 (ACPI NVS)
[ 0.000000] BIOS-e820: 00000000dd04f400 - 00000000e0000000 (reserved)
[ 0.000000] BIOS-e820: 00000000f8000000 - 00000000fc000000 (reserved)
[ 0.000000] BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved)
[ 0.000000] BIOS-e820: 00000000fed18000 - 00000000fed1c000 (reserved)
[ 0.000000] BIOS-e820: 00000000fed20000 - 00000000fed90000 (reserved)
[ 0.000000] BIOS-e820: 00000000feda0000 - 00000000feda6000 (reserved)
[ 0.000000] BIOS-e820: 00000000fee00000 - 00000000fee10000 (reserved)
[ 0.000000] BIOS-e820: 00000000ffe60000 - 0000000100000000 (reserved)
[ 0.000000] BIOS-e820: 0000000100000000 - 0000000120000000 (usable)
[ 0.000000] DMI 2.4 present.
[ 0.000000] last_pfn = 0xdd04d max_arch_pfn = 0x100000
[ 0.000000] MTRR default type: uncachable
[ 0.000000] MTRR fixed ranges enabled:
[ 0.000000] 00000-9FFFF write-back
[ 0.000000] A0000-BFFFF uncachable
[ 0.000000] C0000-CFFFF write-protect
[ 0.000000] D0000-EFFFF uncachable
[ 0.000000] F0000-FFFFF write-protect
[ 0.000000] MTRR variable ranges enabled:
[ 0.000000] 0 base 000000000 mask 800000000 write-back
[ 0.000000] 1 base 0E0000000 mask FE0000000 uncachable
[ 0.000000] 2 base 0DDC00000 mask FFFC00000 uncachable
[ 0.000000] 3 base 0DE000000 mask FFE000000 uncachable
[ 0.000000] 4 disabled
[ 0.000000] 5 disabled
[ 0.000000] 6 disabled
[ 0.000000] x86 PAT enabled: cpu 0, old 0x7040600070406, new 0x7010600070106
[ 0.000000] e820 update range: 00000000ddc00000 - 0000000100000000 (usable) ==> (reserved)
[ 0.000000] e820 update range: 0000000000002000 - 0000000000006000 (usable) ==> (reserved)
[ 0.000000] Scanning 1 areas for low memory corruption
[ 0.000000] modified physical RAM map:
[ 0.000000] modified: 0000000000000000 - 0000000000002000 (usable)
[ 0.000000] modified: 0000000000002000 - 0000000000006000 (reserved)
[ 0.000000] modified: 0000000000006000 - 000000000009f000 (usable)
[ 0.000000] modified: 000000000009f000 - 00000000000a0000 (reserved)...

Revision history for this message
BUBUNTU (bubuntu-maesuzzo) wrote :
Download full text (59.3 KiB)

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.6pre) Gecko/20091116 Ubuntu/9.04 (jaunty) Shiretoko/3.5.6pre

Crashes when running a youtube video and i try to maximize it. Awful!!
I have a Dell E6400

lspci | grep -i vga
00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)

[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 2.6.31-15-generic (buildd@rothera) (gcc version 4.4.1 (Ubuntu 4.4.1-4ubuntu8) ) #50-Ubuntu SMP Tue Nov 10 14:54:29 UTC 2009 (Ubuntu 2.6.31-15.50-generic)
[ 0.000000] KERNEL supported cpus:
[ 0.000000] Intel GenuineIntel
[ 0.000000] AMD AuthenticAMD
[ 0.000000] NSC Geode by NSC
[ 0.000000] Cyrix CyrixInstead
[ 0.000000] Centaur CentaurHauls
[ 0.000000] Transmeta GenuineTMx86
[ 0.000000] Transmeta TransmetaCPU
[ 0.000000] UMC UMC UMC UMC
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: 0000000000000000 - 000000000009f000 (usable)
[ 0.000000] BIOS-e820: 000000000009f000 - 00000000000a0000 (reserved)
[ 0.000000] BIOS-e820: 0000000000100000 - 00000000dd04d400 (usable)
[ 0.000000] BIOS-e820: 00000000dd04d400 - 00000000dd04f400 (ACPI NVS)
[ 0.000000] BIOS-e820: 00000000dd04f400 - 00000000e0000000 (reserved)
[ 0.000000] BIOS-e820: 00000000f8000000 - 00000000fc000000 (reserved)
[ 0.000000] BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved)
[ 0.000000] BIOS-e820: 00000000fed18000 - 00000000fed1c000 (reserved)
[ 0.000000] BIOS-e820: 00000000fed20000 - 00000000fed90000 (reserved)
[ 0.000000] BIOS-e820: 00000000feda0000 - 00000000feda6000 (reserved)
[ 0.000000] BIOS-e820: 00000000fee00000 - 00000000fee10000 (reserved)
[ 0.000000] BIOS-e820: 00000000ffe60000 - 0000000100000000 (reserved)
[ 0.000000] BIOS-e820: 0000000100000000 - 0000000120000000 (usable)
[ 0.000000] DMI 2.4 present.
[ 0.000000] last_pfn = 0xdd04d max_arch_pfn = 0x100000
[ 0.000000] MTRR default type: uncachable
[ 0.000000] MTRR fixed ranges enabled:
[ 0.000000] 00000-9FFFF write-back
[ 0.000000] A0000-BFFFF uncachable
[ 0.000000] C0000-CFFFF write-protect
[ 0.000000] D0000-EFFFF uncachable
[ 0.000000] F0000-FFFFF write-protect
[ 0.000000] MTRR variable ranges enabled:
[ 0.000000] 0 base 000000000 mask 800000000 write-back
[ 0.000000] 1 base 0E0000000 mask FE0000000 uncachable
[ 0.000000] 2 base 0DDC00000 mask FFFC00000 uncachable
[ 0.000000] 3 base 0DE000000 mask FFE000000 uncachable
[ 0.000000] 4 disabled
[ 0.000000] 5 disabled
[ 0.000000] 6 disabled
[ 0.000000] x86 PAT enabled: cpu 0, old 0x7040600070406, new 0x7010600070106
[ 0.000000] e820 update range: 00000000ddc00000 - 0000000100000000 (usable) ==> (reserved)
[ 0.000000] e820 update range: 0000000000002000 - 0000000000006000 (usable) ==> (reserved)
[ 0.000000] Scanning 1 areas for low memory corruption
[ 0.000000] modified physical RAM map:
[ 0.000000] modified: 0000000000000000 - 0000000000002000 (usable)
[ 0.000000] modified: 0000000000002000 - 0000000000006000 (reserved)
[ 0.000000] modified: 0000000000006000 - 000000000009f000 (usable)
[ 0.000000] modified: 000000000009f000 - 00000000000a0000 (reserved)
[ 0.000000] modified: 0000000000100000 - 00000000dd0...

Revision history for this message
Micah Gersten (micahg) wrote :

This bug was fixed. Please file a new bug report if you are still experiencing crashing. You can reference this bug number so that we can check if it's the same issue or not.

Stendys (lars-stendys)
Changed in firefox-3.5 (Ubuntu):
assignee: nobody → Stendys (lars-stendys)
Revision history for this message
Micah Gersten (micahg) wrote :

@Stendys

Please don't assign yourself bugs unless you are going to fix them. This bug is already fixed.

Changed in firefox-3.5 (Ubuntu):
assignee: Stendys (lars-stendys) → nobody
Revision history for this message
czaby (peter-czabala) wrote :

It is not fixed. Firefox still crashing when going to fullscreen with youtube videos.

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
importance: Unknown → Critical
Bug Watch Updater (bug-watch-updater)
Changed in firefox-3.5 (Fedora):
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Bug attachments

Remote bug watches

Bug watches keep track of this bug in other bug trackers.