Bug#562698: iceweasel: crashes randomly and never figures out why

Tue Dec 29 14:09:52 UTC 2009

On Monday 28 December 2009, Mike Hommey wrote:
> On Sun, Dec 27, 2009 at 10:16:53AM +0800, Li He wrote:
> > Package: iceweasel
> > Version: 3.5.6-1
> > Severity: important
> > 
> > I am suffering from the random crashes of iceweasel possibly from 3.5.x versions.
> > I tried many of them, 3.5.2, 3.5.3, 3.5.4, 3.5.5 and now 3.5.6. They all crash 
> > randomly. I googled many times and I found there are guys reporting similar bugs.
> > Some of them are even told their claimed bug is fixed but to my own experience
> > iceweasel never stops this random crashes.
> > 
> > First I tried to create a new profile, since it is said the old profile might
> > include something that crashes the program. But soon I found out the crash still
> > occurs.
> > 
> > Later I found someone says you might create an empty ~/.mozilla. So I removed my
> > ~/.mozilla and start up an iceweasel without any extensions or plugins. But all
> > of a sudden, the browser crashed again.
> > 
> > So I think it has nothing to do with plugins or extensions. It is simply from
> > iceweasel itself. Don't tell me it has anything to do with the kernel. During
> > this period, 2.6.29, 2.6.30, 2.6.31(-trunk) and now 2.6.32-trunk. And the driver,
> > someone says the video driver might cause trouble. But if I remember well,
> > I did configured it properly (with radeon for ATI X1400 on a T60 thinkpad).
> > 
> > I can't trace with iceweasel -g option (with iceweasel-dbg and xulrunner-dbg 
> > installed). I can see there is a gdb process after executing the command but 
> > I wait for 5-6 minutes and nothing happens (the harddisk was not even reading
> > anything). I did try without iceweasel-dbg some time earlier. The tracing was
> > not successful gdb only provided very limited information, which is almost
> > identical to some earlier bug report.
> > 
> > This random crash happens when a tab is closed, either by clicking the x on
> > top of the tab or press Ctrl-W. The gdb will claim there is a seg fault due to
> > an image (if I remember well). If I restart the firefox, sometimes it will
> > notify me to restore the last session due to a crash but sometimes it will
> > simply restore the session without any notification (as if nothing happens).
> > 
> > I am very serious about this problem since I can't bear it any more. Just think
> > about it. Every 10-20 minites surfing the web, the browser crashes and you have
> > to restart it. In Windows, this never happens. If any more information is demanded
> > I will try to provide ASAP. But so far, I just got this simple description.
> > 
> > Sometimes I even suspect that the crash is caused by my input method. But now
> > I think I am wrong about it. I tried ibus and scim. Browers like arora do have
> > some conflicts with ibus. They crash when I type with ibus triggered. But this
> > never happens with iceweasel, with neither scim nor ibus.
> 
> Could you try the instructions in /usr/share/bug/iceweasel/presubj, most
> notably, the one to disable plugins.
> 
> Thanks
> 
> Mike
> 

I did try this:
MOZILLA_DISABLE_PLUGINS=1 /usr/bin/iceweasel
The crash came several minutes later when I closed one tab. The returned information 
on the terminal is
Trace/breakpoint trap

To be honest, I mentioned I tried this last time except with no command given.

Here I list some other information. Please try this sequence:
mv ~/.mozilla ~/.mozilla.bak
MOZILLA_DISABLE_PLUGINS=1 /usr/bin/iceweasel -g

visit some web pages. what I did was
the first tab: http://new.sina.com.cn
the second tab: http://www.vip.edu.cn
the third tab: http://demonstrate.ycool.com
after opening the three sites in my iceweasel, I returned to the second page, clicked 
some links (the one meaning product if you understand Chinese) there and closed it with 
Ctrl-W. Then my X is even frozen. Luckily I got the following information in gdb:

GNU gdb (GDB) 7.0-debian
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/lib/iceweasel/firefox-bin...(no debugging symbols found)...done.
(gdb) set pagination off 
(gdb) run 
Starting program: /usr/lib/iceweasel/firefox-bin 
[Thread debugging using libthread_db enabled]

(firefox-bin:13385): GLib-WARNING **: g_set_prgname() called multiple times
[New Thread 0xb68ffb70 (LWP 13391)]
[New Thread 0xb60feb70 (LWP 13392)]
[Thread 0xb60feb70 (LWP 13392) exited]
[Thread 0xb68ffb70 (LWP 13391) exited]
Executing new program: /usr/lib/xulrunner-1.9.1/xulrunner-stub
[Thread debugging using libthread_db enabled]

(firefox-bin:13385): GLib-WARNING **: g_set_prgname() called multiple times
[New Thread 0xb67ffb70 (LWP 13398)]
[New Thread 0xb5ffeb70 (LWP 13399)]
[New Thread 0xb57fdb70 (LWP 13400)]
[New Thread 0xb3a38b70 (LWP 13401)]
[Thread 0xb3a38b70 (LWP 13401) exited]
[New Thread 0xb3a38b70 (LWP 13402)]
[Thread 0xb5ffeb70 (LWP 13399) exited]
[Thread 0xb3a38b70 (LWP 13402) exited]
[Thread 0xb57fdb70 (LWP 13400) exited]
[Thread 0xb67ffb70 (LWP 13398) exited]
Executing new program: /usr/lib/xulrunner-1.9.1/xulrunner-stub
[Thread debugging using libthread_db enabled]

(firefox-bin:13385): GLib-WARNING **: g_set_prgname() called multiple times
[New Thread 0xb67ffb70 (LWP 13404)]
[New Thread 0xb5ffeb70 (LWP 13405)]
[New Thread 0xb57fdb70 (LWP 13406)]
[New Thread 0xb3affb70 (LWP 13407)]
[Thread 0xb3affb70 (LWP 13407) exited]
[New Thread 0xb3affb70 (LWP 13408)]
[New Thread 0xb2dffb70 (LWP 13409)]
[New Thread 0xb25feb70 (LWP 13410)]
[Thread 0xb3affb70 (LWP 13408) exited]
[New Thread 0xb3affb70 (LWP 13411)]
[New Thread 0xafeffb70 (LWP 13412)]
[New Thread 0xaf6feb70 (LWP 13413)]
[New Thread 0xaeefdb70 (LWP 13414)]

[New Thread 0xae3ffb70 (LWP 13415)]
[Thread 0xae3ffb70 (LWP 13415) exited]
[New Thread 0xae3ffb70 (LWP 13416)]
[Thread 0xae3ffb70 (LWP 13416) exited]
[New Thread 0xae3ffb70 (LWP 13417)]
[Thread 0xae3ffb70 (LWP 13417) exited]
[New Thread 0xae3ffb70 (LWP 13418)]
[Thread 0xae3ffb70 (LWP 13418) exited]
[New Thread 0xae3ffb70 (LWP 13419)]
[Thread 0xae3ffb70 (LWP 13419) exited]
[New Thread 0xae3ffb70 (LWP 13420)]
[Thread 0xae3ffb70 (LWP 13420) exited]
[New Thread 0xae3ffb70 (LWP 13421)]
[New Thread 0xacbffb70 (LWP 13422)]
[Thread 0xacbffb70 (LWP 13422) exited]
[New Thread 0xacbffb70 (LWP 13423)]
[Thread 0xacbffb70 (LWP 13423) exited]
[New Thread 0xacbffb70 (LWP 13424)]
[Thread 0xacbffb70 (LWP 13424) exited]

Gdk-ERROR **: The program 'firefox-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'RenderBadPicture (invalid Picture parameter)'.
  (Details: serial 62330 error_code 158 request_code 148 minor_code 7)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)
aborting...

Program received signal SIGTRAP, Trace/breakpoint trap.
0x4697ec44 in g_logv () from /lib/libglib-2.0.so.0

The back trace is:
(gdb) bt full
#0  0x4697ec44 in g_logv () from /lib/libglib-2.0.so.0
No symbol table info available.
#1  0x4697efd6 in g_log () from /lib/libglib-2.0.so.0
No symbol table info available.
#2  0x483ae407 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#3  0x4846bb85 in ?? () from /usr/lib/libbonoboui-2.so.0
No symbol table info available.
#4  0x46716a19 in _XError () from /usr/lib/libX11.so.6
No symbol table info available.
#5  0x4671dfda in ?? () from /usr/lib/libX11.so.6
No symbol table info available.
#6  0x4671e6ad in _XReply () from /usr/lib/libX11.so.6
No symbol table info available.
#7  0x4670c06d in XQueryPointer () from /usr/lib/libX11.so.6
No symbol table info available.
#8  0x483bb2e0 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#9  0x4836298c in ?? () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#10 0x483631bf in gdk_display_get_window_at_pointer () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#11 0xb7790377 in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#12 0x49639322 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
No symbol table info available.
#13 0x46a04e13 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#14 0x46a1c34f in ?? () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#15 0x46a1d84f in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#16 0x46a1de16 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#17 0x4977b1be in ?? () from /usr/lib/libgtk-x11-2.0.so.0
No symbol table info available.
#18 0x49632121 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
No symbol table info available.
#19 0x483a5b2a in ?? () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#20 0x46975098 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
No symbol table info available.
#21 0x46978823 in ?? () from /lib/libglib-2.0.so.0
No symbol table info available.
#22 0x469789a8 in g_main_context_iteration () from /lib/libglib-2.0.so.0
No symbol table info available.
#23 0xb7791d08 in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#24 0xb77a58b8 in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#25 0xb77a5a04 in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#26 0xb7852cf6 in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#27 0xb7824aff in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#28 0xb77a5b6a in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#29 0xb7676388 in ?? () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#30 0xb7045c94 in XRE_main () from /usr/lib/xulrunner-1.9.1/libxul.so
No symbol table info available.
#31 0x08049de5 in ?? ()
No symbol table info available.
#32 0x42ce1b55 in __libc_start_main (main=Could not find the frame base for "__libc_start_main".
) at libc-start.c:222
        result = <value optimized out>
        unwind_buf = Could not find the frame base for "__libc_start_main".

I installed iceweasek-dbg, but it won't back trace.
Program received signal SIGTRAP, Trace/breakpoint trap.
IA__g_logv (log_domain=0x483c5b6b "Gdk", log_level=G_LOG_LEVEL_ERROR, format=0x483e3760 "%s", args1=0xbfffa39c "") at /tmp/buildd/glib2.0-2.23.1/glib/gmessages.c:555
555	/tmp/buildd/glib2.0-2.23.1/glib/gmessages.c: No such file or directory.
	in /tmp/buildd/glib2.0-2.23.1/glib/gmessages.c
(gdb) bt full
#0  IA__g_logv (log_domain=Cannot access memory at address 0xbfffa370
) at /tmp/buildd/glib2.0-2.23.1/glib/gmessages.c:555
        depth = Cannot access memory at address 0xbfff9f3c

Hope this helps you find the bug.

Best wishes!

-- 
He, Li
Shanghai Key Lab of Intelligent Information Processing
School of Computer Science
Fudan University, Shanghai, China
E-mail: I.demonstrate at gmail.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.alioth.debian.org/pipermail/pkg-mozilla-maintainers/attachments/20091229/16f168ed/attachment-0001.pgp>