1320542 - Firefox crashes when dragging inline map

Status: RESOLVED DUPLICATE of bug 1271100

(Firefox :: Untriaged, defect)

Description

[ks132]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161114220042

Steps to reproduce:

1. Go to http://wikiroutes.info/en/msk?routes=1138
2. Drag inline map for a while in different directions



Actual results:

Firefox window closed.
In dmesg I see either 

[ 7485.169110] traps: firefox[7335] trap int3 ip:7fc3d3e21a21 sp:7fffd0c768a0 error:0 in libglib-2.0.so.0.5000.1[7fc3d3dd2000+110000]

or

[ 7485.355895] Chrome_ChildThr[7413]: segfault at 0 ip 0000561da8d3fb39 sp 00007fb78eafe2e0 error 6 in plugin-container[561da8d37000+3f000]

Backtrace of crashed process:
#0  0x00007fc3d3e21a21 in _g_log_abort (breakpoint=breakpoint@entry=1) at gmessages.c:487
#1  0x00007fc3d3e24161 in g_log_writer_default (log_level=6, log_level@entry=G_LOG_LEVEL_ERROR, fields=fields@entry=0x7fffd0c76900, n_fields=n_fields@entry=6, user_data=user_data@entry=0x0) at gmessages.c:2382
#2  0x00007fc3d3e225bc in g_log_structured_array (log_level=G_LOG_LEVEL_ERROR, fields=0x7fffd0c76900, n_fields=6) at gmessages.c:1770
#3  0x00007fc3d3e228b9 in g_log_structured (log_domain=log_domain@entry=0x7fc3d6813cce "Gdk", log_level=log_level@entry=G_LOG_LEVEL_ERROR) at gmessages.c:1597
#4  0x00007fc3d67d5e1e in _gdk_x11_display_error_event (display=display@entry=0x7fc3bbc0c1c0 [GdkX11Display], error=error@entry=0x7fffd0c77080) at gdkdisplay-x11.c:2579
#5  0x00007fc3d67e2ff3 in gdk_x_error (xdisplay=0x7fc3d78f7000, error=0x7fffd0c77080) at gdkmain-x11.c:307
#6  0x00007fc3d606aded in _XError (dpy=dpy@entry=0x7fc3d78f7000, rep=rep@entry=0x7fc3870aa640) at XlibInt.c:1434
#7  0x00007fc3d6067d17 in handle_error (dpy=0x7fc3d78f7000, err=0x7fc3870aa640, in_XReply=<optimized out>) at xcb_io.c:199
#8  0x00007fc3d6067dd5 in handle_response (dpy=0x7fc3d78f7000, response=0x7fc3870aa640, in_XReply=<optimized out>) at xcb_io.c:311
#9  0x00007fc3d60686d5 in _XEventsQueued (dpy=dpy@entry=0x7fc3d78f7000, mode=mode@entry=2) at xcb_io.c:350
#10 0x00007fc3d605a3a7 in XPending (dpy=dpy@entry=0x7fc3d78f7000) at Pending.c:55
#11 0x00007fc3d67dd5dc in _gdk_x11_display_queue_events (display=0x7fc3bbc0c1c0 [GdkX11Display]) at gdkeventsource.c:327
#12 0x00007fc3d67a7a69 in gdk_display_get_event (display=display@entry=0x7fc3bbc0c1c0 [GdkX11Display]) at gdkdisplay.c:438
#13 0x00007fc3d67dd452 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:363
#14 0x00007fc3d3e1be42 in g_main_dispatch (context=0x7fc3bbc153d0) at gmain.c:3203
#15 0x00007fc3d3e1be42 in g_main_context_dispatch (context=context@entry=0x7fc3bbc153d0) at gmain.c:3856
#16 0x00007fc3d3e1c1c0 in g_main_context_iterate (context=context@entry=0x7fc3bbc153d0, block=block@entry=0, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3929
#17 0x00007fc3d3e1c26c in g_main_context_iteration (context=0x7fc3bbc153d0, may_block=0) at gmain.c:3990
#18 0x00007fc3c9e3585f in nsAppShell::ProcessNextNativeEvent(bool) () at /usr/lib64/firefox/libxul.so
#19 0x00007fc3c9e1d4b3 in nsBaseAppShell::DoProcessNextNativeEvent(bool) () at /usr/lib64/firefox/libxul.so
#20 0x00007fc3c9e1d612 in nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) () at /usr/lib64/firefox/libxul.so
#21 0x00007fc3c8a99b9f in nsThread::ProcessNextEvent(bool, bool*) () at /usr/lib64/firefox/libxul.so
#22 0x00007fc3c8ab4c37 in NS_ProcessNextEvent(nsIThread*, bool) () at /usr/lib64/firefox/libxul.so
#23 0x00007fc3c8cc371e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () at /usr/lib64/firefox/libxul.so
#24 0x00007fc3c8cae7a2 in MessageLoop::Run() () at /usr/lib64/firefox/libxul.so
#25 0x00007fc3c9e1b39c in nsBaseAppShell::Run() () at /usr/lib64/firefox/libxul.so
#26 0x00007fc3ca46ed12 in nsAppStartup::Run() () at /usr/lib64/firefox/libxul.so
#27 0x00007fc3ca4b3b78 in XREMain::XRE_mainRun() () at /usr/lib64/firefox/libxul.so
#28 0x00007fc3ca4b3e3f in XREMain::XRE_main(int, char**, nsXREAppData const*) () at /usr/lib64/firefox/libxul.so
#29 0x00007fc3ca4b4080 in XRE_main () at /usr/lib64/firefox/libxul.so
#30 0x0000564e391ef25e in do_main(int, char**, char**, nsIFile*) ()
#31 0x0000564e391ee817 in main ()



Expected results:

Dragging of map should not lead to Firefox crash.

Comment 1

[ks132]

Firefox process tree before crash looks like this:
 8280 tty2     Sl+    0:19 /usr/lib64/firefox/firefox
 8359 ?        Sl     0:00  \_ /usr/lib64/firefox/plugin-container -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 8280 tab

Comment 2

[YF (Yang)]

Could you provide a crash ID?
https://developer.mozilla.org/docs/How_to_get_a_stacktrace_for_a_bug_report.

Comment 3

[ks132]

(In reply to YF (Yang) from comment #2)
> Could you provide a crash ID?

Looks like no.
I am using Firefox from Fedora 25 distribution with Mozilla Crash Reporter disabled.
I can' even open about:crashes page:
https://support.mozilla.org/en-US/questions/936744

Comment 4

[YF (Yang)]

You can try to use https://ftp.mozilla.org/pub/firefox/releases/50.0/linux-x86_64/en-US/.


In addition, you can try to create a new profile, maybe it can solve this problem:
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles

Comment 5

[ks132]

(In reply to YF (Yang) from comment #4)
> You can try to use
> https://ftp.mozilla.org/pub/firefox/releases/50.0/linux-x86_64/en-US/.

This is what I've got:
[ks@localhost firefox]$ ./firefox

(firefox:11979): Gdk-ERROR **: The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAccess (attempt to access private resource denied)'.
  (Details: serial 6206 error_code 10 request_code 130 (MIT-SHM) minor_code 1)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the GDK_SYNCHRONIZE environment
   variable to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)
[Child 12043] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-rel-l64-00000000000000000000/build/src/ipc/glue/MessageChannel.cpp, line 2056
[Child 12043] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-rel-l64-00000000000000000000/build/src/ipc/glue/MessageChannel.cpp, line 2056

###!!! [Child][MessageChannel] Error: (msgtype=0x420003,name=PCompositable::Msg_Destroy) Channel error: cannot send/recv


###!!! [Child][MessageChannel] Error: (msgtype=0x420003,name=PCompositable::Msg_Destroy) Channel error: cannot send/recv

Trace/breakpoint trap (core dumped)



But still no crash reports were submitted in about:crashes page.

Comment 6

[ks132]

Probably duplicate of Bug 1320463. I can reproduce it as well.

Comment 7

[ks132]

Can't reproduce in 50.1.0.
Can be closed as duplicate of Bug 1271100. Thanks!