37212 - Above URL crashes browser: Gdk-ERROR **: BadMatch (invalid parameter attributes)

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Wayne Vinson]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.12 i386; en-US; m16) Gecko/20000421
BuildID:    2000042113

When loading the above page, the browser crashes after loading the page
background.  The url was origionally mentioned in bug 32739, but this seem to be
something diferent.

Reproducible: Always
Steps to Reproduce:
1.launch moz
2.go to url
3.watch crash

Actual Results:  crashed uner linux, near crash under Win98

Expected Results:  display page

sorry, ddd did stupid things when I tried to get a stack trace.

Comment 1

[Wayne Vinson]

Somehow this got set to build Config.  Should be browser-general.  Changing.

Comment 2

[Wayne Vinson]

console output:

->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Read Clipboard from memory
Document: Done (80.266 secs)
Error loading URL http://uvsclug.org/200001.shtml
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Write Clipboard to memory
Gdk-ERROR **: BadMatch (invalid parameter attributes)
  serial 344516 error_code 8 request_code 73 minor_code 0

Comment 3

[Andreas Franke (gone)]

gdb took quite a long time till segv'ing, but then I got this backtrace:
#0  0x400df903 in nsStr::Truncate () from /libxpcom.so
#1  0x400e41f8 in nsString::AssignWithConversion () from /libxpcom.so
#2  0x40b6a5cb in NSGetModule () from /components/libnecko.so
#3  0x40b6a2d7 in NSGetModule () from /components/libnecko.so
#4  0x40b684c4 in NSGetModule () from /components/libnecko.so
#5  0x40b6af45 in NSGetModule () from /components/libnecko.so
#6  0x4010ca20 in nsThread::Main () from /libxpcom.so
#7  0x4017279e in PR_Select () from /libnspr4.so
#8  0x40188b85 in pthread_start_thread (arg=0xbf7ffe40) at manager.c:241

This is PC/Linux, build 2000042518.
Confirming and reassigning to default component owner,
adding crash keyword, extending summary.

Comment 4

[Andreas Franke (gone)]

Maybe nsStr::Truncate is completely unrelated...
Running without gdb, the last lines are:

Gdk-ERROR **: BadMatch (invalid parameter attributes)
  serial 4104057 error_code 8 request_code 73 minor_code 0

aborting...
.//run-mozilla.sh: line 29:  8346 Aborted                 $prog ${1+"$@"}

And with gdb, the segv occurs immediately after a thread switch:

Gdk-ERROR **: BadMatch (invalid parameter attributes)
  serial 26116 error_code 8 request_code 73 minor_code 0
[Switching to Thread 6374]

Program received signal SIGSEGV, Segmentation fault.

and "info threads" says there are only two threads left:
* 4 Thread 6375  0x4030fdeb in __sigsuspend (set=0xbf5ffc10)
    at ../sysdeps/unix/sysv/linux/sigsuspend.c:48
  3 Thread 6374  0x400df903 in nsStr::Truncate ()
   from /home/afranke/mozilla/0425/libxpcom.so

So maybe that's why ddd does stupid things...

Comment 5

[Andreas Franke (gone)]

Removing nsStr::Truncate from summary. Sorry.

Comment 6

[Asa Dotzler [:asa]]

networking maybe.  Updating component and owner.

Comment 7

[Gagan]

This isn't in networking, the crash is in strings area. off to scc?

Comment 8

[Blake Ross]

Who set OS to all, and why?  I was unable to repro on 2000042608 despite 
repeated attempts...page loaded fine, though I did notice the slow scrolling 
reported in bug 32739.  has this been fixed, or is this pp linux?

Comment 9

[Wayne Vinson]

I set it to ALL based on the fact that a #mozillazine person reported a near
crash (ie extreamly high load for a long time) on Win98.  If this bug had a more
precise status, it might be New for Linux, Unconfirmend for Windows.  If this
justifies a change to OS Linux, I'll let a more knowledgable person do it.

Comment 10

[R.K.Aa.]

*** Bug 37917 has been marked as a duplicate of this bug. ***

Comment 11

[John Morrison]

Attachment: min testcase; problem resolving CSS url leads to this crash

Comment 12

[John Morrison]

Doh! That testcase only works when loaded from disk (not over the network).
However, I still think it points out the context in which the string error is 
triggered. 

Comment 13

[Andreas Franke (gone)]

For me (PC/Linux) the testcase crashes, too, but somehow differently:
- there is no Gdk-ERROR **: BadMatch message
- the stack trace seems to be completely different, it ends with

#0  0x4087458c in nsImageGTK::DrawCompositedGeneral ()
#1  0x4087497f in nsImageGTK::Draw ()
#2  0x40878a25 in nsRenderingContextGTK::DrawImage ()
#3  0x40029c0f in nsRenderingContextImpl::DrawTile ()

or 

#0  0x40360295 in chunk_free (ar_ptr=0x403f7d00, p=0x88ce4b0) at malloc.c:3027
#1  0x40360157 in __libc_free (mem=0x88ce4b8) at malloc.c:2950
#2  0x402d4e42 in __builtin_vec_delete (ptr=0x88ce4b8)
#3  0x408749ef in nsImageGTK::Draw ()
#4  0x40878a25 in nsRenderingContextGTK::DrawImage ()
#5  0x40029c0f in nsRenderingContextImpl::DrawTile ()

or

#0  0x40360443 in chunk_free (ar_ptr=0x403f7d00, p=0x892d458) at malloc.c:3048
#1  0x40360157 in __libc_free (mem=0x892d460) at malloc.c:2950
#2  0x40665dd1 in _XDestroyImage () from /usr/X11R6/lib/libX11.so.6
#3  0x414379d3 in nsImageGTK::Draw ()
#4  0x4143ba25 in nsRenderingContextGTK::DrawImage ()
#5  0x40029c0f in nsRenderingContextImpl::DrawTile ()

So maybe the testcase belongs to a different bug?

Comment 14

[Andreas Franke (gone)]

Ok, I don't know why, but I don't see the Gdk-Error **: BadMatch messages
any more with the original URL(s), neither with http://uvsclug.org/200001.shtml
nor with http://www.konqueror.org/. So the testcase really belongs to this bug.

Comment 15

[Scott Collins]

Does that mean this bug no longer happens, or just that it doesn't happen with a 
subset of the cases where it was previously known to happen?

Comment 16

[Andreas Franke (gone)]

It still happens the same way as before with build 2000050811.

I figured out that the "Gdk-ERROR **: BadMatch" messages only appear 
when I'm logged in from home, but not if I'm logged in from a local 
machine. Locally, we have quite a fast ethernet here.

When I crash from home, the relevant threads have already died, and
they don't show up in gdb. When I crash here, I get:
#0  0x408cf5bc in nsImageGTK::DrawCompositedGeneral () from libgfx_gtk.so
#1  0x408cf93f in nsImageGTK::Draw ()                  from libgfx_gtk.so
#2  0x408d3c65 in nsRenderingContextGTK::DrawImage ()  from libgfx_gtk.so
#3  0x40029d1f in nsRenderingContextImpl::DrawTile ()  from libraptorgfx.so
which seems to be the real problem.

I think this is a cake for pav... ;)

Comment 17

[Scott Collins]

This was never a string bug, that just happened to show up on the stack in some 
early traces.  Re-assigning to GTK-bitch: pav.

Comment 18

[Stuart Parmenter]

badmatch has been fixed.  this page is still awful because it has a very large
8bit alpha png as the background for no apparent reason.  Not much we can do
about that.  If you want to file a bug about this page being painfully slow,
file a bug against [e-mail] and cc me.

Comment 19

[Andreas Franke (gone)]

Verified on PC/Linux with 2000051210 build.