485504 - Clicking fullscreen in the blip.tv flash video player, causes firefox 3.13b to fault in glibc

Status: VERIFIED DUPLICATE of bug 469439

(Firefox :: General, defect)

Description

[Greg Bowyer]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3

Pressing the fullscreen button in the blip.tv flash player causes firefox to crash inside glibc whereby it complains that it cannot free a given pointer.

I am not sure if this is flash or firefox, and I do not have a build with symbols, but I am willing to test on a version that has symbols, provide core dumps etc as necessary

Reproducible: Always

Steps to Reproduce:
1. Navigate to blip.tv (http://clojure.blip.tv/#1319826)
2. Start playing the video
3. Press the fullscreen button
Actual Results:  
The flash video goes full screen

Expected Results:  
Firefox crashes

Backtrace of this is attached to the bug report

 *** glibc detected *** /opt/mozilla/firefox/3.1b3/firefox-bin: free(): invalid pointer: 0xabd4b190 ***

uname -a
Linux gregs-desktop 2.6.27-11-generic #1 SMP Thu Jan 29 19:24:39 UTC 2009 i686 GNU/Linux

Ubuntu 8, standard install

the tracemoneky jit is on for *both* content and chrome

Comment 1

[Greg Bowyer]

A core file is available here 
http://gbowyer.freeshell.org/moz-ff3.1b3-bliptv-flash.core.bz2

Comment 2

[Greg Bowyer]

Attachment: Stacktrace produced when glibc fails on free()

Comment 3

[timeless]

sorry, your stack trace isn't helpful.

bug 420474 comment 1 has a script which can enable you to try to download symbols for mozilla.org binaries. If you can get it to work, you can try to get a useful stack trace.

note that we don't usually have people w/ time to pull in random core dumps and analyze them.

Comment 4

[Stuart]

I have a similar bug in FF3.5B4 on ubuntu 9.04, when clicking fullscreen the browser windows vanish

Comment 5

[nemo]

Same thing? Fullscreen on multiple players appears to crash.

$ *** glibc detected *** ./firefox-bin: munmap_chunk(): invalid pointer: 0xa69d14a0 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb67ad604]
/usr/lib/libGL.so.1[0xac4a5355]
======= Memory map: ========
08048000-08056000 r-xp 00000000 08:06 14332955   /home/nemo/firefox/firefox-bin
08056000-08057000 rw-p 0000d000 08:06 14332955   /home/nemo/firefox/firefox-bin
08057000-08058000 rw-p 08057000 00:00 0 
a34e8000-a4202000 r-xp 00000000 08:06 17169510   /usr/lib/libGLcore.so.180.44
a4202000-a43f4000 rwxp 00d19000 08:06 17169510   /usr/lib/libGLcore.so.180.44
a43f4000-a4400000 rwxp a43f4000 00:00 0 
a4400000-a5500000 rw-p a4400000 00:00 0 
a55fd000-a55fe000 ---p a55fd000 00:00 0 
a55fe000-a5dfe000 rwxp a55fe000 00:00 0 
a5dfe000-a5dff000 ---p a5dfe000 00:00 0 
a5dff000-a65ff000 rwxp a5dff000 00:00 0 
a6600000-a6d00000 rw-p a6600000 00:00 0 
a6daa000-a7500000 r--p 00000000 08:06 18727937   /usr/share/fonts/truetype/sazanami/sazanami-gothic.ttf
a7500000-a7800000 rw-p a7500000 00:00 0 
a7842000-a78ce000 r--p 00000000 08:06 25402407   /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Bold.ttf
a78ce000-a8024000 r--p 00000000 08:06 18727937   /usr/share/fonts/truetype/sazanami/sazanami-gothic.ttf
a8024000-a8068000 r--p 00000000 08:06 24643662   /usr/share/fonts/truetype/msttcorefonts/Arial.ttf
a8068000-a8100000 r--p 00000000 08:06 25402369   /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
a8100000-a8a00000 rw-p a8100000 00:00 0 
a8a29000-a8b5c000 r-xp 00000000 08:06 13798440   /lib/i686/cmov/libcrypto.so.0.9.8
a8b5c000-a8b64000 r--p 00132000 08:06 13798440   /lib/i686/cmov/libcrypto.so.0.9.8
a8b64000-a8b71000 rw-p 0013a000 08:06 13798440   /lib/i686/cmov/libcrypto.so.0.9.8
a8b71000-a9b75000 rw-p a8b71000 00:00 0 
a9b75000-aa4e2000 r-xp 00000000 08:06 1245193    /usr/lib/flashplugin-installer/libflashplayer.so
aa4e2000-aa515000 rw-p 0096c000 08:06 1245193    /usr/lib/flashplugin-installer/libflashplayer.so
aa515000-ac400000 rw-p aa515000 00:00 0 
ac444000-ac4d1000 r-xp 00000000 08:06 17169509   /usr/lib/libGL.so.180.44
ac4d1000-ac4ef000 rwxp 0008d000 08:06 17169509   /usr/lib/libGL.so.180.44
ac4ef000-ac4fe000 rwxp ac4ef000 00:00 0 
ac4fe000-ac4ff000 ---p ac4fe000 00:00 0 
ac4ff000-accff000 rwxp ac4ff000 00:00 0 
accff000-acd00000 ---p accff000 00:00 0 
acd00000-ad500000 rwxp acd00000 00:00 0 
ad500000-ad700000 rw-p ad500000 00:00 0 
ad72d000-ad76d000 r--p 00000000 08:06 1228247    /usr/share/fonts/truetype/misc/tahomabd.ttf
ad76d000-ad7fc000 r-xp 00000000 08:06 15105036   /usr/lib/libkrb5.so.3.3
ad7fc000-ad7fe000 r--p 0008e000 08:06 15105036   /usr/lib/libkrb5.so.3.3
ad7fe000-ad7ff000 rw-p 00090000 08:06 15105036   /usr/lib/libkrb5.so.3.3
ad7ff000-ad800000 ---p ad7ff000 00:00 0 
ad800000-ae000000 rwxp ad800000 00:00 0 
ae000000-ae200000 rw-p ae000000 00:00 0 
ae200000-ae226000 r--p 00000000 08:06 1228292    /usr/share/fonts/truetype/misc/verdanai.ttf
ae226000-ae248000 r-xp 00000000 08:06 15105034   /usr/lib/libk5crypto.so.3.1
ae248000-ae249000 r--p 00022000 08:06 15105034   /usr/lib/libk5crypto.so.3.1
ae249000-ae24a000 rw-p 00023000 08:06 15105034   /usr/lib/libk5crypto.so.3.1
ae24a000-ae28c000 r-xp 00000000 08:06 13798444   /lib/i686/cmov/libssl.so.0.9.8
ae28c000-ae28d000 r--p 00041000 08:06 13798444   /lib/i686/cmov/libssl.so.0.9.8
ae28d000-ae290000 rw-p 00042000 08:06 13798444   /lib/i686/cmov/libssl.so.0.9.8
ae290000-ae2b9000 r-xp 00000000 08:06 15105033   /usr/lib/libgssapi_krb5.so.2.2
ae2b9000-ae2ba000 r--p 00028000 08:06 15105033   /usr/lib/libgssapi_krb5.so.2.2
ae2ba000-ae2bb000 rw-p 00029000 08:06 15105033   /usr/lib/libgssapi_krb5.so.2.2
ae2bb000-ae2fb000 r-xp 00000000 08:06 15080462   /usr/lib/libldap_r-2.4.so.2.4.1
ae2fb000-ae2fc000 ---p 00040000 08:06 15080462   /usr/lib/libldap_r-2.4.so.2.4.1
ae2fc000-ae2fd000 r--p 00040000 08:06 15080462   /usr/lib/libldap_r-2.4.so.2.4.1
ae2fd000-ae2fe000 rw-p 00041000 08:06 15080462   /usr/lib/libldap_r-2.4.so.2.4.1
ae2fe000-ae2ff000 rw-p ae2fe000 00:00 0 
ae2ff000-ae300000 ---p ae2ff000 00:00 0 
ae300000-aeb00000 rwxp ae300000 00:00 0 
aeb00000-af000000 rw-p aeb00000 00:00 0 
af001000-af017000 r-xp 00000000 08:06 1237027    /usr/lib/libsasl2.so.2.0.22
af017000-af018000 r--p 00015000 08:06 1237027    /usr/lib/libsasl2.so.2.0.22
af018000-af019000 rw-p 00016000 08:06 1237027    /usr/lib/libsasl2.so.2.0.22
af019000-af03c000 r--p 00000000 08:06 1228290    /usr/share/fonts/truetype/misc/verdana.ttf
af05f000-af0bc000 r-xp 00000000 08:06 1237111    /usr/lib/libpulse.so.0.7.1
af0bc000-af0bd000 r--p 0005c000 08:06 1237111    /usr/lib/libpulse.so.0.7.1
af0bd000-af0be000 rw-p 0005d000 08:06 1237111    /usr/lib/libpulse.so.0.7.1
af0c3000-af0ca000 r-xp 00000000 08:06 15105037   /usr/lib/libkrb5support.so.0.1
af0ca000-af0cb000 r--p 00006000 08:06 15105037   /usr/lib/libkrb5support.so.0.1
af0cb000-af0cc000 rw-p 00007000 08:06 15105037   /usr/lib/libkrb5support.so.0.1
af0cc000-af0fc000 r-xp 00000000 08:06 15080899   /usr/lib/libidn.so.11.5.39
af0fc000-af0fd000 ---p 00030000 08:06 15080899   /usr/lib/libidn.so.11.5.39
af0fd000-af0fe000 r--p 00030000 08:06 15080899   /usr/lib/libidn.so.11.5.39
af0fe000-af0ff000 rw-p 00031000 08:06 15080899   /usr/lib/libidn.so.11.5.39
af0ff000-af100000 ---p af0ff000 00:00 0 
af100000-af900000 rwxp af100000 00:00 0 
af900000-afb00000 rw-p af900000 00:00 0 
afb00000-afb0c000 r-xp 00000000 08:06 15080456   /usr/lib/liblber-2.4.so.2.4.1
afb0c000-afb0d000 r--p 0000b000 08:06 15080456   /usr/lib/liblber-2.4.so.2.4.1
afb0d000-afb0e000 rw-p 0000c000 08:06 15080456   /usr/lib/liblber-2.4.so.2.4.1
afb30000-afb57000 r--p 00000000 08:06 1227956    /usr/share/fonts/truetype/misc/georgiai.ttf
afb57000-afb93000 r-xp 00000000 08:06 17169470   /usr/lib/libcurl.so.4.1.0
afb93000-afb94000 r--p 0003c000 08:06 17169470   /usr/lib/libcurl.so.4.1.0
afb94000-afb95000 rw-p 0003d000 08:06 17169470   /usr/lib/libcurl.so.4.1.0
afb95000-afbd9000 r--p 00000000 08:06 24643662   /usr/share/fonts/truetype/msttcorefonts/Arial.ttf
afbd9000-afbeb000 r--p 00000000 08:06 1208370    /usr/share/fonts/type1/gsfonts/n019004l.pfb
afbff000-afc00000 ---p afbff000 00:00 0 
afc00000-b0400000 rwxp afc00000 00:00 0 
b0400000-b0500000 rw-p b0400000 00:00 0 
b0500000-b0502000 r-xp 00000000 08:06 2838548    /lib/libkeyutils-1.2.so
b0502000-b0503000 r--p 00001000 08:06 2838548    /lib/libkeyutils-1.2.so
b0503000-b0504000 rw-p 00002000 08:06 2838548    /lib/libkeyutils-1.2.so
b050e000-b0522000 r--p 00000000 08:06 1208369    /usr/share/fonts/type1/gsfonts/n019003l.pfb
b0534000-b0544000 r--p 00000000 08:06 1228266    /usr/share/fonts/truetype/misc/trebucbd.ttf
b0544000-b0575000 r-xp 00000000 08:06 5614625    /usr/lib/libcroco-0.6.so.3.0.1
b0575000-b0578000 rw-p 00030000 08:06 5614625    /usr/lib/libcroco-0.6.so.3.0.1
b0578000-b05ab000 r-xp 00000000 08:06 15080879   /usr/lib/libgsf-1.so.114.0.11
b05ab000-b05ac000 ---p 00033000 08:06 15080879   /usr/lib/libgsf-1.so.114.0.11
b05ac000-b05ae000 r--p 00033000 08:06 15080879   /usr/lib/libgsf-1.so.114.0.11
b05ae000-b05af000 rw-p 00035000 08:06 15080879   /usr/lib/libgsf-1.so.114.0.11
b05af000-b05b0000 rw-p b05af000 00:00 0 
b05b0000-b05e1000 r-xp 00000000 08:06 15080881   /usr/lib/librsvg-2.so.2.26.0
b05e1000-b05e2000 r--p 00031000 08:06 15080881   /usr/lib/librsvg-2.so.2.26.0
b05e2000-b05e3000 rw-p 00032000 08:06 15080881   /usr/lib/librsvg-2.so.2.26.0
b05ed000-b05fe000 r--p 00000000 08:06 1228280    /usr/share/fonts/truetype/misc/vera.ttf
b05fe000-b05ff000 ---p b05fe000 00:00 0 
b05ff000-b0dff000 rwxp b05ff000 00:00 0 
b0dff000-b0e00000 ---p b0dff000 00:00 0 
b0e00000-b1600000 rwxp b0e00000 00:00 0 
b1600000-b1800000 rw-p b1600000 00:00 0 
b1801000-b1803000 r-xp 00000000 08:06 2838546    /lib/libcom_err.so.2.1
b1803000-b1804000 r--p 00001000 08:06 2838546    /lib/libcom_err.so.2.1
b1804000-b1805000 rw-p 00002000 08:06 2838546    /lib/libcom_err.so.2.1
b1805000-b1bb7000 r--p 00000000 08:06 1150983    /usr/share/icons/hicolor/icon-theme.cache
b1bb7000-b2200000 r--p 00000000 08:06 1118215    /usr/share/icons/gnome/icon-theme.cache
b2200000-b2b00000 rw-p b2200000 00:00 0 
b2b02000-b2b1a000 rwxp b2b02000 00:00 0 
b2b1b000-b2b20000 r-xp 00000000 08:06 1238651    /usr/lib/libgdbm.so.3.0.0
b2b20000-b2b21000 r--p 00004000 08:06 1238651    /usr/lib/libgdbm.so.3.0.0
b2b21000-b2b22000 rw-p 00005000 08:06 1238651    /usr/lib/libgdbm.so.3.0.0
b2b2Segmentation fault

Comment 6

[nemo]

Actually, looks like this is dupe of bug #469439