490187 - Firefox 3.0.9 Segfaults on Ubuntu 9.04 Jaunty with Smarter Fox extension enabled

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Yongqian]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.9) Gecko/2009042114 Ubuntu/9.04 (jaunty) Firefox/3.0.9
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.9) Gecko/2009042114 Ubuntu/9.04 (jaunty) Firefox/3.0.9

I'm the author of the Smarter Fox extension and I just noticed that with it enabled, Firefox 3.0.9 segfaults when visiting www.kde.org.

Reproducible: Always

Steps to Reproduce:
1. Install Smarter Fox 1.3.1 from https://addons.mozilla.org/en-US/firefox/addon/9825
2. Go to Tools -> Smarter Fox and disable everything except "Show popup bubble"
3. Run Firefox from the console
4. Go to www.kde.org
5. Firefox segfaults. See the error in console.
Actual Results:  
segfault

Expected Results:  
no segfault

Smarter Fox does not use any binary components or anything else that should cause problems. It just uses regular javascript. It has no problems running on previous versions or other platforms. Please fix this ASAP, my users are complaining and blaming it on me :(.

Comment 1

[Yongqian]

This seems to not happen if FoxyProxy is enabled, so when testing please use a fresh profile with only Smarter Fox installed. If you need any more information, don't hesitate to ask.

Comment 2

[Nick Thomas [:nthomas] (UTC+12)]

Please give http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.0.10-candidates/build1/firefox-3.0.10.en-US.linux-i686.tar.bz2
a spin (yeah, I know it's not a 64bit build) - it has a fix for bug 489322, due out early this week.

Comment 3

[Yongqian]

I can't test it. With ia32-libs installed, trying to run it fails with 

./firefox-bin: error while loading shared libraries: libjemalloc.so: cannot open shared object file: No such file or directory

Comment 4

[Yongqian]

Also, I think this might be causing problems in Firefox 3.0.9 on Macs as well. I recall Firefox having hiccups on the Mac at work (with this extension installed) after the update. At the time I just blamed it on the Mac being slow but now I think it might be the same bug.

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

(In reply to comment #3)
> I can't test it. With ia32-libs installed, trying to run it fails with 
> 
> ./firefox-bin: error while loading shared libraries: libjemalloc.so: cannot
> open shared object file: No such file or directory

Looks like you're running ./firefox-bin instead of ./firefox

BTW, I tried to reproduce on mac with 3.0.9 and got it to chew all the CPU up but no crash. Unsure how I triggered it. Can't reproduce a crash on Ubuntu 07.10 and don't have anything more recent to hand.

Comment 6

[Yongqian]

./firefox runs firefox but it can't connect to the internet for some reason, complaining about some libraries being x64.

Comment 7

[Yongqian]

Ok, I just tested with Firefox 3.0.10 and the error still occurs. I do not believe that it is my extension's problem since it does not use any binary components and should thus be unable to trigger a segmentation fault no matter how buggy it is. If anyone needs more information I would be happy to provide it.

Comment 8

[Yongqian]

The output from Firefox is simply this:

yong@cmp2:~/.mozilla$ firefox
Segmentation fault
yong@cmp2:~/.mozilla$


I understand that the Firefox team is busy putting together a great product but I would feel better if anyone can at least confirm that this bug will be looked at.

Comment 9

[Nick Thomas [:nthomas] (UTC+12)]

If you could follow 
 https://wiki.ubuntu.com/DebuggingProgramCrash
to install debug symbols for your Ubuntu Firefox build, then get a backtrace for the crash using
 https://wiki.ubuntu.com/Backtrace
and _attach_ that to this bug. 

That should provide some information about what functions are in use when Firefox crashes. Binary extensions are not required in an extension to cause crashes, JS can trigger core bugs just as well.

Comment 10

[Yongqian]

Attachment: gdb backtrace

Comment 11

[Nick Thomas [:nthomas] (UTC+12)]

Top of the stack is nsSubDocumentFrame::Reflow, so over to Core::Layout for triage.

Comment 12

[Dave Garrett]

Same stack as bug 469366 & bug 482578.

Comment 13

[Boris Zbarsky [:bzbarsky]]

This is more likely to be a dup of bug 489050.  Just because the stack is the same doesn't mean the bug is the same; there are many possible ways to create the sort of broken frame tree that will cause a crash with this sort of stack.

Once bug 489050 is fixed, this should be retested.  Note the dependency I added a while back.

Comment 14

[Daniel Veditz [:dveditz]]

Now that bug 489050 is fixed on trunk and Shiretoko, does it in fact fix this bug?

Comment 15

[Mats Palmgren (inactive)]

Please file a new bug if the crash still occurs in a recent version of Firefox.