Closed Bug 545653 Opened 16 years ago Closed 15 years ago

crash [@ objc_msgSend] using object freed by [WebKit]IdleTimerVector/PoolCleaner after loading a PKCS#11 module

Categories

(Core :: Widget: Cocoa, defect)

Product:
Core
Component:
Widget: Cocoa
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
status1.9.2 --- .5-fixed

People

(Reporter: Stefan.Neis, Assigned: smichaud)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

Apple crash report
36.72 KB, text/plain
Details
User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; de-AT; rv:1.8.1.23) Gecko/20090906 SeaMonkey/1.1.18 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 We are using a PKCS#11 module (from onepin-opensc-pkcs11) which works nicely on other platforms and even on OSX with Firefox 3.5, but it crashes with Firefox 3.6. We realize it's going to be hard for you to reproduce, but thought that maybe the crash dump might give someone some idea(s). So here's the dump: Process: firefox-bin [252] Path: /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/firefox-bin Identifier: org.mozilla.firefox Version: 3.6 (3.6) Code Type: X86 (Native) Parent Process: bash [222] Interval Since Last Report: 3029 sec Crashes Since Last Report: 1 Per-App Interval Since Last Report: 2239 sec Per-App Crashes Since Last Report: 1 Date/Time: 2010-02-10 08:15:07.006 +0100 OS Version: Mac OS X 10.5.8 (9L30) Report Version: 6 Anonymous UUID: C752ACC9-9CAE-4219-81F0-F15D7CBFB5F0 Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000c0000023 Crashed Thread: 0 Thread 0 Crashed: 0 libobjc.A.dylib 0x916e9688 objc_msgSend + 24 1 XUL 0x01a1df9a JSD_GetValueForObject + 879946 2 XUL 0x018a6a47 void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) + 7304055 3 XUL 0x00fd013b XRE_main + 15707 4 org.mozilla.firefox 0x00002cb8 start + 2168 5 org.mozilla.firefox 0x00002542 start + 258 6 org.mozilla.firefox 0x00002469 start + 41 Thread 1: 0 libSystem.B.dylib 0x926f03ca select$DARWIN_EXTSN$NOCANCEL + 10 1 libnspr4.dylib 0x000563e2 PR_Now + 2034 2 libnspr4.dylib 0x000523f9 PR_Poll + 121 3 XUL 0x0108ef5a DumpJSStack + 686938 4 XUL 0x0108fb64 DumpJSStack + 690020 5 XUL 0x010900e3 DumpJSStack + 691427 6 XUL 0x01af2a0c NS_GetComponentRegistrar_P + 36156 7 XUL 0x01ab298a JNIEnv_::CallStaticObjectMethod(_jclass*, _jmethodID*, ...) + 272922 8 XUL 0x0108f69b DumpJSStack + 688795 9 XUL 0x01af2a67 NS_GetComponentRegistrar_P + 36247 10 XUL 0x01ab298a JNIEnv_::CallStaticObjectMethod(_jclass*, _jmethodID*, ...) + 272922 11 XUL 0x01af2c8c NS_GetComponentRegistrar_P + 36796 12 libnspr4.dylib 0x00053ce8 PR_Select + 856 13 libSystem.B.dylib 0x926ea155 _pthread_start + 321 14 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 2: 0 libSystem.B.dylib 0x926b92ce semaphore_wait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2c6 _pthread_cond_wait + 1267 2 libSystem.B.dylib 0x92730539 pthread_cond_wait + 48 3 libnspr4.dylib 0x0004e921 PR_WaitCondVar + 241 4 libmozjs.dylib 0x0022dd8f js_ValueToCharBuffer + 18463 5 libnspr4.dylib 0x00053ce8 PR_Select + 856 6 libSystem.B.dylib 0x926ea155 _pthread_start + 321 7 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 3: 0 libSystem.B.dylib 0x926b92e6 semaphore_timedwait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2af _pthread_cond_wait + 1244 2 libSystem.B.dylib 0x92735aab pthread_cond_timedwait + 47 3 libnspr4.dylib 0x0004e4f1 PR_AssertCurrentThreadOwnsLock + 177 4 libnspr4.dylib 0x0004e87f PR_WaitCondVar + 79 5 XUL 0x01001b23 DumpJSStack + 108323 6 libnspr4.dylib 0x00053ce8 PR_Select + 856 7 libSystem.B.dylib 0x926ea155 _pthread_start + 321 8 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 4: 0 libSystem.B.dylib 0x926b9286 mach_msg_trap + 10 1 libSystem.B.dylib 0x926c0a7c mach_msg + 72 2 com.unsanity.ape 0x00626c39 __ape_agent + 316 3 libSystem.B.dylib 0x926ea155 _pthread_start + 321 4 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 5: 0 libSystem.B.dylib 0x926b92e6 semaphore_timedwait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2af _pthread_cond_wait + 1244 2 libSystem.B.dylib 0x92735aab pthread_cond_timedwait + 47 3 libnspr4.dylib 0x0004e4f1 PR_AssertCurrentThreadOwnsLock + 177 4 libnspr4.dylib 0x0004e87f PR_WaitCondVar + 79 5 XUL 0x01af7047 NS_GetComponentRegistrar_P + 54135 6 XUL 0x01af2a67 NS_GetComponentRegistrar_P + 36247 7 XUL 0x01ab298a JNIEnv_::CallStaticObjectMethod(_jclass*, _jmethodID*, ...) + 272922 8 XUL 0x01af2c8c NS_GetComponentRegistrar_P + 36796 9 libnspr4.dylib 0x00053ce8 PR_Select + 856 10 libSystem.B.dylib 0x926ea155 _pthread_start + 321 11 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 6: 0 libSystem.B.dylib 0x926b92e6 semaphore_timedwait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2af _pthread_cond_wait + 1244 2 libSystem.B.dylib 0x92735aab pthread_cond_timedwait + 47 3 libnspr4.dylib 0x0004e4f1 PR_AssertCurrentThreadOwnsLock + 177 4 libnspr4.dylib 0x0004e87f PR_WaitCondVar + 79 5 libnspr4.dylib 0x000548cf PR_Sleep + 143 6 libnss3.dylib 0x002e20cc SECMOD_UpdateSlotList + 1051 7 libnss3.dylib 0x002e21a7 SECMOD_WaitForAnyTokenEvent + 156 8 XUL 0x0190d026 void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) + 7723350 9 libnspr4.dylib 0x00053ce8 PR_Select + 856 10 libSystem.B.dylib 0x926ea155 _pthread_start + 321 11 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 7: 0 libSystem.B.dylib 0x926b92ce semaphore_wait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2c6 _pthread_cond_wait + 1267 2 libSystem.B.dylib 0x92730539 pthread_cond_wait + 48 3 libnspr4.dylib 0x0004e921 PR_WaitCondVar + 241 4 XUL 0x018d04fe void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) + 7474734 5 libnspr4.dylib 0x00053ce8 PR_Select + 856 6 libSystem.B.dylib 0x926ea155 _pthread_start + 321 7 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 8: 0 libSystem.B.dylib 0x926b92ce semaphore_wait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2c6 _pthread_cond_wait + 1267 2 libSystem.B.dylib 0x92730539 pthread_cond_wait + 48 3 libnspr4.dylib 0x0004e921 PR_WaitCondVar + 241 4 XUL 0x018d11b4 void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) + 7477988 5 libnspr4.dylib 0x00053ce8 PR_Select + 856 6 libSystem.B.dylib 0x926ea155 _pthread_start + 321 7 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 9: 0 libSystem.B.dylib 0x926b92e6 semaphore_timedwait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2af _pthread_cond_wait + 1244 2 libSystem.B.dylib 0x92735aab pthread_cond_timedwait + 47 3 libnspr4.dylib 0x0004e4f1 PR_AssertCurrentThreadOwnsLock + 177 4 libnspr4.dylib 0x0004e87f PR_WaitCondVar + 79 5 libnspr4.dylib 0x0004ebf9 PR_Wait + 57 6 XUL 0x01af4a32 NS_GetComponentRegistrar_P + 44386 7 XUL 0x01af2a67 NS_GetComponentRegistrar_P + 36247 8 XUL 0x01ab298a JNIEnv_::CallStaticObjectMethod(_jclass*, _jmethodID*, ...) + 272922 9 XUL 0x01af2c8c NS_GetComponentRegistrar_P + 36796 10 libnspr4.dylib 0x00053ce8 PR_Select + 856 11 libSystem.B.dylib 0x926ea155 _pthread_start + 321 12 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 10: 0 libSystem.B.dylib 0x926b92ce semaphore_wait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2c6 _pthread_cond_wait + 1267 2 libSystem.B.dylib 0x92730539 pthread_cond_wait + 48 3 libnspr4.dylib 0x0004e921 PR_WaitCondVar + 241 4 libnspr4.dylib 0x0004ebf9 PR_Wait + 57 5 XUL 0x01af1c80 NS_GetComponentRegistrar_P + 32688 6 XUL 0x01af2a44 NS_GetComponentRegistrar_P + 36212 7 XUL 0x01ab298a JNIEnv_::CallStaticObjectMethod(_jclass*, _jmethodID*, ...) + 272922 8 XUL 0x01af2ca3 NS_GetComponentRegistrar_P + 36819 9 libnspr4.dylib 0x00053ce8 PR_Select + 856 10 libSystem.B.dylib 0x926ea155 _pthread_start + 321 11 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 11: 0 libSystem.B.dylib 0x926b92ce semaphore_wait_signal_trap + 10 1 libSystem.B.dylib 0x926eb2c6 _pthread_cond_wait + 1267 2 libSystem.B.dylib 0x92730539 pthread_cond_wait + 48 3 libnspr4.dylib 0x0004e921 PR_WaitCondVar + 241 4 libnspr4.dylib 0x0004ebf9 PR_Wait + 57 5 XUL 0x01af1c80 NS_GetComponentRegistrar_P + 32688 6 XUL 0x01af2a44 NS_GetComponentRegistrar_P + 36212 7 XUL 0x01ab298a JNIEnv_::CallStaticObjectMethod(_jclass*, _jmethodID*, ...) + 272922 8 XUL 0x01af2ca3 NS_GetComponentRegistrar_P + 36819 9 libnspr4.dylib 0x00053ce8 PR_Select + 856 10 libSystem.B.dylib 0x926ea155 _pthread_start + 321 11 libSystem.B.dylib 0x926ea012 thread_start + 34 Thread 0 crashed with X86 Thread State (32-bit): eax: 0x18d712d0 ebx: 0x90448c8f ecx: 0x916f865c edx: 0xc0000003 edi: 0x004385b0 esi: 0x00457dc0 ebp: 0xbffff208 esp: 0xbffff148 ss: 0x0000001f efl: 0x00210202 eip: 0x916e9688 cs: 0x00000017 ds: 0x0000001f es: 0x0000001f fs: 0x00000000 gs: 0x00000037 cr2: 0xc0000023 Binary Images: 0x1000 - 0x2ff7 +org.mozilla.firefox 3.6 (3.6) <db7b8fbee74e2c8537e9c3e269839db7> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/firefox-bin 0x6000 - 0x6ff8 +libxpcom.dylib ??? (???) <7794c3e150bf38c19eb8f387aa2c970b> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libxpcom.dylib 0xb000 - 0x10ff3 +libplds4.dylib ??? (???) <fa4e2c871fe6f3eb1a5ba65bff3179b0> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libplds4.dylib 0x14000 - 0x1afeb +libplc4.dylib ??? (???) <214dbe4d9dab9ea6295391198644db53> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libplc4.dylib 0x35000 - 0x5efef +libnspr4.dylib ??? (???) <1a4a36bbe1ee858745773a9a8476c0c7> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libnspr4.dylib 0x72000 - 0xdcfeb +libsqlite3.dylib ??? (???) <a66752ccfaca20b519d177582328496a> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib 0xe4000 - 0xf9fec +libsmime3.dylib ??? (???) <1a88903ec1b5eea81f78bf4282f646ea> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libsmime3.dylib 0x102000 - 0x12afe3 +libssl3.dylib ??? (???) <b9aa6ac1907c747c5a76a913240e0365> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libssl3.dylib 0x157000 - 0x296fff +libmozjs.dylib ??? (???) <7b1de76271427808a0e6acebbbe6fce4> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libmozjs.dylib 0x2ae000 - 0x368fe7 +libnss3.dylib ??? (???) <a5aad3f55d722f70f3a64248f8c467e0> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libnss3.dylib 0x37b000 - 0x388fef +libnssutil3.dylib ??? (???) <bccee0d697d90085441944ef80c1d934> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libnssutil3.dylib 0x60c000 - 0x60ffff +libbrowserdirprovider.dylib ??? (???) <5f9562c9021becf1bc5ea09e2cca3b17> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/components/libbrowserdirprovider.dylib 0x625000 - 0x637fff +com.unsanity.ape 2.5 (2.5) <05296fb55e88a72c8528a373a17f4229> /Library/Frameworks/ApplicationEnhancer.framework/Versions/A/ApplicationEnhancer 0x8c5000 - 0x8f2fe3 +libsoftokn3.dylib ??? (???) <910324a98f26809eedfc8f8f46618f06> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libsoftokn3.dylib 0x91a000 - 0x938ff5 +libnssdbm3.dylib ??? (???) <9c87c7f227505f58cac7b3148e5aa0aa> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libnssdbm3.dylib 0x9ad000 - 0xa14ff7 +libfreebl3.dylib ??? (???) <b56b94073a7de8c77dbbc783a2c183be> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libfreebl3.dylib 0xa21000 - 0xa2fffe +onepin-opensc-pkcs11.so ??? (???) <faa795959a3d016cf1fe19970aeeea64> /home/gutsche/SwissSign/FF3.6/lib/onepin-opensc-pkcs11.so 0xa3b000 - 0xa59ffd +libpkcs15init.2.dylib ??? (???) <9fa01364659f22c5891ee9339638427b> /home/gutsche/SwissSign/FF3.6/lib/libpkcs15init.2.dylib 0xa6b000 - 0xaf6ffb +libopensc.2.dylib ??? (???) <ac8de5c240113b9d326bd88fbfcdccaf> /home/gutsche/SwissSign/FF3.6/lib/libopensc.2.dylib 0xb28000 - 0xb2bffc +libltdl.3.dylib ??? (???) <7eb66768e1abe38c3799255e56cf3693> /home/gutsche/SwissSign/FF3.6/lib/libltdl.3.dylib 0xb31000 - 0xb33ffe +libscconf.2.dylib ??? (???) <bf07299ef3e70ac6c10fa6bedaa05971> /home/gutsche/SwissSign/FF3.6/lib/libscconf.2.dylib 0xb38000 - 0xc7ffe0 +PCSC ??? (???) <4b8ff6ae3b5bd219a5cbd94d35ddbe99> /home/gutsche/SwissSign/FF3.6/lib/PCSC 0xd08000 - 0xd14fff com.apple.iokit.IOHIDLib 1.5.5 (1.5.5) <b8fc922eae4ec02441920c284952b437> /System/Library/Extensions/IOHIDFamily.kext/Contents/PlugIns/IOHIDLib.plugin/Contents/MacOS/IOHIDLib 0xd22000 - 0xd2bff7 com.apple.iokit.IOUSBLib 3.4.9 (3.4.9) <ea4061ec718fddebf2cf952e8606ae87> /System/Library/Extensions/IOUSBFamily.kext/Contents/PlugIns/IOUSBLib.bundle/Contents/MacOS/IOUSBLib 0xd35000 - 0xd76ffb +libnssckbi.dylib ??? (???) <0f8cfb2a87bf71ce808d6507e82dece4> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/libnssckbi.dylib 0xfc5000 - 0x1d68fef +XUL ??? (???) <5f8846906946b6fe562d5f322f5aeabd> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/XUL 0x131c6000 - 0x131effe7 +libbrowsercomps.dylib ??? (???) <bed87c30242e8f453b584ad47a9b4850> /home/gutsche/SwissSign/FF3.6/firefox.app/Contents/MacOS/components/libbrowsercomps.dylib 0x19299000 - 0x194a0fef com.apple.RawCamera.bundle 2.1.1 (508) <2598b38224411e6865888bcc9b96acc8> /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera 0x8fe00000 - 0x8fe2db43 dyld 97.1 (???) <458eed38a009e5658a79579e7bc26603> /usr/lib/dyld 0x90003000 - 0x900f7ff4 libiconv.2.dylib ??? (???) <c508c60fafca17824c0017b2e4369802> /usr/lib/libiconv.2.dylib 0x900f8000 - 0x9012afff com.apple.LDAPFramework 1.4.5 (110) <bb7a3e5d66f00d1d1c8a40569b003ba3> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP 0x9012b000 - 0x902cbfff com.apple.JavaScriptCore 5531.21 (5531.21.9) <8b132638e4d517b8cd4613155ed82b87> /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/JavaScriptCore 0x902cc000 - 0x90393ff2 com.apple.vImage 3.0 (3.0) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage 0x90394000 - 0x903c1feb libvDSP.dylib ??? (???) <b232c018ddd040ec4e2c2af632dd497f> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib 0x903c2000 - 0x903eaff7 com.apple.shortcut 1.0.1 (1.0) <131202e7766e327d02d55c0f5fc44ad7> /System/Library/PrivateFrameworks/Shortcut.framework/Versions/A/Shortcut 0x903eb000 - 0x9040ffff libxslt.1.dylib ??? (???) <0a9778d6368ae668826f446878deb99b> /usr/lib/libxslt.1.dylib 0x90410000 - 0x90c0efef com.apple.AppKit 6.5.9 (949.54) <4df5d2e2271175452103f789b4f4d8a8> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit 0x90c1b000 - 0x90ccbfff edu.mit.Kerberos 6.0.13 (6.0.13) <804bd1b3f08fb57396781f012006367c> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos 0x90e05000 - 0x90e14fff libsasl2.2.dylib ??? (???) <bb7971ca2f609c070f87786a93d1041e> /usr/lib/libsasl2.2.dylib 0x90e18000 - 0x90e30ff7 com.apple.CoreVideo 1.6.0 (20.0) <587c9c8966070a7d50276db35e1c76aa> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo 0x90e31000 - 0x90e41ffc com.apple.LangAnalysis 1.6.5 (1.6.5) <d057feb38163121ffd871c564c692804> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis 0x90e42000 - 0x90f75fe7 com.apple.CoreFoundation 6.5.7 (476.19) <a332c8f45529ee26d2e9c36d0c723bad> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation 0x90fda000 - 0x912b4ff3 com.apple.CoreServices.CarbonCore 786.11 (786.14) <d5cceb2fe9551d345d40dd1ecf409ec2> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore 0x912b5000 - 0x912b5ffc com.apple.audio.units.AudioUnit 1.5 (1.5) /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit 0x912f1000 - 0x912f2ffc libffi.dylib ??? (???) <a3b573eb950ca583290f7b2b4c486d09> /usr/lib/libffi.dylib 0x912f3000 - 0x91380ff7 com.apple.framework.IOKit 1.5.2 (???) <7a3cc24f78f93931731203854ae0d891> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit 0x91381000 - 0x91385fff libGIF.dylib ??? (???) <e7d550bda10018f52e61bb499dcf445f> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib 0x91386000 - 0x91394ffd libz.1.dylib ??? (???) <5ddd8539ae2ebfd8e7cc1c57525385c7> /usr/lib/libz.1.dylib 0x9145f000 - 0x914b8ff7 libGLU.dylib ??? (???) <a3b9be30100a25a6cd3ad109892f52b7> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib 0x91676000 - 0x916d3ffb libstdc++.6.dylib ??? (???) <04b812dcec670daa8b7d2852ab14be60> /usr/lib/libstdc++.6.dylib 0x916d4000 - 0x917b4fff libobjc.A.dylib ??? (???) <7b92613fdf804fd9a0a3733a0674c30b> /usr/lib/libobjc.A.dylib 0x917f9000 - 0x917fcfff com.apple.help 1.1 (36) <b507b08e484cb89033e9cf23062d77de> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help 0x917fd000 - 0x91809ffe libGL.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib 0x9180b000 - 0x9188aff5 com.apple.SearchKit 1.2.2 (1.2.2) <3b5f3ab6a363a4d8a2bbbf74213ab0e5> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit 0x918f2000 - 0x91985fff com.apple.ink.framework 101.3 (86) <bf3fa8927b4b8baae92381a976fd2079> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink 0x91986000 - 0x91a6eff3 com.apple.CoreData 100.2 (186.2) <44df326fea0236718f5ed64084e82270> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData 0x91a6f000 - 0x91a73fff libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib 0x91ac0000 - 0x91acbfe7 libCSync.A.dylib ??? (???) <d88c20c9a2fd0676dec62fddfa74979f> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib 0x91aef000 - 0x91b69ff8 com.apple.print.framework.PrintCore 5.5.4 (245.6) <03d0585059c20cb0bde5e000438c49e1> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore 0x91b6a000 - 0x91bf4fe3 com.apple.DesktopServices 1.4.8 (1.4.8) <a6edef2d49ffdee3b01010b7e6edac1f> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv 0x91bf8000 - 0x91bf8ffa com.apple.CoreServices 32 (32) <2fcc8f3bd5bbfc000b476cad8e6a3dd2> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices 0x91d00000 - 0x91d24feb libssl.0.9.7.dylib ??? (???) <5b29af782be5894be8b336c9c73c18b6> /usr/lib/libssl.0.9.7.dylib 0x91d25000 - 0x91d25ff8 com.apple.ApplicationServices 34 (34) <8f910fa65f01d401ad8d04cc933cf887> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices 0x91d26000 - 0x91d2ffff com.apple.speech.recognition.framework 3.7.24 (3.7.24) <d3180f9edbd9a5e6f283d6156aa3c602> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition 0x91d63000 - 0x91d63fff com.apple.Carbon 136 (136) <98a5e3bc0c4fa44bbb09713bb88707fe> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon 0x91d64000 - 0x91d93fe3 com.apple.AE 402.3 (402.3) <b13bfda0ad9314922ee37c0d018d7de9> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE 0x91d94000 - 0x91f14fff com.apple.AddressBook.framework 4.1.2 (702) <f9360f9926ccd411fdf7550b73034d17> /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook 0x91f88000 - 0x920d0ff7 com.apple.ImageIO.framework 2.0.7 (2.0.7) <cf45179ee2de2d46a6ced2ed147a454c> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO 0x92121000 - 0x92429fe7 com.apple.HIToolbox 1.5.6 (???) <eece3cb8aa0a4e6843fcc1500aca61c5> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox 0x9242f000 - 0x9242fffd com.apple.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/vecLib.framework/Versions/A/vecLib 0x92430000 - 0x92448fff com.apple.openscripting 1.2.8 (???) <572c7452d7e740e8948a5ad07a99602b> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting 0x92449000 - 0x92449ffd com.apple.Accelerate.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib 0x9244a000 - 0x9244ffff com.apple.CommonPanels 1.2.4 (85) <ea0665f57cd267609466ed8b2b20e893> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels 0x92450000 - 0x924acff7 com.apple.htmlrendering 68 (1.1.3) <fe87a9dede38db00e6c8949942c6bd4f> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering 0x924ad000 - 0x924adffd com.apple.Accelerate 1.4.2 (Accelerate 1.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate 0x924e0000 - 0x9251efff libGLImage.dylib ??? (???) <a6425aeb77f4da13212ac75df57b056d> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib 0x9251f000 - 0x92658ff7 libicucore.A.dylib ??? (???) <f2819243b278259b9a622ea111ea5fd6> /usr/lib/libicucore.A.dylib 0x9265e000 - 0x926afff7 com.apple.HIServices 1.7.1 (???) <ba7fd0ede540a0da08db027f87efbd60> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices 0x926b0000 - 0x926b7fe9 libgcc_s.1.dylib ??? (???) <f53c808e87d1184c0f9df63aef53ce0b> /usr/lib/libgcc_s.1.dylib 0x926b8000 - 0x9281fff3 libSystem.B.dylib ??? (???) <ae47ca9b1686b065f8ac4d2de09cc432> /usr/lib/libSystem.B.dylib 0x92820000 - 0x928a7ff7 libsqlite3.0.dylib ??? (???) <3334ea5af7a911637413334154bb4100> /usr/lib/libsqlite3.0.dylib 0x928a8000 - 0x928c6ff3 com.apple.DirectoryService.Framework 3.5.7 (3.5.7) <0dc7272ee811169b47b4c682bfc666c6> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService 0x928c7000 - 0x928cdfff com.apple.print.framework.Print 218.0.3 (220.2) <5b7f4ef7c2df36aff9605377775781e4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print 0x928ce000 - 0x928ceff8 com.apple.Cocoa 6.5 (???) <e064f94d969ce25cb7de3cfb980c3249> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa 0x928cf000 - 0x928d1ff5 libRadiance.dylib ??? (???) <3561a7a6405223a1737f41352f1fd8c8> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib 0x9290f000 - 0x9291bff9 com.apple.helpdata 1.0.1 (14.2) /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/HelpData 0x92a88000 - 0x92ae2ff7 com.apple.CoreText 2.0.4 (???) <f0b6c1d4f40bd21505097f0255abfead> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText 0x92b5e000 - 0x92b6efff com.apple.speech.synthesis.framework 3.7.1 (3.7.1) <06d8fc0307314f8ffc16f206ad3dbf44> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis 0x92b6f000 - 0x92becfeb com.apple.audio.CoreAudio 3.1.2 (3.1.2) <782a08c44be4698597f4bbd79cac21c6> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio 0x92ca5000 - 0x92ce7fef com.apple.NavigationServices 3.5.2 (163) <91844980804067b07a0b6124310d3f31> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices 0x92ce8000 - 0x92ce8ffb com.apple.installserver.framework 1.0 (8) /System/Library/PrivateFrameworks/InstallServer.framework/Versions/A/InstallServer 0x92ce9000 - 0x93389feb com.apple.CoreGraphics 1.409.5 (???) <a40644ccdbdc76e3a0ab4d468b2f9bdd> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics 0x9338a000 - 0x933a8fff libresolv.9.dylib ??? (???) <a8018c42930596593ddf27f7c20fe7af> /usr/lib/libresolv.9.dylib 0x933a9000 - 0x933e0fff com.apple.SystemConfiguration 1.9.2 (1.9.2) <8b26ebf26a009a098484f1ed01ec499c> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration 0x933e1000 - 0x933f6ffb com.apple.ImageCapture 5.0.2 (5.0.2) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture 0x933f7000 - 0x938c8fbe libGLProgrammability.dylib ??? (???) <7f18294a7bd0b6afe4319f29187fc70d> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib 0x938c9000 - 0x938d0ff7 libCGATS.A.dylib ??? (???) <1339abfb67318d65c0130f76bc8c4da6> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib 0x93975000 - 0x93a2ffe3 com.apple.CoreServices.OSServices 228 (228) <bc83e97f6888673c33f86652677c09cb> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices 0x93a30000 - 0x93a4cff3 libPng.dylib ??? (???) <df60749fd50bcfa0da5b4cac899e09df> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib 0x93a65000 - 0x93af2ff7 com.apple.LaunchServices 292 (292) <a41286c7c1eb20ffd5cc796f791070f0> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices 0x93af3000 - 0x93b9afeb com.apple.QD 3.11.57 (???) <35f058678972d42b88ebdf652df79956> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD 0x93b9b000 - 0x93f59fea libLAPACK.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib 0x93f5a000 - 0x93f9bfe7 libRIP.A.dylib ??? (???) <e9c5df8bd574b71e55ac60c910b929ce> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib 0x93f9c000 - 0x9486dfff com.apple.WebCore 5531.21 (5531.21.8) <fa100d959d8655e174d84b87fe154b31> /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.framework/Versions/A/WebCore 0x9486e000 - 0x948a8fe7 com.apple.coreui 1.2 (62) /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI 0x948a9000 - 0x948abfff com.apple.securityhi 3.0 (30817) <2b2854123fed609d1820d2779e2e0963> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI 0x948e3000 - 0x948f9fff com.apple.DictionaryServices 1.0.0 (1.0.0) <ad0aa0252e3323d182e17f50defe56fc> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices 0x949dd000 - 0x94c59fe7 com.apple.Foundation 6.5.9 (677.26) <c68b3cff7864959becfc7fd1a384f925> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation 0x94c5a000 - 0x94c69ffe com.apple.DSObjCWrappers.Framework 1.3 (1.3) <09deb9e32d0d09dfb95ae569bdd2b7a4> /System/Library/PrivateFrameworks/DSObjCWrappers.framework/Versions/A/DSObjCWrappers 0x94cc3000 - 0x94d8efef com.apple.ColorSync 4.5.3 (4.5.3) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync 0x94d8f000 - 0x94ee1ff3 com.apple.audio.toolbox.AudioToolbox 1.5.3 (1.5.3) /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox 0x94ee2000 - 0x94f89fec com.apple.CFNetwork 438.14 (438.14) <5f9ee0430b5f6319f18d9b23e777e0d2> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork 0x94f8a000 - 0x94fa9ffa libJPEG.dylib ??? (???) <37050c2a8d6f7026c94b4bf07c4d8a80> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib 0x94fef000 - 0x94ffcfe7 com.apple.opengl 1.5.10 (1.5.10) <5a2813f80c9441170cc1ab8a3dac5038> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL 0x95032000 - 0x9503afff com.apple.DiskArbitration 2.2.1 (2.2.1) <75b0c8d8940a8a27816961dddcac8e0f> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration 0x9503b000 - 0x953d8fef com.apple.QuartzCore 1.5.8 (1.5.8) <a28fa54346a9f9d5b3bef076a1ee0fcf> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore 0x9556f000 - 0x95602ff3 com.apple.ApplicationServices.ATS 3.8 (???) <eda9db16110de6b7fd9436cd0daa787d> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS 0x95603000 - 0x9560affe libbsm.dylib ??? (???) <d25c63378a5029648ffd4b4669be31bf> /usr/lib/libbsm.dylib 0x9560b000 - 0x956ecff7 libxml2.2.dylib ??? (???) <b3bc0b280c36aa17ac477b4da56cd038> /usr/lib/libxml2.2.dylib 0x96686000 - 0x966affff libcups.2.dylib ??? (???) <a40b9403cc4a0dffefed110e1eab90c4> /usr/lib/libcups.2.dylib 0x966b0000 - 0x966b5fff com.apple.backup.framework 1.0 (1.0) /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup 0x9691f000 - 0x969fbfef com.apple.WebKit 5531.21 (5531.21.8) <aac476a6fa3231d4cdce9a111143e0b7> /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit 0x969fc000 - 0x96bcdff3 com.apple.security 5.0.6 (37592) <c7c68c3ba198b36d571d4b1e028a1a77> /System/Library/Frameworks/Security.framework/Versions/A/Security 0x96bce000 - 0x96c4bfef libvMisc.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib 0x96c4c000 - 0x96c8bfef libTIFF.dylib ??? (???) <cd2e392973a1fa35f23a0f37f55c579c> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib 0x96c8c000 - 0x96cb7fe7 libauto.dylib ??? (???) <42d8422dc23a18071869fdf7b5d8fab5> /usr/lib/libauto.dylib 0x96cb8000 - 0x96d6affb libcrypto.0.9.7.dylib ??? (???) <d02f7e5b8a68813bb7a77f5edb34ff9d> /usr/lib/libcrypto.0.9.7.dylib 0x96dde000 - 0x97104fe2 com.apple.QuickTime 7.6.4 (1327.73) <96515f6a2d628cd2105c7082295199b5> /System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime 0x9714c000 - 0x97156feb com.apple.audio.SoundManager 3.9.2 (3.9.2) <0f2ba6e891d3761212cf5a5e6134d683> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound 0x97157000 - 0x971a0fef com.apple.Metadata 10.5.8 (398.26) <e4d268ea45379200f03cdc7c8bedae6f> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata 0x971a1000 - 0x975b1fef libBLAS.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib 0xfffe8000 - 0xfffebfff libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib 0xffff0000 - 0xffff1780 libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib Reproducible: Always Steps to Reproduce: Unfortunately, we can only reproduce it on our specific setup (with specific hardware and PKCS#11 module). Anyway, it's usually enough to just load the PKCS#11 module and wait some time. At the latest, when entering the PIN, firefox crashes... Actual Results: Firefox crashed. Expected Results: Successful login to the chipcard
Finally having had some success in using valgrind, here's additional information. Valgrind reports several errors: The first one: ==20704== Conditional jump or move depends on uninitialised value(s) ==20704== at 0x6D28038: SECMOD_UpdateSlotList (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libnss3.dylib) ==20704== by 0x6D281A6: SECMOD_WaitForAnyTokenEvent (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libnss3.dylib) ==20704== by 0x190D025: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x61CE7: PR_Select (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libnspr4.dylib) ==20704== by 0x883154: _pthread_start (in /usr/lib/libSystem.B.dylib) ==20704== by 0x883011: thread_start (in /usr/lib/libSystem.B.dylib) The second/third (probably harmless?): ==20704== Syscall param write(buf) points to uninitialised byte(s) ==20704== at 0x88829A: write$NOCANCEL$UNIX2003 (in /usr/lib/libSystem.B.dylib) ==20704== by 0x6C3570F: sqlite3_value_type (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib) ==20704== by 0x6C5011F: sqlite3_randomness (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib) ==20704== by 0x6C501DA: sqlite3_randomness (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib) And fourth to the final crash, all of which seem to be related: ==20704== Invalid read of size 4 ==20704== at 0x3FC1684: objc_msgSend (in /usr/lib/libobjc.A.dylib) ==20704== by 0x1A1DF99: JSD_GetValueForObject (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x18A6A46: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0xFD013A: XRE_main (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x2CB7: (below main) (in ./firefox-bin) ==20704== Address 0x179592f0 is not stack'd, malloc'd or (recently) free'd ==20704== ==20704== Invalid read of size 4 ==20704== at 0x3FC16B0: objc_msgSend (in /usr/lib/libobjc.A.dylib) ==20704== by 0x1A1DF99: JSD_GetValueForObject (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x18A6A46: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0xFD013A: XRE_main (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x2CB7: (below main) (in ./firefox-bin) ==20704== Address 0x179592f0 is not stack'd, malloc'd or (recently) free'd ==20704== ==20704== Invalid read of size 4 ==20704== at 0x3FB0496: object_getClassName (in /usr/lib/libobjc.A.dylib) ==20704== by 0x3FB1BC1: _objc_error (in /usr/lib/libobjc.A.dylib) ==20704== by 0x3FB1C2F: __objc_error (in /usr/lib/libobjc.A.dylib) ==20704== by 0x3FB0636: _freedHandler (in /usr/lib/libobjc.A.dylib) ==20704== by 0x1FC3025: -[NSApplication run] (in /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit) ==20704== by 0x1A1DF99: JSD_GetValueForObject (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x18A6A46: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0xFD013A: XRE_main (in /Users/kobil/SwissSign_FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x2CB7: (below main) (in ./firefox-bin) ==20704== Address 0x179592f0 is not stack'd, malloc'd or (recently) free'd ==20704== vex x86->IR: unhandled instruction bytes: 0xF 0xB 0x55 0x89 ==20704== valgrind: Unrecognised instruction at address 0x3fb1bfa.
Finally having had some success in using valgrind, here's additional information. Valgrind reports several errors: The first one: ==20704== Conditional jump or move depends on uninitialised value(s) ==20704== at 0x6D28038: SECMOD_UpdateSlotList (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libnss3.dylib) ==20704== by 0x6D281A6: SECMOD_WaitForAnyTokenEvent (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libnss3.dylib) ==20704== by 0x190D025: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x61CE7: PR_Select (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libnspr4.dylib) ==20704== by 0x883154: _pthread_start (in /usr/lib/libSystem.B.dylib) ==20704== by 0x883011: thread_start (in /usr/lib/libSystem.B.dylib) The second/third (probably harmless?): ==20704== Syscall param write(buf) points to uninitialised byte(s) ==20704== at 0x88829A: write$NOCANCEL$UNIX2003 (in /usr/lib/libSystem.B.dylib) ==20704== by 0x6C3570F: sqlite3_value_type (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib) ==20704== by 0x6C5011F: sqlite3_randomness (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib) ==20704== by 0x6C501DA: sqlite3_randomness (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/libsqlite3.dylib) And fourth to the final crash, all of which seem to be related: ==20704== Invalid read of size 4 ==20704== at 0x3FC1684: objc_msgSend (in /usr/lib/libobjc.A.dylib) ==20704== by 0x1A1DF99: JSD_GetValueForObject (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x18A6A46: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0xFD013A: XRE_main (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x2CB7: (below main) (in ./firefox-bin) ==20704== Address 0x179592f0 is not stack'd, malloc'd or (recently) free'd ==20704== ==20704== Invalid read of size 4 ==20704== at 0x3FC16B0: objc_msgSend (in /usr/lib/libobjc.A.dylib) ==20704== by 0x1A1DF99: JSD_GetValueForObject (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x18A6A46: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0xFD013A: XRE_main (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x2CB7: (below main) (in ./firefox-bin) ==20704== Address 0x179592f0 is not stack'd, malloc'd or (recently) free'd ==20704== ==20704== Invalid read of size 4 ==20704== at 0x3FB0496: object_getClassName (in /usr/lib/libobjc.A.dylib) ==20704== by 0x3FB1BC1: _objc_error (in /usr/lib/libobjc.A.dylib) ==20704== by 0x3FB1C2F: __objc_error (in /usr/lib/libobjc.A.dylib) ==20704== by 0x3FB0636: _freedHandler (in /usr/lib/libobjc.A.dylib) ==20704== by 0x1FC3025: -[NSApplication run] (in /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit) ==20704== by 0x1A1DF99: JSD_GetValueForObject (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x18A6A46: void std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)>(__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, int, int, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)) (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0xFD013A: XRE_main (in /Users/FF3.6_bug/FF3.6/firefox.app/Contents/MacOS/XUL) ==20704== by 0x2CB7: (below main) (in ./firefox-bin) ==20704== Address 0x179592f0 is not stack'd, malloc'd or (recently) free'd ==20704== vex x86->IR: unhandled instruction bytes: 0xF 0xB 0x55 0x89 ==20704== valgrind: Unrecognised instruction at address 0x3fb1bfa.
Sorry for the duplicated comment... :-(
Summary: spontanuous crash some seconds to minutes after loading a PKCS#11 module → Bug in JSD_GetValueForObject (MacOS X)? was: spontanuous crash some seconds to minutes after loading a PKCS#11 module
reporter: you need to grab shark enabled builds: http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/firefox-3.7a2pre.en-US.mac-shark.dmg otherwise you're just randomly pointing at libraries.
Summary: Bug in JSD_GetValueForObject (MacOS X)? was: spontanuous crash some seconds to minutes after loading a PKCS#11 module → problem somewhere (MacOS X)? was: spontanuous crash some seconds to minutes after loading a PKCS#11 module
I'm just trying that. It is still crashing, so should I use the crash report thing and add a reference to this bug here in the comment field? Also, could you elaborate a bit on what "shark enabled" really means and why it's needed? So far, I always found the regular "crash dumps" quite helpful, so I'm a bit surprised why they should contain "random nonsense" in the case of firefox... So far, I only found http://developer.apple.com/tools/sharkoptimize.html which doesn't help me much to understand what "shark enabled builds" are about.
if you use the build i linked to, then the apple crash report saved to a file and attached to this bug will be fine. our symbols are huge, and as 99.99999% of our customers have no use for them, we strip them to save the download time for them (and to save bandwidth and disk space for us). it's not that you're going to be using 'shark', it's that the builds we have which support shark aren't stripped and are such useful for analyzing your problem using the tool you were already using.
Sorry to ask still another stupid question: Using the build you linked to, I get a crash report form that seems to be mozilla specific. How do I get to the apple crash report?
if you're running in valgrind, it won't matter.... https://developer.mozilla.org/en/Environment_variables_affecting_crash_reporting
Attached file Apple crash report —
I see. I attached the crash log, but I suppose this fragment from valgrind's output is more helpful - it seems to show that some object that has been already relases by its AutoreleasePool is accessed again... ==1046== Invalid read of size 4 ==1046== at 0x61F3684: objc_msgSend (in /usr/lib/libobjc.A.dylib) ==1046== by 0x2CDA269: nsAppShell::Run() (in /Users/FF3.6_bug/FF3.7/Minefield.app/Contents/MacOS/XUL) ==1046== by 0x2B51AC6: nsAppStartup::Run() (in /Users/FF3.6_bug/FF3.7/Minefield.app/Contents/MacOS/XUL) ==1046== by 0x21589D8: XRE_main (in /Users/FF3.6_bug/FF3.7/Minefield.app/Contents/MacOS/XUL) ==1046== by 0x2387: main (in ./firefox-bin) ==1046== Address 0x1cd73f50 is 0 bytes inside a block of size 20 free'd ==1046== at 0x137AF: free (vg_replace_malloc.c:325) ==1046== by 0x61E36B2: _internal_object_dispose (in /usr/lib/libobjc.A.dylib) ==1046== by 0x4FE57BF: NSDeallocateObject (in /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation) ==1046== by 0x4FE14F0: NSPopAutoreleasePool (in /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation) ==1046== by 0x1AB5C185: PoolCleaner (in /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit) ==1046== by 0x545359B: IdleTimerVector (in /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox) ==1046== by 0x63A38F4: CFRunLoopRunSpecific (in /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation) ==1046== by 0x63A3AA7: CFRunLoopRunInMode (in /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation) ==1046== by 0x53E52AB: RunCurrentEventLoopInMode (in /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox) ==1046== by 0x53E4FFD: ReceiveNextEventCommon (in /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox) ==1046== by 0x53E4F38: BlockUntilNextEventMatchingListInMode (in /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox) ==1046== by 0x42DC6D4: _DPSNextEvent (in /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit) ==1046== by 0x42DBF87: -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (in /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit) ==1046== by 0x42D4F9E: -[NSApplication run] (in /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit) ==1046== by 0x2CDA269: nsAppShell::Run() (in /Users/FF3.6_bug/FF3.7/Minefield.app/Contents/MacOS/XUL) ==1046== by 0x2B51AC6: nsAppStartup::Run() (in /Users/FF3.6_bug/FF3.7/Minefield.app/Contents/MacOS/XUL) ==1046== by 0x21589D8: XRE_main (in /Users/FF3.6_bug/FF3.7/Minefield.app/Contents/MacOS/XUL) ==1046== by 0x2387: main (in ./firefox-bin)
Attachment #429728 - Attachment mime type: text/x-log → text/plain
Component: General → Widget: Cocoa
Keywords: crash
Product: Firefox → Core
QA Contact: general → cocoa
Summary: problem somewhere (MacOS X)? was: spontanuous crash some seconds to minutes after loading a PKCS#11 module → crash [@ objc_msgSend] using object freed by [WebKit]IdleTimerVector/PoolCleaner after loading a PKCS#11 module
Version: unspecified → Trunk
Stefan, if you're going to provide more than a few lines of debugging information, please do so as attachments rather than pasting as comments (see "Add an attachment" in https://developer.mozilla.org/en/Bug_writing_guidelines ). Presumably this is more fallout from bug 509130? Steven, it looks like you never linked to a tryserver build with the second patch on bug 533001, so we can't point reporters of bugs like this to that build for testing.
> Presumably this is more fallout from bug 509130? I think this is unlikely. The only way it could happen is if some other Cocoa program launched/spawned Firefox. > Steven, it looks like you never linked to a tryserver build with the > second patch on bug 533001, so we can't point reporters of bugs like > this to that build for testing. It seems I forgot to post it. But even if I had, it would by now have been deleted from the tryserver build archives. I'll start another build and comment here when it's done.
The valgrind log fragment from comment #10 is very strange. In fact, on the face of it, it looks impossible: A Firefox process appears to be spawning another Firefox process, and this without using fork() or the like!!
Where do you see this? Maybe you just did miss the line saying "Address 0x1cd73f50 is 0 bytes inside a block of size 20 free'd"? I.e. that fragment ist saying "Invalid read at <backtrace> for memory block freed at <backtrace>" and both backtraces seem OK to me.
I don't have much experience reading valgrind traces, so I'll take your word for it that I've misread the traces from comment #10. (For example I thought it was one trace, but it appears that it's two separate traces.) But I'd still be very surprised if my patch for bug 509130 could have triggered IdleTimerVector() crashes without either of the following being true: 1) Gecko is being run from a Cocoa embedder (like Camino) or 2) Firefox is being spawned from some other Cocoa app. Is #2 true? Are you spawning Firefox from some other Cocoa app? Once my tryserver build (of the patch for bug 533001) is ready, you can test with that. But that won't be for several hours.
Also, how do you load your PKCS#11 module? Is it a plugin? An extension?
> Is #2 true? Are you spawning Firefox from some other Cocoa app? Is valgrind a Cocoa app? :-)
>> Is #2 true? Are you spawning Firefox from some other Cocoa app? > > Is valgrind a Cocoa app? :-) From a quick look through the valgrind source, it appears the answer is "no".
Yes, that valgrind output was two separate traces; it's a command line utility (so I think the answer to whether it's a Cocoa app is "no" in that sense, but I have no idea what kind of APIs it might use internally). Anyway, the same crash (see the attached crash report) seems to occur when starting it without valgrind, i.e. when I'm just starting it from the "regular" shell window via "DYLD_LIBRARY_PATH=<path_to_the_PKCS#11_module_and_related_libs> <Path-to>/firefox -profile <profile directory for testing>". About the PKCS#11 module: it's OpenSC's "onepin-opensc-pkcs11.so", which however loads a driver for a chipcard reader which is directly talking to the USB port, i.e. it's not using pcsclite. When you load that module (via the usual "Load security module" interface) for the first time, it's actually working, it's just crashing, once it's stored in the profile that this module should be loaded - sorry for not mentioning that earlier. I don't really know about the technical differences between plugin/extension/whatever, so I just hope I gave enough details to enable you to answer your last question yourself. ;-) I'll try the "tryserver build" tommorow...
> once it's stored in the profile that this module should be loaded What does this mean? Do you mean the Firefox profile? If so, what do you put in the Firefox profile to load the PKCS#11 module?
Maybe :kaie can provide some additional details about how NSS and PSM handle loading of PKCS#11 modules and how that might relate to the crashing in this bug.
IIRC, the information which security modules are to be loaded is stored in a seaprate file named "secmod.db", so what I meant to say is that once the information about the module is stored in secmod.db, I get those crashes, while things work if I start with the standard secmod.db. Anyway, the tryserver build seems to work fine, one thing I noticed when running under valgrind is that memory seems to be allocated via "new[]" in gfxTextRun::AllocateStorage(void const*&, unsigned int, unsigned int), but freed via "free" in gfxTextRun::~gfxTextRun(). AFAIK, that's bad at least in theory. Anyway, that build is working for me...
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/src/gfxFont.cpp?mark=2300,2374#2300 afaict it's a matched pair. If it isn't, please file a bug w/ stacks.
Thanks for the information, Stefan Neis. I don't yet know how it's happening, but it's pretty clear that this bug's crashes are triggered by my patch for bug 509130 (from the traces in comment #10, and the fact that my patch for bug 533001 makes the crashes go away).
Assignee: nobody → smichaud
Status: UNCONFIRMED → ASSIGNED
Depends on: 533001
Ever confirmed: true
So what does this mean in practicem in view of your comments to bug 533001? [ But I hope that (if no unfixable problems are discovered) we can get it into FF 3.6.1. ] The bug is probably going to be fixed in the next release? Or is it already too late for this and I should rather hope for the one after that?
there won't be a 3.6.1 ;-), and 3.6.2 is freezing today iiuc
(In reply to comment #24) > Anyway, the tryserver build seems to work fine, one thing I noticed when > running under valgrind is that memory seems to be allocated via "new[]" in > gfxTextRun::AllocateStorage(void const*&, unsigned int, unsigned int), but > freed via "free" in gfxTextRun::~gfxTextRun(). AFAIK, that's bad at least in > theory. (In reply to comment #25) > http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/src/gfxFont.cpp?mark=2300,2374#2300 > afaict it's a matched pair. If it isn't, please file a bug w/ stacks. FYI, Jesse filed bug 551279 that appears to cover this valgrind complaint.
This should be fixed by my patch for bug 533001, which landed on the trunk on 2010-04-05 and which just landed on the 1.9.2 branch (and so will appear in FF 3.6.5).
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
status1.9.2: --- → .5-fixed
Resolution: --- → FIXED
Crash Signature: [@ objc_msgSend]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: