577658 - Crash when visiting page, even with all plugins disabled and Javascript disabled (X_CreatePixmap: BadAlloc)

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[jackkee11]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.4) Gecko/20100622 Fedora/3.6.4-1.fc13 Firefox/3.6.4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.4) Gecko/20100622 Fedora/3.6.4-1.fc13 Firefox/3.6.4

Crash when visiting page, even with all plugins disabled and Javascript disabled.

Reproducible: Always

Steps to Reproduce:
1. Visit http://dining.mit.edu/venues-menus/steam
Actual Results:  
Browser crashed.

Expected Results:  
Page should be viewable, if plugins are disabled.

Comment 1

[jackkee11]

Crash also reproducible in Seamonkey. Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.10) Gecko/20100623 Fedora/2.0.5-1.fc13 SeaMonkey/2.0.5

Comment 2

[Martijn Wargers (dead)]

Do you have crash reports available? Type about:crashes in the url bar to view the sent crash reports.

Comment 3

[Boris Zbarsky [:bzbarsky]]

For what it's worth, this worksforme on Mac...

Comment 4

[jackkee11]

Martin,

I'm sorry, typing about:crashes on Firefox on Fedora says it is not a valid URL.

If this helps, when repeating the action in Firefox while looking at the processes monitor, Firefox was using more and more memory until it was killed by the system OOM killer. My computer has 1 gigabyte of RAM and plenty of swap space.

Thank you.

Comment 5

[Martijn Wargers (dead)]

Weird, about:crashes should exist. Is this some kind of custom Fedora build or something?

Comment 6

[Daniel Veditz [:dveditz]]

Yeah, see the user-agent :-(  "Fedora/3.6.4-1.fc13 Firefox/3.6.4"

Most of the Linux distros disable the crash reporter because their builds aren't going to match up with the symbols from our builds anyway. Which I guess is good that we don't get junk reports we can't use, but means we're fairly blind to a lot of Linux-only problems.

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Since Fedora disabled the crash reporter, the way to get a stack trace on Fedora is quite a bit more complicated, but it's still possible:
 1) enable the debuginfo repositories corresponding to all enabled regular repositories in /etc/yum.repos.d/*
 2) install *-debuginfo RPMs for relevant packages (start with firefox-debuginfo)
 3) Run firefox, and then attach gdb to the running firefox:
     $ gdb /path/to/firefox-bin
     (gdb) attach <process-id>
 4) cause firefox to crash
 5) get a stack trace:
     (gdb) bt
 6) if parts of that stack trace contains just the name of a library and offset within it, instead of filename and line number, install the *-debuginfo RPM corresponding to the RPM containing the library mentioned, and return to step (3) [repeat until step (5) gives a good stack trace]

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

However, probably a better approach would be to download a build from https://www.mozilla.com/ and get that build to crash.  If it does crash, you can send a crash report and find it in about:crashes.  If it doesn't crash, then you should report this bug to Fedora instead of to us.

Comment 9

[jackkee11]

Hello

I've followed and downloaded the default build from mozilla.com for Linux. It crashed as well. These are the crash details from the crash reporter.

Add-ons: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.6
BuildID: 20100625222733
CrashTime: 1279022482
EMCheckCompatibility: true
FramePoisonBase: 00000000f0dea000
FramePoisonSize: 4096
InstallTime: 1279022469
Notes: X_CreatePixmap: BadAlloc (insufficient resources for operation); 840 requests ago
ProductName: Firefox
ReleaseChannel: release
StartupTime: 1279022470
Theme: classic/1.0
Throttleable: 1
URL: http://dining.mit.edu/venues-menus/steam
Vendor: Mozilla
Version: 3.6.6

The following messages were also emitted to the console window.

###!!! ABORT: X_CreatePixmap: BadAlloc (insufficient resources for operation); 840 requests ago: file /builds/slave/linux_build/build/toolkit/xre/nsX11ErrorHandler.cpp, line 182
UNKNOWN [./libxul.so +0x001FF0AA]
UNKNOWN [/usr/lib/libbonoboui-2.so.0 +0x00020A34]
_XError+0x00000111 [/usr/lib/libX11.so.6 +0x0003C121]
UNKNOWN [/usr/lib/libX11.so.6 +0x00042957]
_XReply+0x00000106 [/usr/lib/libX11.so.6 +0x00043016]
XQueryPointer+0x0000006E [/usr/lib/libX11.so.6 +0x0003047E]
UNKNOWN [/usr/lib/libgdk-x11-2.0.so.0 +0x0006EA85]
UNKNOWN [/usr/lib/libgdk-x11-2.0.so.0 +0x0001719D]
gdk_display_get_window_at_pointer+0x0000008F [/usr/lib/libgdk-x11-2.0.so.0 +0x00017A2F]
UNKNOWN [./libxul.so +0x00A02EA1]
UNKNOWN [/usr/lib/libgtk-x11-2.0.so.0 +0x0014D9A8]
g_closure_invoke+0x000001B3 [/lib/libgobject-2.0.so.0 +0x000096E3]
UNKNOWN [/lib/libgobject-2.0.so.0 +0x0001E255]
g_signal_emit_valist+0x000005D5 [/lib/libgobject-2.0.so.0 +0x0001F4D5]
g_signal_emit+0x00000027 [/lib/libgobject-2.0.so.0 +0x0001FAF7]
UNKNOWN [/usr/lib/libgtk-x11-2.0.so.0 +0x00296B36]
gtk_main_do_event+0x0000061D [/usr/lib/libgtk-x11-2.0.so.0 +0x001462BD]
UNKNOWN [/usr/lib/libgdk-x11-2.0.so.0 +0x0005A2AB]
g_main_context_dispatch+0x000001D5 [/lib/libglib-2.0.so.0 +0x00039525]
UNKNOWN [/lib/libglib-2.0.so.0 +0x0003D268]
g_main_context_iteration+0x00000069 [/lib/libglib-2.0.so.0 +0x0003D449]
UNKNOWN [./libxul.so +0x00A03D9C]
UNKNOWN [./libxul.so +0x00A182E4]
UNKNOWN [./libxul.so +0x00A186FD]
UNKNOWN [./libxul.so +0x00B8CB04]
UNKNOWN [./libxul.so +0x00B5AEE5]
UNKNOWN [./libxul.so +0x00ABEA80]
_ZN11MessageLoop11RunInternalEv+0x00000028 [./libxul.so +0x00B22042]
_ZN11MessageLoop10RunHandlerEv+0x0000001A [./libxul.so +0x00B22066]
_ZN11MessageLoop3RunEv+0x00000029 [./libxul.so +0x00B220DD]
UNKNOWN [./libxul.so +0x00A1842E]
UNKNOWN [./libxul.so +0x008DCC22]
XRE_main+0x00002614 [./libxul.so +0x001F8C80]
UNKNOWN [./firefox-bin +0x000015AA]
__libc_start_main+0x000000E6 [/lib/libc.so.6 +0x00016CC6]

I hope this will be of some help. Thank you.

Comment 10

[Boris Zbarsky [:bzbarsky]]

What's the crash incident id listed in about:crashes for that crash?

Comment 11

[Jesse Ruderman]

BadAlloc crashes are generally not exploitable, so this crash bug doesn't need to be hidden.

Comment 12

[Al Billings [:abillings - ex-MoCo]]

This does not seem to reproduce on http://dining.mit.edu/venues-menus/steam with Ubuntu 11.10 32-bit and Firefox 10.0.1. Either the site has changed or the work of the last year and a half has resolved this issue.