601854 - Firefox crashes upon "one click" downloads, before opening the "save as" popup, or after the download completed upon right-click "save as" downloads of compressed files

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[hinoglu]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.55 Safari/534.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.11) Gecko/20101001 Firefox/3.6.11

Downloading compressed files causes crashes. Other types of files don't have any unexpected results. When left-clicking on the download link, firefox immediately crashes. When right-click->save as-> wait fow download finishes, firefox crashes.
 

Reproducible: Always

Steps to Reproduce:
1. left click on download link of any compressed file

or 

1. right click on file link
2. click enter on "save as" dialog 
3. wait until download finishes download 
Actual Results:  
on left click on download link, firefox crashes when download begins.
on right-click save as steps, firefox crashes after download ends.

Expected Results:  
on left click downloads, download dialog should have opened.
on right-click downloads download should have finished successfully and dialog should have closed.

gdb output:

(gdb) continue
Continuing.
[Thread 0x442d7b70 (LWP 32441) exited]
[New Thread 0x442d7b70 (LWP 32456)]
[New Thread 0x46f00b70 (LWP 32459)]
[Thread 0x46f00b70 (LWP 32459) exited]
[New Thread 0x46f00b70 (LWP 32460)]
[New Thread 0x47101b70 (LWP 32461)]
[Thread 0x47101b70 (LWP 32461) exited]
[New Thread 0x47101b70 (LWP 32462)]
[Thread 0x47101b70 (LWP 32462) exited]
[New Thread 0x47101b70 (LWP 32463)]
[Thread 0x47101b70 (LWP 32463) exited]
[New Thread 0x47101b70 (LWP 32464)]
[Thread 0x47101b70 (LWP 32464) exited]

Program received signal SIGSEGV, Segmentation fault.
0x41a7de0d in strncmp () from /lib/libc.so.6
(gdb) bt
#0  0x41a7de0d in strncmp () from /lib/libc.so.6
#1  0x425a9977 in __xmlParserInputBufferCreateFilename (URI=0x47a16e80 "/usr/local/share/mime/application/x-gzip.xml", enc=XML_CHAR_ENCODING_UTF8) at xmlIO.c:2412
#2  0x425a9a12 in xmlParserInputBufferCreateFilename__internal_alias (URI=0x47a16e80 "/usr/local/share/mime/application/x-gzip.xml", enc=XML_CHAR_ENCODING_NONE) at xmlIO.c:2446
#3  0x42630952 in xmlNewTextReaderFilename__internal_alias (URI=0x47a16e80 "/usr/local/share/mime/application/x-gzip.xml") at xmlreader.c:2125
#4  0x426f6c83 in load_mime_entry (mime_type=<value optimized out>) at gnome-vfs-mime-info.c:404
#5  get_entry (mime_type=<value optimized out>) at gnome-vfs-mime-info.c:492
#6  0x426f7275 in gnome_vfs_mime_get_value (mime_type=0x479aa588 "application/x-gzip", key=0x42721112 "icon_filename") at gnome-vfs-mime-info.c:545
#7  0x426f62e7 in gnome_vfs_mime_get_icon (mime_type=0x479aa588 "application/x-gzip") at gnome-vfs-mime-handlers.c:208
#8  0x421d5316 in gnome_icon_lookup () from /opt/gnome2/lib/libgnomeui-2.so.0
#9  0x421375a5 in ?? () from /opt/Mozilla/FireFox35b4/components/libimgicon.so
#10 0x42137a71 in ?? () from /opt/Mozilla/FireFox35b4/components/libimgicon.so
#11 0x42136795 in ?? () from /opt/Mozilla/FireFox35b4/components/libimgicon.so
#12 0x402de9ae in ?? () from /opt/Mozilla/FireFox/libxul.so
#13 0x402d1c39 in ?? () from /opt/Mozilla/FireFox/libxul.so
#14 0x403c64dc in ?? () from /opt/Mozilla/FireFox/libxul.so
#15 0x403c8dcc in ?? () from /opt/Mozilla/FireFox/libxul.so
#16 0x4053f166 in ?? () from /opt/Mozilla/FireFox/libxul.so
#17 0x40517cf9 in ?? () from /opt/Mozilla/FireFox/libxul.so
#18 0x40517fe7 in ?? () from /opt/Mozilla/FireFox/libxul.so
#19 0x403dcb12 in ?? () from /opt/Mozilla/FireFox/libxul.so
#20 0x40417b5b in ?? () from /opt/Mozilla/FireFox/libxul.so
#21 0x4057eda4 in ?? () from /opt/Mozilla/FireFox/libxul.so
#22 0x405765a0 in ?? () from /opt/Mozilla/FireFox/libxul.so
#23 0x4057675d in ?? () from /opt/Mozilla/FireFox/libxul.so
#24 0x40572f68 in ?? () from /opt/Mozilla/FireFox/libxul.so
#25 0x407d8bf6 in ?? () from /opt/Mozilla/FireFox/libxul.so
#26 0x402acad8 in ?? () from /opt/Mozilla/FireFox/libxul.so
#27 0x40fdfd69 in ?? () from /opt/Mozilla/FireFox/libmozjs.so
#28 0x40fe5b1f in js_Invoke () from /opt/Mozilla/FireFox/libmozjs.so
#29 0x40fe60d6 in ?? () from /opt/Mozilla/FireFox/libmozjs.so
#30 0x40f9c8a0 in JS_CallFunctionValue () from /opt/Mozilla/FireFox/libmozjs.so

seems that xml parser fails somehow. below is my /usr/local/share/mime/application/x-gzip.xml file for inspection:

<?xml version="1.0" encoding="utf-8"?>
<mime-type xmlns="http://www.freedesktop.org/standards/shared-mime-info" type="application/x-gzip">
  <!--Created automatically by update-mime-database. DO NOT EDIT!-->
  <comment>gzip archive</comment>
  <comment xml:lang="de">gzip-Archiv</comment>
  <comment xml:lang="fi">gzip-arkisto</comment>
  <comment xml:lang="no">gzip-arkiv</comment>
  <comment xml:lang="sv">gzip-arkiv</comment>
</mime-type>

latest 2 crash-stats: 
http://crash-stats.mozilla.com/report/index/bp-5dfe77ae-5f68-4153-848f-857ba2101004
http://crash-stats.mozilla.com/report/index/bp-e915e578-9dd1-49fa-8d02-b815b2101004

even on -safe-mode crash occurs, with no difference in reproducing steps.
I'm having this problem since many versions back in 3.6 branch.

Comment 1

[Daniel Mota Leite]

i think i have this bug too, firefox 4.0b8pree on a slackware64-current, but for me it crashs with other files, like pdf and jpeg

Program received signal SIGSEGV, Segmentation fault.
gzdirect (file=0xffffffffdd7caa60) at gzread.c:614
(gdb) bt full
#0  gzdirect (file=0xffffffffdd7caa60) at gzread.c:614
        state = 0xffffffffdd7caa60
#1  0x00007fffe85ec9bd in __xmlParserInputBufferCreateFilename (URI=0x7fffdd814540 "/usr/share/mime/application/x-gzip.xml", enc=XML_CHAR_ENCODING_NONE) at xmlIO.c:2522
        ret = 0x7fffdd814580
        i = <value optimized out>
        context = 0xffffffffdd7caa60
#2  0x00007fffe866dda5 in xmlNewTextReaderFilename__internal_alias (URI=0x7fffdd814540 "/usr/share/mime/application/x-gzip.xml") at xmlreader.c:2152
        input = <value optimized out>
        ret = <value optimized out>
        directory = 0x0
#3  0x00007fffe8b13606 in ?? () from /usr/lib64/libgnomevfs-2.so.0
No symbol table info available.
#4  0x00007fffe8b13bbd in gnome_vfs_mime_get_value () from /usr/lib64/libgnomevfs-2.so.0
No symbol table info available.
#5  0x00007fffe91f8dbc in ?? () from /home/higuita/apps/firefox/components/libmozgnome.so
No symbol table info available.
#6  0x00007ffff6ab1b79 in ?? () from /home/higuita/apps/firefox/libxul.so


Downgrading zlib and libxml2 to the last stable
slackware release the problem disappears  (libxml2 2.7.6 and  zlib 1.2.3).
Keeping zlib 1.2.3 and recompiling libxml2 2.7.7 the problem is also 
fixed.
using zlib 1.2.5 and compiling the latest libxml2 2.7.8 it still crashs

i already contacted the libxml2 abd zlib devs and they still cant point why it crashs, but  Mark Adler (zlib) notice this:

"On Nov 5, 2010, at 2:05 AM, higuita wrote:
> #0  gzdirect (file=0xffffffffdd7caa60) at gzread.c:614  

the pointer high four bytes are all 0xff.  Also the high bit of low four bytes is 1.  So my theory is that there is an error in compiling and linking the application and libraries where a 64-bit pointer is getting truncated to 32 bits somewhere along the way, and then being sign-extended back to 64 bits."


hinoglu: what distro are you using and versions of zlib and libxml2? 32bit or 64bit system? gcc and glibc version?

thanks
higuita

Comment 2

[hinoglu]

libxml2 - 2.6.32
gcc 4.3.2
glibc 2.11.2
libz 1.2.5
32bit system

it's not a specific distro, was a suse once but i keep it updated by compile-installing new versions of packages. i've been having this crashing problem since long before i've updated to gcc 4.3.2 & glibc 2.11.2. libxml2 was there before the crashes started. 

i'm not sure how and when it crashes anymore, it sometimes crashes upon starting to download, sometimes crashes after download. rarely downloads successfuly, mostly crashes regardless of filetype. sigh.

i'm throwing a guess about the "content-type" or other related headers received from remote server, but could not find time to try it yet.

Comment 3

[Daniel Mota Leite]

If you have zlib 1.2.5, you need libxml2 2.7.7 or higher

libxml2 used wrongly internal zlib calls that changed in zlib 1.2.5... so libxml2 2.7.7 is the lowest one you can use with that zlib version.

upgrade that and maybe your problem is solved

Comment 4

[hinoglu]

Daniel, thank you the heads-up. 

I've upgraded libxml2 to 2.7.7 and everything seems to work fine.

Comment 5

[Daniel Mota Leite]

for me, the problem is solved with a patch in zlib and a recompile for the libxml2.

more info in this post:

http://www.mail-archive.com/[e-mail]/msg07895.html

this will probably be applied uptream and in more distros.

this bug can be close, both reporters have the problem fixed ( i cant close it)

Comment 6

[Daniel Mota Leite]

this bug can be probably closed, as we both have the problem solved

Comment 7

[hinoglu]

for both having problems due to environment packages such as zlib and libxml, i guess resolved-invalid might be appropriate status for this bug report.