622294 - DRI2DestroyDrawable: BadDrawable crash from jQuery with WebGL enabled on any support.mozilla.com pages [@ linux-gate.so@0x422 ]

Status: RESOLVED WORKSFORME

(Core :: Graphics: CanvasWebGL, defect)

Description

[Dave Garrett]

Instant crash going to SUMO. 100% reproducible in a new profile using latest Minefield on Linux.

bp-939c5d2b-7f30-42ff-9326-3379b2101231
0 	linux-gate.so 	linux-gate.so@0x422 	
1 	libc-2.11.1.so 	libc-2.11.1.so@0x2da81 	
2 	libmozalloc.so 	mozalloc_abort 	mozalloc_abort.cpp:75
3 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:379
4 	libxul.so 	X11Error 	nsX11ErrorHandler.cpp:190
5 	libX11.so.6.3.0 	libX11.so.6.3.0@0x3b298 	
6 	libX11.so.6.3.0 	libX11.so.6.3.0@0x4192e 	
7 	libX11.so.6.3.0 	libX11.so.6.3.0@0x42355 	
8 	libX11.so.6.3.0 	libX11.so.6.3.0@0x2aa67 	
9 	libgdk-x11-2.0.so.0.2000.1 	libgdk-x11-2.0.so.0.2000.1@0x53977 	
10 	libglib-2.0.so.0.2400.1 	libglib-2.0.so.0.2400.1@0x3eac9 	
11 	libglib-2.0.so.0.2400.1 	libglib-2.0.so.0.2400.1@0x3eee8 	
12 	libglib-2.0.so.0.2400.1 	libglib-2.0.so.0.2400.1@0x3f4b7 	
13 	libxul.so 	nsAppShell::ProcessNextNativeEvent 	nsAppShell.cpp:144
14 	libxul.so 	nsBaseAppShell::DoProcessNextNativeEvent 	nsBaseAppShell.cpp:173
15 	libxul.so 	nsBaseAppShell::OnProcessNextEvent 	nsBaseAppShell.cpp:315
16 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:590
17 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
18 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:110
19 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:219
20 	libxul.so 	MessageLoop::Run 	message_loop.cc:202
21 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:192
22 	libxul.so 	nsAppStartup::Run 	nsAppStartup.cpp:191
23 		@0x227af2f 	
24 	libxul.so 	XRE_main 	nsAppRunner.cpp:3694
25 	firefox-bin 	main 	nsBrowserApp.cpp:158
26 	libc-2.11.1.so 	libc-2.11.1.so@0x16bd5 	
27 	firefox-bin 	firefox-bin@0x1390 	
28 	firefox-bin 	Output 	nsBrowserApp.cpp:77
29 		@0x2

Shell output is:
###!!! ABORT: DRI2DestroyDrawable: BadDrawable (invalid Pixmap or Window parameter); 2 requests ago: file ../../../toolkit/xre/nsX11ErrorHandler.cpp, line 190
###!!! ABORT: DRI2DestroyDrawable: BadDrawable (invalid Pixmap or Window parameter); 2 requests ago: file ../../../toolkit/xre/nsX11ErrorHandler.cpp, line 190

Appears to be an X11 error on pretty much the worst site you'd want to crash. ;)

Comment 1

[Dave Garrett]

Just did a quick test in a WinXP VM and no problems there.

Socorro suggests bug 559704 & bug 605335, but the former involves the Quack Live plugin and the later is an older 1.9.2 Fennec crash, whereas this is new.

Comment 2

[Dave Garrett]

(In reply to comment #1)
> the Quack Live plugin

Er... Quake Live plugin. Let's just pretend I can type today...

OS is up-to-date Kubuntu 10.04 LTS 32-bit, by the way.

Comment 3

[Dave Garrett]

Safe mode also crashes. No GPU acceleration is on. Beta 8 does not crash.

Comment 4

[Dave Garrett]

regression range from nightlies puts it on the 27th:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=24b63f638579&tochange=e928817fb4e9

narrowing it down further using hourlies puts it here:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=eaa44c83914f&tochange=e9aa8f38d75e

making the regressor one of the following:
http://hg.mozilla.org/mozilla-central/rev/e9aa8f38d75e (bug 578877)
http://hg.mozilla.org/mozilla-central/rev/8f8b1db55800 (bug 621571)

Both commits are from Vladimir Vukicevic, so CCing

Both commits are about WebGL, one enabling it by default on Linux. Setting webgl.enabled_for_all_sites to false stops the crashes. The crash is reproducible with the pref flipped to true on any SUMO page, but I don't think there's WebGL on every SUMO page so I don't know what's going on here.

Comment 5

[Dave Garrett]

Beta 8 does crash if I turn WebGL on.

Beta 8 gives me a different stack trace if I go to the page, then flip the pref in another tab and then refresh SUMO:
bp-0e6f2eb1-7cb5-45f7-b175-7acde2101231
0 	linux-gate.so 	linux-gate.so@0x422 	
1 	libc-2.11.1.so 	libc-2.11.1.so@0x2da81 	
2 	libmozalloc.so 	mozalloc_abort 	mozalloc_abort.cpp:75
3 	libxul.so 	NS_DebugBreak_P 	xpcom/base/nsDebugImpl.cpp:379
4 	libxul.so 	X11Error 	toolkit/xre/nsX11ErrorHandler.cpp:190
5 	libX11.so.6.3.0 	libX11.so.6.3.0@0x3b298 	
6 	libX11.so.6.3.0 	libX11.so.6.3.0@0x4192e 	
7 	libX11.so.6.3.0 	libX11.so.6.3.0@0x41fb5 	
8 	libX11.so.6.3.0 	libX11.so.6.3.0@0x37210 	
9 	libgdk-x11-2.0.so.0.2000.1 	libgdk-x11-2.0.so.0.2000.1@0x679da 	
10 	libgdk-x11-2.0.so.0.2000.1 	libgdk-x11-2.0.so.0.2000.1@0x36484 	
11 	libxul.so 	nsWindow::WidgetToScreenOffset 	widget/src/gtk2/nsWindow.cpp:1884
12 	libxul.so 	nsIView::CalcWidgetBounds 	view/src/nsView.cpp:408
13 	libxul.so 	nsView::DoResetWidgetBounds 	view/src/nsView.cpp:458
14 	libxul.so 	nsViewManager::ProcessPendingUpdates 	view/src/nsViewManager.cpp:461
15 	libxul.so 	nsViewManager::ProcessPendingUpdates 	view/src/nsViewManager.cpp:467
16 	libxul.so 	nsViewManager::FlushPendingInvalidates 	view/src/nsViewManager.cpp:1634
17 	libxul.so 	nsViewManager::EndUpdateViewBatch 	view/src/nsViewManager.cpp:1567
18 	libxul.so 	nsIViewManager::UpdateViewBatch::EndUpdateViewBatch 	nsIViewManager.h:335
19 	libxul.so 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4909
20 	libxul.so 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6432
21 	libxul.so 	nsGenericElement::GetPrimaryFrame 	content/base/src/nsGenericElement.cpp:3773
22 	libxul.so 	nsGenericElement::GetStyledFrame 	content/base/src/nsGenericElement.cpp:1481
23 	libxul.so 	nsGenericHTMLElement::GetOffsetRect 	content/html/content/src/nsGenericHTMLElement.cpp:497
24 	libxul.so 	nsGenericHTMLElement::GetOffsetHeight 	content/html/content/src/nsGenericHTMLElement.cpp:640
25 	libxul.so 	nsIDOMNSHTMLElement_GetOffsetHeight 	dom_quickstubs.cpp:20479
26 	libxul.so 	js_GetProperty 	js/src/jscntxtinlines.h:728
27 	libxul.so 	js::mjit::ic::GetProp 	js/src/jsobj.h:1111
28 		@0x5e056ae 	
29 	libxul.so 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:745
30 	libxul.so 	js::Execute 	js/src/jsinterp.cpp:654
31 	libxul.so 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:4940
32 	libxul.so 	JS_EvaluateUCScriptForPrincipalsVersion 	js/src/jsapi.cpp:4916
33 	libxul.so 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1731
34 	libxul.so 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:890
35 	libxul.so 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:783
36 	libxul.so 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:646
37 	libxul.so 	nsScriptElement::MaybeProcessScript 	content/base/src/nsScriptElement.cpp:180
38 	libxul.so 	nsHTMLScriptElement::MaybeProcessScript 	content/html/content/src/nsHTMLScriptElement.cpp:583
39 	libxul.so 	nsHTMLScriptElement::DoneAddingChildren 	content/html/content/src/nsHTMLScriptElement.cpp:510
40 	libxul.so 	nsHtml5TreeOpExecutor::RunScript 	parser/html/nsHtml5TreeOpExecutor.cpp:730
41 	libxul.so 	nsHtml5TreeOpExecutor::RunFlushLoop 	parser/html/nsHtml5TreeOpExecutor.cpp:525
42 	libxul.so 	nsHtml5ExecutorReflusher::Run 	parser/html/nsHtml5TreeOpExecutor.cpp:90
43 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:626
44 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
45 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
46 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
47 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:202
48 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:192
49 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:191
50 		@0x23f9777 	
51 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3691
52 	firefox-bin 	main 	nsBrowserApp.cpp:158
53 	libc-2.11.1.so 	libc-2.11.1.so@0x16bd5 	
54 	firefox-bin 	firefox-bin@0x1390 	
55 	firefox-bin 	Output 	nsBrowserApp.cpp:77
56 		@0x2

Comment 6

[Dave Garrett]

Info about my graphics card in this laptop:
sudo lshw -C video
  *-display               
       description: VGA compatible controller
       product: Radeon Mobility M7 LW [Radeon Mobility 7500]
       vendor: ATI Technologies Inc
       physical id: 0
       bus info: pci@0000:01:00.0
       version: 00
       width: 32 bits
       clock: 66MHz
       capabilities: agp agp-2.0 pm bus_master vga_palette cap_list rom
       configuration: driver=radeon latency=32 mingnt=8
       resources: irq:11 memory:e8000000-efffffff(prefetchable) ioport:c000(size=256) memory:fcff0000-fcffffff memory:fc000000-fc01ffff(prefetchable)

There's two issues here the way I see it:
1) a WebGL crash of some kind
2) WebGL is touched by SUMO

My driver/card might need blacklisting, as this computer is quite old and just might not work with it at this point, but even so something is quite wrong when it's not crashing on a WebGL demo but rather just trying to go to support.mozilla.com.

Comment 7

[Karl Tomlinson (:karlt)]

Thanks.  Can you also paste the output of "glxinfo | grep OpenGL", please?

And do you get a different stack when MOZ_X_SYNC=1 is in the environment?

Comment 9

[Dave Garrett]

(In reply to comment #7)
> Thanks.  Can you also paste the output of "glxinfo | grep OpenGL", please?

Sure. It requested I install mesa-utils to get it, which I did, then:
glxinfo | grep OpenGL
OpenGL vendor string: Tungsten Graphics, Inc.
OpenGL renderer string: Mesa DRI R100 (RV200 4C57) 20090101 x86/MMX/SSE2 TCL DRI2
OpenGL version string: 1.3 Mesa 7.7.1
OpenGL extensions:

(the extensions line is empty; that's not a typo, just to be clear)

> And do you get a different stack when MOZ_X_SYNC=1 is in the environment?

My normal command to start up the nightly for a test is:
/opt/firefox4.0b9pre/firefox -no-remote -profilemanager

If I change that to this:
env MOZ_X_SYNC=1 /opt/firefox4.0b9pre/firefox -no-remote -profilemanager

I can't reproduce the crash on SUMO anymore.

Comment 10

[Benoit Jacob [:bjacob] (mostly away)]

(In reply to comment #9)
> My normal command to start up the nightly for a test is:
> /opt/firefox4.0b9pre/firefox -no-remote -profilemanager
> 
> If I change that to this:
> env MOZ_X_SYNC=1 /opt/firefox4.0b9pre/firefox -no-remote -profilemanager
> 
> I can't reproduce the crash on SUMO anymore.

OK, so that almost certainly means that this will be fixed by the upcoming changes in bug 616416.

Comment 11

[Dave Garrett]

That's good to know, but why WebGL is touched at all here?

Comment 12

[Benoit Jacob [:bjacob] (mostly away)]

(In reply to comment #11)
> That's good to know, but why WebGL is touched at all here?

Good question to ask to the webmasters! Or use a debugger and do DumpJSStack().

Comment 13

[Benoit Jacob [:bjacob] (mostly away)]

Can you please try this build and let me know if it's still crashing:
Linux x86:
http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-1ac107d4163e/try-lnx/
Linux x86-64:
http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-1ac107d4163e/try-lnx64/

Comment 14

[Benoit Jacob [:bjacob] (mostly away)]

Apparently these builds were not properly uploaded, please try again with these builds, which also have a greater chance of working (I added more error checking):

http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-1adffb67558a/

Comment 15

[Dave Garrett]

(In reply to comment #14)
> http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-1adffb67558a/

Tested using the Linux 32-bit debug tryserver build. No crash on first view of a SUMO page, but if you click to go to another or just refresh the page it has the same error.
bp-3e16653f-d285-4302-bbd6-bd3062110105
(not very informative stack though, as there's no symbols for the build)

I did a "2>" on the command to save the shell error output to a file. Here's all the spew starting from a blank tab in a new profile, typing support.mozilla.com into the address bar, pressing enter, waiting for it to load fully, then pressing F5 to refresh the page, after which point it hits the error:

WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Unable to test style tree integrity -- no content node: file ../../../layout/base/nsCSSFrameConstructor.cpp, line 8071
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
GL extensions: GL_EXT_compiled_vertex_array GL_EXT_texture_env_add GL_ARB_draw_buffers GL_ARB_imaging GL_ARB_multisample GL_ARB_multitexture GL_ARB_occlusion_query GL_ARB_texture_border_clamp GL_ARB_texture_compression GL_ARB_texture_cube_map GL_ARB_texture_env_add GL_ARB_texture_env_combine GL_ARB_texture_env_crossbar GL_ARB_texture_env_dot3 GL_ARB_texture_mirrored_repeat GL_ARB_texture_rectangle GL_ARB_transpose_matrix GL_ARB_vertex_buffer_object GL_ARB_window_pos GL_EXT_abgr GL_EXT_bgra GL_EXT_blend_color GL_EXT_blend_logic_op GL_EXT_blend_minmax GL_EXT_blend_subtract GL_EXT_convolution GL_EXT_copy_texture GL_EXT_draw_range_elements GL_EXT_framebuffer_object GL_EXT_fog_coord GL_EXT_histogram GL_EXT_multi_draw_arrays GL_EXT_packed_depth_stencil GL_EXT_packed_pixels GL_EXT_polygon_offset GL_EXT_rescale_normal GL_EXT_secondary_color GL_EXT_separate_specular_color GL_EXT_stencil_wrap GL_EXT_subtexture GL_EXT_texture GL_EXT_texture3D GL_EXT_texture_cube_map GL_EXT_texture_edge_clamp GL_EXT_texture_env_combine GL_EXT_texture_env_dot3 GL_EXT_texture_filter_anisotropic GL_EXT_texture_lod_bias GL_EXT_texture_mirror_clamp GL_EXT_texture_object GL_EXT_texture_rectangle GL_EXT_vertex_array GL_APPLE_packed_pixels GL_ATI_texture_env_combine3 GL_ATI_texture_mirror_once GL_IBM_multimode_draw_arrays GL_IBM_rasterpos_clip GL_IBM_texture_mirrored_repeat GL_MESA_ycbcr_texture GL_MESA_window_pos GL_NV_blend_square GL_NV_light_max_exponent GL_NV_packed_depth_stencil GL_NV_texture_rectangle GL_NV_texgen_reflection GL_OES_read_format GL_SGI_color_matrix GL_SGI_color_table GL_SGIS_generate_mipmap GL_SGIS_texture_border_clamp GL_SGIS_texture_edge_clamp GL_SGIS_texture_lod GL_SUN_multi_draw_arrays
Found extension GL_ARB_texture_rectangle
Found extension GL_EXT_bgra
Found extension GL_EXT_framebuffer_object
OpenGL vendor ('Tungsten Graphics, Inc.') unrecognized
WARNING: Failed to create GLXContext!: file ../../../gfx/thebes/GLContextProviderGLX.cpp, line 281
WARNING: Failed to create GLXContext!: file ../../../gfx/thebes/GLContextProviderGLX.cpp, line 281
JavaScript warning: http://support.mozilla.com/media/js/common-min.js?build=3844d67, line 16: WebGL: Can't get a usable WebGL context
WARNING: Unable to test style tree integrity -- no content node: file ../../../layout/base/nsCSSFrameConstructor.cpp, line 8071
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: The category has no corresponding type!: file ../../../dom/base/nsScriptNameSpaceManager.cpp, line 690
WARNING: The category has no corresponding type!: file ../../../dom/base/nsScriptNameSpaceManager.cpp, line 690
WARNING: The category has no corresponding type!: file ../../../dom/base/nsScriptNameSpaceManager.cpp, line 690
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Unable to test style tree integrity -- no content node: file ../../../layout/base/nsCSSFrameConstructor.cpp, line 8071
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Failed to create GLXContext!: file ../../../gfx/thebes/GLContextProviderGLX.cpp, line 281
JavaScript warning: http://support.mozilla.com/media/js/common-min.js?build=3844d67, line 16: WebGL: Can't get a usable WebGL context
###!!! ABORT: DRI2DestroyDrawable: BadDrawable (invalid Pixmap or Window parameter); 2 requests ago; id=0x3600b24
Re-running with MOZ_X_SYNC=1 in the environment may give a more helpful backtrace.: file ../../../toolkit/xre/nsX11ErrorHandler.cpp, line 190
UNKNOWN [/opt/test.dbg/libxul.so +0x00341A34]
_XError+0x00000109 [/usr/lib/libX11.so.6 +0x0003B299]
UNKNOWN [/usr/lib/libX11.so.6 +0x0004192F]
_XEventsQueued+0x00000056 [/usr/lib/libX11.so.6 +0x00042356]
XPending+0x00000068 [/usr/lib/libX11.so.6 +0x0002AA68]
UNKNOWN [/usr/lib/libgdk-x11-2.0.so.0 +0x00053978]
g_main_context_prepare+0x000001AA [/lib/libglib-2.0.so.0 +0x0003EACA]
UNKNOWN [/lib/libglib-2.0.so.0 +0x0003EEE9]
g_main_context_iteration+0x00000068 [/lib/libglib-2.0.so.0 +0x0003F4B8]
UNKNOWN [/opt/test.dbg/libxul.so +0x016D8D95]
UNKNOWN [/opt/test.dbg/libxul.so +0x016FFF37]
UNKNOWN [/opt/test.dbg/libxul.so +0x01700C51]
UNKNOWN [/opt/test.dbg/libxul.so +0x01AA438E]
UNKNOWN [/opt/test.dbg/libxul.so +0x01A2BC20]
UNKNOWN [/opt/test.dbg/libxul.so +0x01873538]
UNKNOWN [/opt/test.dbg/libxul.so +0x01B10B3B]
UNKNOWN [/opt/test.dbg/libxul.so +0x01B10B53]
UNKNOWN [/opt/test.dbg/libxul.so +0x01B10BB7]
UNKNOWN [/opt/test.dbg/libxul.so +0x017003F6]
UNKNOWN [/opt/test.dbg/libxul.so +0x01434C11]
XRE_main+0x000031F1 [/opt/test.dbg/libxul.so +0x0032F927]
UNKNOWN [/opt/test.dbg/firefox-bin +0x00000E42]
__libc_start_main+0x000000E6 [/lib/tls/i686/cmov/libc.so.6 +0x00016BD6]
###!!! ABORT: DRI2DestroyDrawable: BadDrawable (invalid Pixmap or Window parameter); 2 requests ago; id=0x3600b24
Re-running with MOZ_X_SYNC=1 in the environment may give a more helpful backtrace.: file ../../../toolkit/xre/nsX11ErrorHandler.cpp, line 190

As before, prefixing the command with "env MOZ_X_SYNC=1" avoids the error. Just to be thorough in case there's something in here, I saved the error output for this test as well. Exact same steps. Diffing the two outputs, the test with MOZ_X_SYNC=1 has the following instead of everything from the first abort line down (but they both have the preceding same JavaScript warning line):

WARNING: Unable to test style tree integrity -- no content node: file ../../../layout/base/nsCSSFrameConstructor.cpp, line 8071
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: The category has no corresponding type!: file ../../../dom/base/nsScriptNameSpaceManager.cpp, line 690
WARNING: The category has no corresponding type!: file ../../../dom/base/nsScriptNameSpaceManager.cpp, line 690
WARNING: The category has no corresponding type!: file ../../../dom/base/nsScriptNameSpaceManager.cpp, line 690
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Unable to test style tree integrity -- no content node: file ../../../layout/base/nsCSSFrameConstructor.cpp, line 8071
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Failed to create GLXContext!: file ../../../gfx/thebes/GLContextProviderGLX.cpp, line 281
JavaScript warning: http://support.mozilla.com/media/js/common-min.js?build=3844d67, line 16: WebGL: Can't get a usable WebGL context
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Unable to test style tree integrity -- no content node: file ../../../layout/base/nsCSSFrameConstructor.cpp, line 8071
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: Overflowed nscoord_MAX in conversion to nscoord: file ../../dist/include/nsCoord.h, line 359
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x8000FFFF: file ../../../../content/base/src/nsContentUtils.cpp, line 2899
WARNING: NS_ENSURE_TRUE(pusher.Push(aBoundElement)) failed: file ../../../../content/xbl/src/nsXBLProtoImplMethod.cpp, line 327
WARNING: cannot post event if not initialized: file ../../../../netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 201
WARNING: nsExceptionService ignoring thread destruction after shutdown: file ../../../xpcom/base/nsExceptionService.cpp, line 197
WARNING: NS_ENSURE_TRUE(!(mAsyncExecutionThread)) failed: file ../../../storage/src/mozStorageConnection.cpp, line 673
WARNING: NS_ENSURE_TRUE(factory) failed: file ../../../docshell/base/nsDocShell.cpp, line 10703
WARNING: not an nsIRDFRemoteDataSource: 'remote != nsnull', file ../../../../rdf/datasource/src/nsLocalStore.cpp, line 312

Comment 16

[Dave Garrett]

The JavaScript warning is for http://support.mozilla.com/media/js/common-min.js?build=3844d67 which appears to be a minified jQuery v1.4.2. Also says it Includes Sizzle.js. Its date line is: Sat Feb 13 22:33:48 2010 -0500

Comment 17

[Dave Garrett]

It's not clear because Bugzilla hard word wraps everything whether you like it or not, but the JS warning line in full includes the WebGL bit:

JavaScript warning: http://support.mozilla.com/media/js/common-min.js?build=3844d67, line 16: WebGL: Can't get a usable WebGL context

Line 16 is the entirety of the minified file, but doing a search does find the string "webgl" in there in a few places. I think this is probably the trigger but I have no clue what it's doing or why.

(excessive word wrapping made comment 15 way longer than it needed to be...)

Comment 18

[Dave Garrett]

jQuery is the same conclusion in bug 616416 comment 14 - bug 616416 comment 16. It seems to be the common culprit here, so duping this there.

Comment 19

[Dave Garrett]

Actually, not quite a dupe per bug 616416 comment 6. That one still crashes with MOZ_X_SYNC=1 and this one doesn't. So same trigger, slightly different bugs. Will leave this one open instead of duping then (sorry for the bugspam).

Comment 20

[Joe Drew (not getting mail)]

This is another example of a very old GPU crashing in WebGL. Like in bug 616416, I want a fix, but I wouldn't hold release on it.

Comment 21

[Anton]

Signature	
UUID	f22dc8e7-abe2-4bd9-a20d-df3f82110511
Uptime	6.6 hours
Last Crash	25758 seconds (7.2 hours) before submission
Install Age	632030 seconds (1.0 weeks) since version was first installed.
Install Time	2011-05-04 08:17:51
Product	Firefox
Version	4.0.1
Build ID	20110429093851
Release Channel	unknown
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.35-23-generic-pae #41~lucid1-Ubuntu SMP Thu Dec 2 23:51:29 UTC 2010 i686
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	SIGSEGV
Crash Address	0x360039
User Comments	lololol
Processor Notes 	No thread was identified as the cause of the crash; No signature could be created because we do not know which thread crashed
EMCheckCompatibility	True

Comment 22

[Karl Tomlinson (:karlt)]

The report in comment 21 must be a different issue because libGL is not loaded.

Comment 23

[Anton]

Shall I create one ?

Comment 24

[Karl Tomlinson (:karlt)]

Yes, please file another bug, Aton.  The crash report submitted unfortunately doesn't contain much helpful information, but, if you can provide steps to reproduce (or even obtain a backtrace with gdb), we'd have a better chance of working out what is happening.

Comment 25

[Karl Tomlinson (:karlt)]

Er, sorry about the missing 'n'.

Comment 26

[Anton]

Nevermind :)
Ok, I've enabled saving core dumps in my Ubuntu and waiting for next crash.

Comment 27

[Dave Garrett]

Closing old bug as WFM. If someone else is getting something along this line still or again, then it's probably best to file a new clean bug with the needed information and steps to reproduce in a current version. (the computer I filed this for is dead and trashed so I won't be testing it, at least)