FS#51672 - [firefox] 49.0.2-1 segfaults on http://stepstone.de

Attached to Project: Arch Linux
Opened by stefan (stefan1) - Thursday, 03 November 2016, 10:45 GMT
Last edited by Doug Newgard (Scimmia) - Friday, 30 December 2016, 14:04 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Jan de Groot (JGC)
Evangelos Foutras (foutrelis)
Jan Alexander Steffens (heftig)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 2
Private No

Details

Description:

Firefox terminates with Segmentation Fault when browsing
http://stepstone.de.


This is not an upstream bug, see

https://bugzilla.mozilla.org/show_bug.cgi?id=1314041


I've put severity to medium since it is a segfault, and security implications are unknown.


Additional info:

* package version: 49.0.2-1

* config: verified with out-of-the box config, as installed by
pacman.

* log files: not available, since about:crashes is disabled on Arch
build.


Steps to reproduce:

Start Firefox, go to http://stepstone.de, type "computer scientist"
into field "Was", hit return. Close popup window. Start scrolling
through result list. Firefox will segfault within roughly ten
seconds.

First observed with my personal setup.

After removing `~/.mozilla` and restarting, the tab crashes, and also
other tabs crash that are open at the same time.

Also verified after removing `~/.mozilla` and restarting in "Save
mode".

This task depends upon

Closed by  Doug Newgard (Scimmia)
Friday, 30 December 2016, 14:04 GMT
Reason for closing:  Not a bug
Comment by Doug Newgard (Scimmia) - Thursday, 03 November 2016, 15:30 GMT
No problem here
Comment by stefan (stefan1) - Thursday, 03 November 2016, 15:51 GMT
I have just confirmed the described behaviour. Segfault with my setup, and "crashing tabs" with default setup, which I've achieved by

# pacman -Rcs firefox
# pacman -S firefox

$ rm -rf .mozilla
$ /bin/firefox >/tmp/ff.log 2>&1

I fail to attach the logfile and a post-crash screenshot
Comment by stefan (stefan1) - Thursday, 03 November 2016, 15:53 GMT
sk@tauhou:~$ cat /tmp/ff.log
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[Parent 7774] WARNING: pipe error (45): Connection reset by peer: file /build/firefox/src/firefox-49.0.2/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 316
[Parent 7774] WARNING: pipe error (42): Connection reset by peer: file /build/firefox/src/firefox-49.0.2/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 316

###!!! [Parent][MessageChannel] Error: (msgtype=0x2C007A,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv


###!!! [Parent][MessageChannel] Error: (msgtype=0x2C007A,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
Comment by Piero Vera (pierovera) - Sunday, 06 November 2016, 21:52 GMT
Can confirm this happening on Firefox 49.0.2-1, except it doesn't happen on Linux 4.8.3 and does on 4.8.6. Might not be related, but it might be worth noting.
Comment by stefan (stefan1) - Monday, 07 November 2016, 09:11 GMT
Yes, I'm on 4.8.6:

sk@tauhou:~$ cat /proc/version
Linux version 4.8.6-1-ARCH (builduser@tobias) (gcc version 6.2.1 20160830 (GCC) ) #1 SMP PREEMPT Mon Oct 31 18:51:30 CET 2016
Comment by Jan Alexander Steffens (heftig) - Monday, 07 November 2016, 09:13 GMT
I cannot reproduce this.
Comment by stefan (stefan1) - Monday, 07 November 2016, 09:50 GMT
Here's a stack trace generated using `strace -o /tmp/ff.log /usr/bin/firefox`. Is there any other way how I can provide information?
Comment by Jan Alexander Steffens (heftig) - Monday, 07 November 2016, 12:38 GMT
strace produces system call traces, not stack traces. System call traces are not useful here.

You might find stacktraces using coredumpctl.
Comment by stefan (stefan1) - Thursday, 10 November 2016, 11:06 GMT
Awww, how embarassing, I know. I've tried gdb first but it complains
with

$ gdb /usr/bin/firefox
GNU gdb (GDB) 7.12
[...]
Reading symbols from /usr/bin/firefox...(no debugging symbols found)...done.
(gdb)

so I gaveup, sending the list of syscalls instead. Coredumctl gave me
the attached stack trace.
   ff.dump (35.2 KiB)
Comment by Jan de Groot (JGC) - Thursday, 10 November 2016, 11:10 GMT
The stacktraces indicate something with nouveau_dri, so it's probably not a bug in firefox but a crash in your graphics driver. That's also why most of us can't reproduce your bug.
Comment by stefan (stefan1) - Thursday, 10 November 2016, 14:28 GMT
Hmmm, would that not also manifest in a lot more situations? I'm
using nouveau since the installation of this system in 2015, but I do
not see too many coredumps.

Also, I've not seen Firefox segfault on any other website, and not in
such a reproducible fashion.

The first entry reported by `coredumpctl` is for the program
`darktable` on the date 2015-07-26. Over time, I've seen

$ coredumpctl list | head -n-1 | wc -l
843

coredumps. Listed by program, that's

$ coredumpctl list |
sed -rn 's#^.*/([^/-]*)$#\1#p' |
sed -r 's#emacs-#emacs#g' |
sort | uniq -c | sort -n
1 svn
1 Xorg
2 mkGraphs
3 freewrl
4 fglMatcher
4 hugin
4 zathura
5 fgl
8 rsh
9 assi
10 queue
15 a.out
15 darktable
16 viking
21 gnuplot
32 firefox
110 parser

Out of these 843 coredumps, only 30 mention `nouveau`, 25 of which
involve `firefox`:

$ coredumpctl list |
sed -r 's#^(\S+\s+){4}(\S+)\s+(\S+\s+){3}.*/([^/]+)$#\2 \4#' |
while read pid name; do
coredumpctl info "$pid" "$name" 2>/dev/null | grep -q nouveau &&
echo "$name";
done | sort | uniq -c
25 firefox
4 hugin
1 Xorg


So the other option may be to file a bug against the
`xf86-video-nouveau` package?
Comment by Piero Vera (pierovera) - Thursday, 10 November 2016, 14:59 GMT
I'm not certain it's an issue with xf86-video-nouveau as it happens to me on Nvidia proprietary drivers, on both 370.28 and 375.10. It doesn't happen on my other machine with xf86-video-intel for whatever reason though. I'll attach the coredumps I have later today.
Comment by Piero Vera (pierovera) - Thursday, 01 December 2016, 02:58 GMT
I have no logical explanation for it, but I've fixed the issue on my end. Apparently the root partition (/boot and /home are separate partitions) being near full or full was causing Firefox to segfault. After extending the root partition, I'm having absolutely no issues so far. It's worth noting that the .mozilla directory is indeed in /home, which isn't even close to full. I wish I could help further but I believe my problem might be another one, regardless of it making any sense or not.

Loading...