firefox startup SEGV on amd64 when I installed chromebug
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
firefox-3.5 (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
Binary package hint: firefox
Today, I observed SEGV of firefox-3.5 on amd64.
1) Ubuntu 9.10
2) firefox:
Installed: 3.5.3+build1+
Candidate: 3.5.3+build1+
Version table:
*** 3.5.3+build1+
500 http://
100 /var/lib/
Here is gdb session, with backtrace.
I suspect pointer truncation (64 -> 32)
('script' should be 0x7fffe4867ab8, but it is 0xe4867ab8)
=======
-arashi(pts/0)% firefox-3.5 -g -no-remote -p develuser
/usr/bin/gdb /usr/lib/
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://
Reading symbols from /usr/lib/
(gdb) set height 0
(gdb) run
Starting program: /usr/lib/
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffe6cf0910 (LWP 15893)]
[New Thread 0x7fffe62e5910 (LWP 15894)]
[New Thread 0x7fffe51ff910 (LWP 15895)]
Program received signal SIGSEGV, Segmentation fault.
js_PCToLineNumber (cx=0x7fffe6fe2000, script=
1808 jsscript.cpp: No such file or directory.
in jsscript.cpp
Current language: auto
The current source language is "auto; currently c++".
(gdb) bt
#0 js_PCToLineNumber (cx=0x7fffe6fe2000, script=
#1 0x00007ffff53a3594 in jsd_GetClosestLine (jsdc=0x7ffff67
#2 0x00007ffff53a96cd in jsds_FilterHook (jsdc=0x7ffff67
#3 0x00007ffff53aa2f3 in jsds_ExecutionH
rval=
#4 0x00007ffff53a26ef in jsd_CallExecuti
hookData=0x1, rval=<value optimized out>) at jsd_hook.c:177
#5 0x00007ffff636936f in JS_HandleTrap (cx=0x7fffe6f09800, script=
#6 0x00007ffff6381c4f in js_Interpret (cx=0x7fffe6f09800) at jsinterp.cpp:5647
#7 0x00007ffff638ebfd in js_Execute (cx=0x7fffe6f09800, chain=0x7fffe6f
at jsinterp.cpp:1622
#8 0x00007ffff6357a48 in JS_ExecuteScript (cx=0x7fffe6fe2000, obj=0x7fffe4867000, script=0xe4867ab8, rval=0x3e11) at jsapi.cpp:5036
#9 0x00007ffff4d7502c in mozJSComponentL
aLocation=
#10 0x00007ffff4d7602f in mozJSComponentL
at mozJSComponentL
#11 0x00007ffff54ed8f3 in nsFactoryEntry:
#12 0x00007ffff54eda15 in nsComponentMana
aIID=..., aResult=
#13 0x00007ffff54eea6a in nsComponentMana
result=
#14 0x00007ffff54c4bd4 in nsGetServiceByC
#15 0x00007ffff54c434a in nsCOMPtr_
#16 0x00007ffff52ed5ca in nsCOMPtr<
someData=<value optimized out>) at ../../.
#17 nsAppStartupNot
at nsAppStartupNot
#18 0x00007ffff4d185e2 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>) at nsAppRunner.
#19 0x000000000040271f in ?? ()
#20 0x00007ffff6be3abd in __libc_start_main () from /lib/libc.so.6
#21 0x0000000000401f99 in ?? ()
#22 0x00007fffffffe468 in ?? ()
#23 0x000000000000001c in ?? ()
#24 0x0000000000000004 in ?? ()
#25 0x00007fffffffe7de in ?? ()
#26 0x0000000000000000 in ?? ()
(gdb) up 9
#9 0x00007ffff4d7502c in mozJSComponentL
aLocation=
1386 mozJSComponentL
in mozJSComponentL
(gdb) p nativePath
$1 = {<nsFixedCString> = {<nsCString> = {<nsACString_
mLength = 59, mFlags = 65553}, <No data fields>}, mFixedCapacity = 63,
mFixedBuf = 0x7fffffff94f0 "file:/
mStorage = "file:/
(gdb) p *script
$2 = {code = 0x7fffe4867ab8 "S", length = 1850, version = 4276, nfixed = 101, objectsOffset = 80 'P', upvarsOffset = 0 '\000', regexpsOffset = 0 '\000',
trynotesOffset = 0 '\000', flags = 0 '\000', main = 0x7fffe4867afd ";", atomMap = {vector = 0x7fffe4867060, length = 160},
filename = 0x7fffe52295fd "file:/
u = {object = 0x0, nextToGC = 0x0}}
(gdb) down
#8 0x00007ffff6357a48 in JS_ExecuteScript (cx=0x7fffe6fe2000, obj=0x7fffe4867000, script=0xe4867ab8, rval=0x3e11) at jsapi.cpp:5036
5036 jsapi.cpp: No such file or directory.
in jsapi.cpp
(gdb) up
#9 0x00007ffff4d7502c in mozJSComponentL
aLocation=
1386 mozJSComponentL
in mozJSComponentL
(gdb) info registers
rax 0x0 0
rbx 0x7fffe5203540 140737037481280
rcx 0x1 1
rdx 0xe4867ab8 3834018488
rsi 0x7fffe4867000 140737027403776
rdi 0x7fffe6fe2000 140737068802048
rbp 0x1 0x1
rsp 0x7fffffff92d0 0x7fffffff92d0
r8 0x1 1
r9 0x3e11 15889
r10 0x7fffffff8b40 140737488325440
r11 0x7fffe6fe6980 140737068820864
r12 0x7ffff6760250 140737328317008
r13 0x7fffe4867000 140737027403776
r14 0x7fffe5227128 140737037627688
r15 0x7fffe6f09800 140737067915264
rip 0x7ffff4d7502c 0x7ffff4d7502c <mozJSComponent
eflags 0x10206 [ PF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1fa3 [ IE DE PE IM DM ZM OM UM PM ]
(gdb) x/8i $pc-32
0x7ffff4d7500c <_ZN20mozJSComp
0x7ffff4d75014 <_ZN20mozJSComp
0x7ffff4d7501c <_ZN20mozJSComp
0x7ffff4d75024 <_ZN20mozJSComp
0x7ffff4d75027 <_ZN20mozJSComp
0x7ffff4d7502c <_ZN20mozJSComp
0x7ffff4d7502e <_ZN20mozJSComp
jne 0x7ffff4d7503e <_ZN20mozJSComp
0x7ffff4d75030 <_ZN20mozJSComp
(gdb)
Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 449744, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.