#642537 iceweasel: randomly crashes by receiving from X the following: ABORT: Request 155.34: BadLength

Package:
iceweasel
Source:
firefox-esr
Submitter:
Cengiz Gunay
Date:
2011-10-04 05:51:08 UTC
Severity:
important
#642537#5
Date:
2011-09-23 15:54:40 UTC
From:
To:
After having to upgrade iceweasel (because of dependency requirements) to either 5.* or to 6.* it started
randomly crashing. It runs for a few minutes and then I receive this error on the console:

###!!! ABORT: Request 155.34: BadLength (poly request too large or
internal Xlib length error); 215 requests ago: file
/build/buildd-iceweasel_6.0.2-1-i386-0rGvYM/iceweasel-6.0.2/toolkit/xre/nsX11ErrorHandler.cpp,
line 199

To make sure it's not the add-ons, I ran it like this:
MOZILLA_DISABLE_PLUGINS=1 gdb --args /usr/lib/iceweasel/firefox-bin -g -safe-mode

And got the stack trace:
(gdb) bt full
#0  0xb74d3667 in raise () from /lib/i386-linux-gnu/libc.so.6
No symbol table info available.
#1  0xb74d6a52 in abort () from /lib/i386-linux-gnu/libc.so.6
No symbol table info available.
#2  0xb773bee7 in mozalloc_abort (msg=0xbfc5c454 "###!!! ABORT: Request
155.34: BadLength (poly request too large or internal Xlib length
error); 215 requests ago: file
/build/buildd-iceweasel_6.0.2-1-i386-0rGvYM/iceweasel-6.0.2/toolkit/xre/nsX11Erro"...)
at
/build/buildd-iceweasel_6.0.2-1-i386-0rGvYM/iceweasel-6.0.2/memory/mozalloc/mozalloc_abort.cpp:76
No locals.
Die: DW_TAG_unspecified_type (abbrev = 24, offset = 213332010)
	has children: FALSE
		attributes:
				DW_AT_name (DW_FORM_strp) string:
				"decltype(nullptr)"
				Dwarf Error: Cannot find type of die [in
				module
				/usr/lib/debug/usr/lib/xulrunner-6.0/libxul.so]

It's obviously not coming from iceweasel, but I don't
have any clue on what package to change to fix this problem. I already upgraded
my Xorg packages.

I would appreciate if you can give me any insight (I assume it's some
package I stupidly forgot to upgrade)

Thanks!
#642537#10
Date:
2011-09-23 16:02:19 UTC
From:
To:
Try running iceweasel --sync, it should make X requests synchronously,
which would get you a meaning full backtrace.

Mike
#642537#15
Date:
2011-09-25 21:43:35 UTC
From:
To:
Ok, it crashed also with --sync and gave a very similar backtrace:

 Program received signal SIGPIPE, Broken pipe.
[Switching to Thread -1312818320 (LWP 19884)]
0xb763013e in send () from /lib/i386-linux-gnu/libpthread.so.0
(gdb) bt full
#0  0xb763013e in send () from /lib/i386-linux-gnu/libpthread.so.0
No symbol table info available.
#1  0xb7378a53 in PR_GetConnectStatus () from /usr/lib/libnspr4.so.0d
 No symbol table info available.
#2  0xb594ca23 in NSSSSL_VersionCheck () from
/usr/lib/i386-linux-gnu/libssl3.so.1d
No symbol table info available.
#3  0xb593fa2e in SSL_PreencryptedFileToStream () from
/usr/lib/i386-linux-gnu/libssl3.so.1d
 No symbol table info available.
#4  0xb5941d33 in SSL_GetStatistics () from
/usr/lib/i386-linux-gnu/libssl3.so.1d
No symbol table info available.
#5  0xb5950ccb in SSL_ResetHandshake () from
/usr/lib/i386-linux-gnu/libssl3.so.1d
 No symbol table info available.
#6  0xb595408e in SSL_InheritMPServerSIDCache () from
/usr/lib/i386-linux-gnu/libssl3.so.1d
No symbol table info available.
Die: DW_TAG_unspecified_type (abbrev = 30, offset = 169483515)
 has children: FALSE
attributes:
DW_AT_name (DW_FORM_strp) string: "decltype(nullptr)"
Dwarf Error: Cannot find type of die [in module
/usr/lib/debug/usr/lib/xulrunner-6.0/libxul.so]
#642537#20
Date:
2011-09-26 06:44:45 UTC
From:
To:
SIGPIPE is actually not a crash, but gdb happens to stop when seeing
those. Either "continue" execution or type the following gdb command
before starting:
  handle SIGPIPE nostop noprint pass

Mike
#642537#25
Date:
2011-09-27 03:38:43 UTC
From:
To:
I used the "handle" command for SIGPIPE and iceweasel ran a long time this
time. But eventually after 30 minutes, it crashed, taking down gdb with it!
Although, I was able to load the core file it generated, and here is the
stack trace:

$ gdb /usr/lib/iceweasel/firefox-bin core
...
Program terminated with signal 5, Trace/breakpoint trap.
#0  0xb76d8a81 in __nptl_create_event () from
/lib/i386-linux-gnu/libpthread.so.0
(gdb) set pagination off
(gdb) bt full
#0  0xb76d8a81 in __nptl_create_event () from
/lib/i386-linux-gnu/libpthread.so.0
No symbol table info available.
#1  0xb76da1b6 in pthread_create@@GLIBC_2.1 () from
/lib/i386-linux-gnu/libpthread.so.0
No symbol table info available.
#2  0xb742c709 in PR_JoinThread () from /usr/lib/libnspr4.so.0d
No symbol table info available.
Die: DW_TAG_unspecified_type (abbrev = 27, offset = 212961860)
 has children: FALSE
attributes:
DW_AT_name (DW_FORM_strp) string: "decltype(nullptr)"
Dwarf Error: Cannot find type of die [in module
/usr/lib/debug/usr/lib/xulrunner-6.0/libxul.so]

GDB loaded a lot of symbol information, but the thread library doesn't seem
to have any (I didn't see a -dbg package for pthread?). From the looks of
it, can this be a race condition with the newly starting threads?
#642537#30
Date:
2011-09-27 05:23:15 UTC
From:
To:
That really doesn't look remotely related to your initial problem.

Mike
#642537#35
Date:
2011-09-29 00:20:11 UTC
From:
To:
2011/9/27 Mike Hommey <mh@glandium.org>

But it still crashes? Anything else you want me to try? Should this go
upstream?

BTW, I still get the X error when running it outside of gdb.
#642537#40
Date:
2011-09-29 05:50:13 UTC
From:
To:
I hadn't notices, but that wasn't a crash either. It was a
trace/breakpoint trap.

Unless you can get a meaningful backtrace for it, there's not much we
can do.

Mike
#642537#45
Date:
2011-10-04 03:26:15 UTC
From:
To:
2011/9/29 Mike Hommey <mh@glandium.org>:

Well, it is crashing gdb while I'm debugging it. Is there a way of
preventing this?
#642537#50
Date:
2011-10-04 05:47:13 UTC
From:
To:
Apart from trying a different version of gdb, no idea.

Mike