#773761 Viewing certain image in Iceweasel kills/restarts session

Package:
libgl1-mesa-dri
Source:
mesa
Description:
free implementation of the OpenGL API -- DRI modules
Submitter:
Date:
2014-12-24 07:39:04 UTC
Severity:
normal
#773761#5
Date:
2014-12-22 23:55:45 UTC
From:
To:
Package: iceweaselVersion: 31.3.0esr-1~deb7u1Please note, the link is NSFW (shows nudity)! The bug only occurs when viewing this specific image, so unfortunately there is no way not to submit it.When viewing this NSFW image [1] in Iceweasel, 1. the image starts to load,2. my screen goes black,3. a line at the top containing "Init" and some number appears,4. a few seconds later, the black disappears and I am at the login screen (hence lost my session).When viewing a smaller version (embedded in a HTML page) [2], nothing happens.When viewing the image in Chromium, nothing happens.[1] http://i.imgur.com/cgTtTxZ.jpg?1[2] http://i.imgur.com/cgTtTxZ
#773761#14
Date:
2014-12-24 01:50:47 UTC
From:
To:
--- Please enter the report below this line. ---

I have observed similar behavior with a different site. Iceweasel
experienced a GPF coincident with my window-manager (Awesome) session
ending and kicking me out to the display-manager greeter:

/var/log/messages shows:

Dec 23 17:33:27 warthog kernel: [174248.546132] traps:
iceweasel[15037] general protection ip:7f928c8fbfe0 sp:7fffeaf9d9a0
error:0 in r600_dri.so[7f928c630000+76f000]

The specific file was http://www.harkavagrant.com/images/ducks3.png;
the crash occurred when switching to the tab in which the above PNG
was displayed while the browser was in fullscreen mode. I will try to
duplicate the behavior with all extensions / add-ons disabled after
sending this message.


Debian Release: 8.0
  500 testing-updates ftp.us.debian.org
  500 testing-proposed-updates ftp.us.debian.org
  500 testing         security.debian.org
  500 testing         ftp.us.debian.org
  500 stable          dl.google.com
    1 experimental    ftp.debian.org
--- Package information. ---
Depends                               (Version) | Installed
===============================================-+-===================
libasound2                          (>= 1.0.16) |
libatk1.0-0                         (>= 1.12.4) |
libc6                                 (>= 2.17) |
libcairo2                            (>= 1.2.4) |
libdbus-1-3                          (>= 1.0.2) |
libdbus-glib-1-2                      (>= 0.78) |
libevent-2.0-5               (>= 2.0.10-stable) |
libffi6                              (>= 3.0.4) |
libfontconfig1                        (>= 2.11) |
libfreetype6                         (>= 2.2.1) |
libgcc1                            (>= 1:4.1.1) |
libgdk-pixbuf2.0-0                  (>= 2.22.0) |
libglib2.0-0                        (>= 2.37.3) |
libgtk2.0-0                         (>= 2.24.0) |
libhunspell-1.3-0                    (>= 1.3.3) |
libnspr4                          (>= 2:4.10.3) |
libnss3                             (>= 2:3.16) |
libpango-1.0-0                      (>= 1.14.0) |
libsqlite3-0                     (>= 3.7.12-1~) |
libstartup-notification0               (>= 0.8) |
libstdc++6                             (>= 4.9) |
libvpx1                              (>= 1.3.0) |
libx11-6                                        |
libxext6                                        |
libxrender1                                     |
libxt6                                          |
zlib1g                             (>= 1:1.2.0) |
fontconfig                                      |
procps                                          |
debianutils                           (>= 1.16) |


Package's Recommends field is empty.

Suggests                   (Version) | Installed
====================================-+-===========
fonts-stix                           | 1.1.1-1
 OR otf-stix                         |
fonts-oflb-asana-math                |
fonts-mathjax                        |
mozplugger                           |
libgssapi-krb5-2                     | 1.12.1+dfsg-16
 OR libkrb53                         |
libgnomeui-0                         |
libcanberra0                         | 0.30-2.1
--- Output from package bug script ---
#773761#19
Date:
2014-12-24 02:33:11 UTC
From:
To:
--- Please enter the report below this line. ---

I've reproduced the session-crashing behavior twice with all
extensions disabled and on the same stimulus (switching to a tab
displaying http://www.harkavagrant.com/images/ducks3.png in fullscreen
mode).

`tail .xsession-errors` output is unchanged:

QPixmap: It is not safe to use pixmaps outside the GUI thread
QPixmap: It is not safe to use pixmaps outside the GUI thread
Launching "Iceweasel" : "/usr/bin/iceweasel %u"

(process:16899): GLib-CRITICAL **: g_slice_set_config: assertion
'sys_page_size == 0' failed
Error: The name org.freedesktop.UPower was not provided by any
.service files

`tail /var/log/messages` is now:

Dec 23 18:16:09 warthog kernel: [176810.253955] traps:
iceweasel[16373] general protection ip:7faf503fbfe0 sp:7fffeea81930
error:0 in r600_dri.so[7faf50130000+76f000]
Dec 23 18:16:37 warthog kernel: [176838.390051] traps:
iceweasel[16423] general protection ip:7fffe6503fe0 sp:7fffffffc780
error:0 in r600_dri.so[7fffe6238000+76f000]
Dec 23 18:21:21 warthog kernel: [177122.364398] traps:
iceweasel[16684] general protection ip:7f29ed1fbfe0 sp:7fff0967ca20
error:0 in r600_dri.so[7f29ecf30000+76f000]
Dec 23 18:21:41 warthog kernel: [177143.134127] traps: icedove[16719]
general protection ip:7f109e3fbfe0 sp:7fff91bc8040 error:0 in
r600_dri.so[7f109e130000+76f000]
Dec 23 18:22:39 warthog kernel: [177200.667982] traps:
iceweasel[16766] general protection ip:7f73abffbfe0 sp:7fff851681c0
error:0 in r600_dri.so[7f73abd30000+76f000]
Dec 23 18:23:01 warthog kernel: [177222.509321] traps:
iceweasel[16818] general protection ip:7f81f2bfbfe0 sp:7fff0fe883d0
error:0 in r600_dri.so[7f81f2930000+76f000]
Dec 23 18:23:32 warthog kernel: [177253.280145] traps:
iceweasel[16871] general protection ip:7f89ae7fbfe0 sp:7fff76af0a30
error:0 in r600_dri.so[7f89ae530000+76f000]
Dec 23 18:24:02 warthog kernel: [177283.489015] traps:
iceweasel[16902] general protection ip:7f33421fbfe0 sp:7fffd425e680
error:0 in r600_dri.so[7f3341f30000+76f000]
Dec 23 18:24:45 warthog kernel: [177327.047427] traps:
iceweasel[17001] general protection ip:7ff5b47fbfe0 sp:7fff8d7a5540
error:0 in r600_dri.so[7ff5b4530000+76f000]
Dec 23 18:24:51 warthog kernel: [177332.388961] traps: icedove[17017]
general protection ip:7f81a3dfbfe0 sp:7fff73ceb2d0 error:0 in
r600_dri.so[7f81a3b30000+76f000]

I attempted to do the gdb as specified in reportbug-ng's message but
could not capture the output due to successfully reproducing the
session crash... I don't really know how to use gdb.

Debian Release: 8.0
  500 testing-updates ftp.us.debian.org
  500 testing-proposed-updates ftp.us.debian.org
  500 testing         security.debian.org
  500 testing         ftp.us.debian.org
  500 stable          dl.google.com
    1 experimental    ftp.debian.org
--- Package information. ---
Depends                               (Version) | Installed
===============================================-+-===================
libasound2                          (>= 1.0.16) |
libatk1.0-0                         (>= 1.12.4) |
libc6                                 (>= 2.17) |
libcairo2                            (>= 1.2.4) |
libdbus-1-3                          (>= 1.0.2) |
libdbus-glib-1-2                      (>= 0.78) |
libevent-2.0-5               (>= 2.0.10-stable) |
libffi6                              (>= 3.0.4) |
libfontconfig1                        (>= 2.11) |
libfreetype6                         (>= 2.2.1) |
libgcc1                            (>= 1:4.1.1) |
libgdk-pixbuf2.0-0                  (>= 2.22.0) |
libglib2.0-0                        (>= 2.37.3) |
libgtk2.0-0                         (>= 2.24.0) |
libhunspell-1.3-0                    (>= 1.3.3) |
libnspr4                          (>= 2:4.10.3) |
libnss3                             (>= 2:3.16) |
libpango-1.0-0                      (>= 1.14.0) |
libsqlite3-0                     (>= 3.7.12-1~) |
libstartup-notification0               (>= 0.8) |
libstdc++6                             (>= 4.9) |
libvpx1                              (>= 1.3.0) |
libx11-6                                        |
libxext6                                        |
libxrender1                                     |
libxt6                                          |
zlib1g                             (>= 1:1.2.0) |
fontconfig                                      |
procps                                          |
debianutils                           (>= 1.16) |


Package's Recommends field is empty.

Suggests                   (Version) | Installed
====================================-+-===========
fonts-stix                           | 1.1.1-1
 OR otf-stix                         |
fonts-oflb-asana-math                |
fonts-mathjax                        |
mozplugger                           |
libgssapi-krb5-2                     | 1.12.1+dfsg-16
 OR libkrb53                         |
libgnomeui-0                         |
libcanberra0                         | 0.30-2.1
--- Output from package bug script ---
#773761#24
Date:
2014-12-24 03:01:26 UTC
From:
To:
Control: reassign -1 libgl1-mesa-dri

Note how the crash address is in r600_dri.so...

Mike

#773761#33
Date:
2014-12-24 07:37:28 UTC
From:
To:
OK, but I'm not sure what to do with that information... are you
saying that this is a bug in libgl1-mesa-dri and not in iceweasel?