Firefox 49.0_7,1 crashes on YouTube video and certain web pages

Tue Oct 4 18:25:53 UTC 2016

Hello,

First off:

FreeBSD igor 9.3-RELEASE-p43 FreeBSD 9.3-RELEASE-p43 #0: Sat May 28
00:19:32 UTC 2016
root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

/usr/ports/www/firefox/Makefile:
     $FreeBSD: head/www/firefox/Makefile 422956 2016-09-30 01:15:10Z
jbeich $

Normally, I'd use the defaults of DBUS and FFMPEG, but for this build
I've unchecked all configuration options except OPTIMIZE_CFLAGS, which
is enabled.

How to reproduce:

% firefox
Bus error (core dumped)

URL loaded which crashed it:

https://www.youtube.com/watch?v=HbRsWJaT4Go

Any YouTube video will work to generate the crash. I have all extensions
disabled. A fresh profile makes no difference in the behavior.

Recompiling with OPTIMIZE_CFLAGS _disabled_ and DEBUG enabled produces
an immediate crash. Logs attached.

% gdb -c firefox.core /usr/local/lib/firefox/firefox
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as
"amd64-marcel-freebsd".../home/zmetzing/.gdbinit:1: Error in sourced
command file:
Undefined command: "add-auto-load-safe-path".  Try "help".
Dwarf Error: wrong version in compilation unit header (is 4, should be
2) [in module /usr/local/lib/firefox/firefox]

Core was generated by `firefox'.
Program terminated with signal 11, Segmentation fault.
#0  0x00000008020f564c in ?? ()
(gdb) bt
#0  0x00000008020f564c in ?? ()
#1  0x0000000807dd3e71 in ?? ()
#2  0x0000000000000000 in ?? ()
(gdb)

--- Zach
-------------- next part --------------
% firefox 
++DOCSHELL 0x821360b00 == 1 [pid = 51531] [id = 1]
++DOMWINDOW == 1 (0x8213ee000) [pid = 51531] [serial = 1] [outer = 0x0]
++DOMWINDOW == 2 (0x8213ee800) [pid = 51531] [serial = 2] [outer = 0x8213ee000]
++DOCSHELL 0x8225d8e00 == 2 [pid = 51531] [id = 2]
++DOMWINDOW == 3 (0x8213b5c00) [pid = 51531] [serial = 3] [outer = 0x0]
++DOMWINDOW == 4 (0x8225fec00) [pid = 51531] [serial = 4] [outer = 0x8213b5c00]
++DOMWINDOW == 5 (0x8213a0400) [pid = 51531] [serial = 5] [outer = 0x8213ee000]
[51531] WARNING: Hardware Vsync support not yet implemented. Falling back to software timers: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/gfx/thebes/gfxPlatform.cpp, line 2251
++DOCSHELL 0x824299300 == 3 [pid = 51531] [id = 3]
++DOMWINDOW == 6 (0x82426bc00) [pid = 51531] [serial = 6] [outer = 0x0]
++DOCSHELL 0x824299800 == 4 [pid = 51531] [id = 4]
++DOMWINDOW == 7 (0x823df9100) [pid = 51531] [serial = 7] [outer = 0x0]
++DOCSHELL 0x824c24a00 == 5 [pid = 51531] [id = 5]
++DOMWINDOW == 8 (0x824b20280) [pid = 51531] [serial = 8] [outer = 0x0]
++DOMWINDOW == 9 (0x824b21b00) [pid = 51531] [serial = 9] [outer = 0x824b20280]
++DOMWINDOW == 10 (0x824debc00) [pid = 51531] [serial = 10] [outer = 0x82426bc00]
++DOMWINDOW == 11 (0x82502a600) [pid = 51531] [serial = 11] [outer = 0x823df9100]
++DOMWINDOW == 12 (0x82502b080) [pid = 51531] [serial = 12] [outer = 0x824b20280]

(firefox:51531): Gdk-WARNING **: gdkproperty-x11.c:325 invalid X atom: 386
[51531] ###!!! ABORT: X_ShmDetach: BadShmSeg (invalid shared segment parameter); 7 requests ago; id=0x3c000a9
Re-running with MOZ_X_SYNC=1 in the environment may give a more helpful backtrace.: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/toolkit/xre/nsX11ErrorHandler.cpp, line 157
#01: XRE_FreeAppData[/usr/local/lib/firefox/libxul.so +0x5335748]
#02: _XError[/usr/local/lib/libX11.so.6 +0x461b4]
#03: _XReadPad[/usr/local/lib/libX11.so.6 +0x43f04]
#04: _XReadPad[/usr/local/lib/libX11.so.6 +0x43f36]
#05: _XEventsQueued[/usr/local/lib/libX11.so.6 +0x44b51]
#06: XFlush[/usr/local/lib/libX11.so.6 +0x2652a]
#07: gdk_window_process_all_updates[/usr/local/lib/libgdk-x11-2.0.so.0 +0x43a18]
#08: gtk_container_check_resize[/usr/local/lib/libgtk-x11-2.0.so.0 +0xd1081]
#09: gdk_threads_add_timeout_seconds[/usr/local/lib/libgdk-x11-2.0.so.0 +0x204ae]
#10: g_main_context_dispatch[/usr/local/lib/libglib-2.0.so.0 +0x48b94]
#11: g_main_context_acquire[/usr/local/lib/libglib-2.0.so.0 +0x4aba7]
#12: g_main_context_iteration[/usr/local/lib/libglib-2.0.so.0 +0x4ac67]
#13: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x43ced17]
#14: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x43881ff]
#15: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x438858d]
#16: std::atomic<PRThread*>::store(PRThread*, std::memory_order)[/usr/local/lib/firefox/libxul.so +0xda439e]
#17: unsigned long* std::__copy_move<true, true, std::random_access_iterator_tag>::__copy_m<unsigned long>(unsigned long const*, unsigned long const*, unsigned long*)[/usr/local/lib/firefox/libxul.so +0xe0a874]
#18: IPC::Message** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<IPC::Message*>(IPC::Message* const*, IPC::Message* const*, IPC::Message**)[/usr/local/lib/firefox/libxul.so +0x133f145]
#19: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12de517]
#20: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12de4aa]
#21: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12de483]
#22: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x4388282]
#23: XRE_StartupTimelineRecord[/usr/local/lib/firefox/libxul.so +0x52917a1]
#24: XRE_GetBinaryPath[/usr/local/lib/firefox/libxul.so +0x5329d5a]
#25: XRE_GlibInit[/usr/local/lib/firefox/libxul.so +0x532a285]
#26: XRE_main[/usr/local/lib/firefox/libxul.so +0x532a529]
#27: _start[/usr/local/bin/firefox +0x7d2c]
#28: _start[/usr/local/bin/firefox +0x8160]
#29: _start[/usr/local/bin/firefox +0x73b9]
#30: ??? (???:???)
[51531] ###!!! ABORT: X_ShmDetach: BadShmSeg (invalid shared segment parameter); 7 requests ago; id=0x3c000a9
Re-running with MOZ_X_SYNC=1 in the environment may give a more helpful backtrace.: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/toolkit/xre/nsX11ErrorHandler.cpp, line 157
Hit MOZ_CRASH() at /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/memory/mozalloc/mozalloc_abort.cpp:33
Segmentation fault (core dumped)
-------------- next part --------------
% env MOZ_X_SYNC=1 firefox
[51562] WARNING: Last startup was detected as a crash.: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/toolkit/components/startup/nsAppStartup.cpp, line 898
++DOCSHELL 0x81f088000 == 1 [pid = 51562] [id = 1]
++DOMWINDOW == 1 (0x820c96c00) [pid = 51562] [serial = 1] [outer = 0x0]
++DOMWINDOW == 2 (0x81f0a4400) [pid = 51562] [serial = 2] [outer = 0x820c96c00]
++DOCSHELL 0x821aeab00 == 2 [pid = 51562] [id = 2]
++DOMWINDOW == 3 (0x820c96800) [pid = 51562] [serial = 3] [outer = 0x0]
++DOMWINDOW == 4 (0x821b25000) [pid = 51562] [serial = 4] [outer = 0x820c96800]
++DOMWINDOW == 5 (0x821bc4000) [pid = 51562] [serial = 5] [outer = 0x820c96c00]
[51562] WARNING: Hardware Vsync support not yet implemented. Falling back to software timers: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/gfx/thebes/gfxPlatform.cpp, line 2251
++DOCSHELL 0x824e67d00 == 3 [pid = 51562] [id = 3]
++DOMWINDOW == 6 (0x824e46c00) [pid = 51562] [serial = 6] [outer = 0x0]
++DOCSHELL 0x824e68200 == 4 [pid = 51562] [id = 4]
++DOMWINDOW == 7 (0x824e13480) [pid = 51562] [serial = 7] [outer = 0x0]
++DOCSHELL 0x82571af00 == 5 [pid = 51562] [id = 5]
++DOMWINDOW == 8 (0x825734b80) [pid = 51562] [serial = 8] [outer = 0x0]
++DOMWINDOW == 9 (0x825736400) [pid = 51562] [serial = 9] [outer = 0x825734b80]
++DOMWINDOW == 10 (0x825957000) [pid = 51562] [serial = 10] [outer = 0x824e46c00]
++DOMWINDOW == 11 (0x826034f00) [pid = 51562] [serial = 11] [outer = 0x824e13480]
++DOMWINDOW == 12 (0x826035980) [pid = 51562] [serial = 12] [outer = 0x825734b80]
[51562] ###!!! ABORT: X_ShmDetach: BadShmSeg (invalid shared segment parameter); sync; id=0x3e0008c: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/toolkit/xre/nsX11ErrorHandler.cpp, line 157
#01: XRE_FreeAppData[/usr/local/lib/firefox/libxul.so +0x5335748]
#02: _XError[/usr/local/lib/libX11.so.6 +0x461b4]
#03: _XReadPad[/usr/local/lib/libX11.so.6 +0x43f04]
#04: _XReadPad[/usr/local/lib/libX11.so.6 +0x43f36]
#05: _XReply[/usr/local/lib/libX11.so.6 +0x444b8]
#06: XSync[/usr/local/lib/libX11.so.6 +0x4046d]
#07: XSetAfterFunction[/usr/local/lib/libX11.so.6 +0x4060b]
#08: XShmDetach[/usr/local/lib/libXext.so.6 +0x8c1c]
#09: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x4360673]
#10: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x4360492]
#11: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x4360774]
#12: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x43c2be4]
#13: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x43c2e1c]
#14: bool __gnu_cxx::__ops::_Iter_less_val::operator()<CharRange const*, CharRange const>(CharRange const*, CharRange const&) const[/usr/local/lib/firefox/libxul.so +0x4361fbc]
#15: mozilla::layers::HitTestingTreeNode*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::HitTestingTreeNode**>(mozilla::layers::HitTestingTreeNode** const*, mozilla::layers::HitTestingTreeNode** const*[/usr/local/lib/firefox/libxul.so +0x2101c9c]
#16: mozilla::layers::LayerComposite*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::LayerComposite**>(mozilla::layers::LayerComposite** const*, mozilla::layers::LayerComposite** const*, mozilla::layer[/usr/local/lib/firefox/libxul.so +0x218727e]
#17: mozilla::layers::LayerComposite*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::LayerComposite**>(mozilla::layers::LayerComposite** const*, mozilla::layers::LayerComposite** const*, mozilla::layer[/usr/local/lib/firefox/libxul.so +0x218551d]
#18: mozilla::layers::LayerComposite*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::LayerComposite**>(mozilla::layers::LayerComposite** const*, mozilla::layers::LayerComposite** const*, mozilla::layer[/usr/local/lib/firefox/libxul.so +0x218509d]
#19: mozilla::layers::LayerComposite*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::LayerComposite**>(mozilla::layers::LayerComposite** const*, mozilla::layers::LayerComposite** const*, mozilla::layer[/usr/local/lib/firefox/libxul.so +0x2199126]
#20: mozilla::layers::LayerComposite*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::LayerComposite**>(mozilla::layers::LayerComposite** const*, mozilla::layers::LayerComposite** const*, mozilla::layer[/usr/local/lib/firefox/libxul.so +0x2196e8e]
#21: mozilla::layers::LayerComposite*** std::__copy_move_backward<false, true, std::random_access_iterator_tag>::__copy_move_b<mozilla::layers::LayerComposite**>(mozilla::layers::LayerComposite** const*, mozilla::layers::LayerComposite** const*, mozilla::layer[/usr/local/lib/firefox/libxul.so +0x219696e]
#22: mozilla::layers::EditReply* std::__uninitialized_copy<false>::__uninit_copy<mozilla::layers::EditReply*, mozilla::layers::EditReply*>(mozilla::layers::EditReply*, mozilla::layers::EditReply*, mozilla::layers::EditReply*)[/usr/local/lib/firefox/libxul.so +0x21c6b26]
#23: mozilla::layers::EditReply* std::__uninitialized_copy<false>::__uninit_copy<mozilla::layers::EditReply*, mozilla::layers::EditReply*>(mozilla::layers::EditReply*, mozilla::layers::EditReply*, mozilla::layers::EditReply*)[/usr/local/lib/firefox/libxul.so +0x21c60c2]
#24: mozilla::layers::EditReply* std::__uninitialized_copy<false>::__uninit_copy<mozilla::layers::EditReply*, mozilla::layers::EditReply*>(mozilla::layers::EditReply*, mozilla::layers::EditReply*, mozilla::layers::EditReply*)[/usr/local/lib/firefox/libxul.so +0x21c5815]
#25: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12dec5a]
#26: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12dece3]
#27: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12df067]
#28: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12df58d]
#29: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12de517]
#30: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12de4aa]
#31: std::numeric_limits<int>::min()[/usr/local/lib/firefox/libxul.so +0x12de483]
#32: std::move_iterator<int*>::base() const[/usr/local/lib/firefox/libxul.so +0x12fba5e]
#33: std::move_iterator<int*>::base() const[/usr/local/lib/firefox/libxul.so +0x12f6cc1]
#34: _pthread_getprio[/lib/libthr.so.3 +0x8dc4]
#35: ??? (???:???)
[51562] ###!!! ABORT: X_ShmDetach: BadShmSeg (invalid shared segment parameter); sync; id=0x3e0008c: file /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/toolkit/xre/nsX11ErrorHandler.cpp, line 157
Hit MOZ_CRASH() at /export/outbox/build/usr/ports/www/firefox/work/firefox-49.0/memory/mozalloc/mozalloc_abort.cpp:33
Segmentation fault (core dumped)