Debian Bug report logs - #428765
Segfault on page with sound if you return to the page

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon Valiquette <v.simon@ieee.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Segfault on page with sound if you return to the page

Date: Wed, 13 Jun 2007 19:21:38 -0400

Package: iceape-browser
Version: 1.0.9-0etch1
Severity: important

  If you go to this page, leave It and return later to this page, iceape
will reliably crash each time on Etch PPC.

http://www.redgreen.com/index.cfm?app=cart&a=menu

argn=src, argv=files/layout/ifthewomen.wav
argn=loop, argv=false
argn=autostart, argv=true
argn=mastersound, argv=
argn=hidden, argv=true
argn=height, argv=0
argn=width, argv=0
[00000001] main private debug: checking builtin modules
[00000001] main private debug: checking plugin modules
[00000001] main private debug: loading plugins cache file /home/test/.vlc/cache/plugins-0404be.dat
[00000001] main private debug: recursively browsing `modules'
[00000001] main private debug: recursively browsing `/usr/lib/vlc'
[00000001] main private debug: recursively browsing `plugins'
[00000001] main private debug: module bank initialized, found 219 modules
[00000001] main private debug: opening config file /home/test/.vlc/vlcrc
[00000001] main private debug: CPU has capabilities AltiVec FPU
[00000001] main private debug: looking for memcpy module: 2 candidates
[00000001] main private debug: using memcpy module "memcpyaltivec"
[00000283] main playlist debug: waiting for thread completion
[00000283] main playlist debug: thread 853538016 (playlist) created at priority 0 (playlist/playlist.c:184)
[00000284] main private debug: waiting for thread completion
[00000284] main private debug: thread 861926624 (preparser) created at priority 0 (playlist/playlist.c:210)
[00000285] main interface debug: looking for interface module: 1 candidate
[00000285] main interface debug: using interface module "hotkeys"
[00000285] main interface debug: thread 870315232 (interface) created at priority 0 (interface/interface.c:231)
[00000287] main interface debug: looking for interface module: 1 candidate
[00000287] main interface debug: using interface module "screensaver"
[00000287] main interface debug: thread 878703840 (interface) created at priority 0 (interface/interface.c:231)
[00000283] main playlist debug: adding playlist item `http://www.redgreen.com/files/layout/ifthewomen.wav' ( /home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01 )
[00000283] main playlist debug: creating new input thread
[00000289] main input debug: waiting for thread completion
[00000289] main input debug: thread 887092448 (input) created at priority 0 (input/input.c:266)
[00000289] main input debug: `/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01' gives access `' demux `' path `/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01'
[00000289] main input debug: creating demux: access='' demux='' path='/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01'
[00000290] main demuxer debug: looking for access_demux module: 2 candidates
[00000289] main input debug: creating access '' path='/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01'
[00000293] main access debug: looking for access2 module: 5 candidates
[00000293] vcd access debug: trying .cue file: /home/test/.mozilla/default/9ur424uz.cue
[00000293] access_file access debug: opening file `/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01'
[00000293] main access debug: using access2 module "access_file"
[00000299] main private debug: pre-buffering...
[00000299] main private debug: received first data for our buffer
[00000289] main input debug: creating demux: access='' demux='' path='/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01'
[00000300] main demuxer debug: looking for demux2 module: 44 candidates
[00000300] wav demuxer debug: chunk: fcc=`fmt ` size=16
[00000300] wav demuxer debug: format: 0x0001, fourcc: araw, channels: 1, freq: 22050 Hz, bitrate: 21Ko/s, blockalign: 1, bits/samples: 8, extra size: 0
[00000300] wav demuxer debug: found Raw audio audio format
[00000300] wav demuxer debug: chunk: fcc=`data` size=66884
[00000289] main input debug: selecting program id=0
[00000300] main demuxer debug: using demux2 module "wav"
[00000289] main input debug: looking for a subtitle file in /home/test/.mozilla/default/9ur424uz.slt/Cache/
[00000311] main decoder debug: looking for decoder module: 24 candidates
[00000311] araw decoder debug: samplerate:22050Hz channels:1 bits/sample:8
[00000311] main decoder debug: using decoder module "araw"
[00000311] main decoder debug: thread 908068064 (decoder) created at priority 0 (input/decoder.c:159)
[00000289] main input debug: `/home/test/.mozilla/default/9ur424uz.slt/Cache/FC23CC6Dd01'
successfully opened
[00000311] main decoder debug: no aout present, spawning one
[00000330] main audio output debug: looking for audio output module: 4 candidates
[00000330] alsa audio output debug: opening ALSA device `default'
[00000330] main audio output debug: thread 916653280 (aout) created at priority 0 (alsa.c:662)
[00000330] main audio output debug: using audio output module "alsa"
[00000330] main audio output debug: output 'fl32' 22050 Hz Mono frame=1 samples/4 bytes
[00000330] main audio output debug: mixer 'fl32' 22050 Hz Mono frame=1 samples/4 bytes
[00000330] main audio output debug: no need for any filter
[00000330] main audio output debug: looking for audio mixer module: 3 candidates
[00000330] main audio output debug: using audio mixer module "trivial_mixer"
[00000330] main audio output debug: input 'u8  ' 22050 Hz Mono frame=1 samples/1 bytes
[00000330] main audio output debug: filter(s) 'u8  '->'fl32' 22050 Hz->22050 Hz Mono->Mono
[00000333] main private debug: looking for audio filter module: 24 candidates
[00000333] main private debug: using audio filter module "u8tofloat32"
[00000330] main audio output debug: found a filter for the whole conversion
[00000330] main audio output debug: filter(s) 'fl32'->'fl32' 24255 Hz->22050 Hz Mono->Mono
[00000361] main private debug: looking for audio filter module: 24 candidates
[00000361] main private debug: using audio filter module "bandlimited_resampler"
[00000330] main audio output debug: found a filter for the whole conversion
[00000289] main input debug: EOF reached
[00000289] main input debug: waiting decoder fifos to empty
[00000289] main input debug: closing input
[00000300] main demuxer debug: removing module "wav"
[00000293] main access debug: removing module "access_file"
[00000311] main decoder debug: removing module "araw"
[00000311] main decoder debug: thread 908068064 joined (input/decoder.c:191)
[00000311] main decoder debug: killing decoder fourcc `araw', 0 PES in FIFO
[00000333] main private debug: removing module "u8tofloat32"
[00000361] main private debug: removing module "bandlimited_resampler"
[00000330] main audio output debug: thread 916653280 joined (alsa.c:714)
[00000330] main audio output debug: removing module "alsa"
[00000330] main audio output debug: removing module "trivial_mixer"
[00000289] main input debug: thread 887092448 joined (input/input.c:413)
[00000283] main playlist: nothing to play


Seems all good, all fine. Now I type www.debian.org and got those messages:

[00000001] main private debug: removing all interfaces
[00000287] main interface debug: thread 878703840 joined (interface/interface.c:258)
[00000287] main interface debug: removing module "screensaver"
[00000285] main interface debug: thread 870315232 joined (interface/interface.c:258)
[00000285] main interface debug: removing module "hotkeys"
[00000001] main private debug: removing playlist handler
[00000284] main private debug: thread 861926624 joined (playlist/playlist.c:247)
[00000283] main playlist debug: thread 853538016 joined (playlist/playlist.c:248)
[00000283] main playlist: stopping playback
[00000283] main playlist debug: deleting playlist item `http://www.redgreen.com/files/layout/ifthewomen.wav'
[00000001] main private debug: removing all video outputs
[00000001] main private debug: removing all audio outputs
[00000001] main private debug: removing module "memcpyaltivec"
[00000001] main private debug: saving plugins cache file /home/test/.vlc/cache/plugins-0404be.dat


  I have the feeling that the module "memcpyaltivec" should not have
been removed here.  Or at least there is something interesting here.

  So now, if I return back to the previous URL
http://www.redgreen.com/index.cfm?app=cart&a=menu
I get this messages just before Iceape crash, which is exactly the same
as the first lines you get when viewing the page the 1st time.

argn=src, argv=files/layout/ifthewomen.wav
argn=loop, argv=false
argn=autostart, argv=true
argn=mastersound, argv=
argn=hidden, argv=true
argn=height, argv=0
argn=width, argv=0


  My feeling is that too much things got freed, and that Iceape try to
request a ressource that don't exist anymore.

  My guess is that the module "memcpyaltivec" should not have been
removed, and that on the 2nd time you visit a page that makes Iceape
try to use memcpyaltivec, It does even if the module is not loaded anymore.

  Note that even if altivec is a PowerPC thing, this bug might (or not)
also show up on Intel based processor with MMX.  We will get an answer
to this very quickly I guess.

  If I am right, then Iceape probably does the following just before
crashing, and don't have the time to print those last debug messages:

[00000001] main private debug: CPU has capabilities AltiVec FPU
[00000001] main private debug: looking for memcpy module: 2 candidates
[00000001] main private debug: using memcpy module "memcpyaltivec"

Simon Valiquette


-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: powerpc (ppc)
Shell:  /bin/sh linked to /bin/dash
Kernel: Linux 2.6.18-4-powerpc
Locale: LANG=fr_CA, LC_CTYPE=fr_CA (charmap=ISO-8859-1)

Versions of packages iceape-browser depends on:
ii  libatk1.0-0               1.12.4-3       The ATK accessibility toolkit
ii  libc6                     2.3.6.ds1-13   GNU C Library: Shared libraries
ii  libcairo2                 1.2.4-4        The Cairo 2D vector graphics libra
ii  libfontconfig1            2.4.2-1.2      generic font configuration library
ii  libgcc1                   1:4.1.1-21     GCC support library
ii  libglib2.0-0              2.12.4-2       The GLib library of C routines
ii  libgtk2.0-0               2.8.20-7       The GTK+ graphical user interface 
ii  libjpeg62                 6b-13          The Independent JPEG Group's JPEG 
ii  libmyspell3c2             1:3.1-18       MySpell spellchecking library
ii  libpango1.0-0             1.14.8-5       Layout and rendering of internatio
ii  libpng12-0                1.2.15~beta5-1 PNG library - runtime
ii  libstdc++6                4.1.1-21       The GNU Standard C++ Library v3
ii  libx11-6                  2:1.0.3-7      X11 client-side library
ii  libxcursor1               1.1.7-4        X cursor management library
ii  libxext6                  1:1.0.1-2      X11 miscellaneous extension librar
ii  libxfixes3                1:4.0.1-5      X11 miscellaneous 'fixes' extensio
ii  libxft2                   2.1.8.2-8      FreeType-based font drawing librar
ii  libxi6                    1:1.0.1-4      X11 Input extension library
ii  libxinerama1              1:1.0.1-4.1    X11 Xinerama extension library
ii  libxrandr2                2:1.1.0.2-5    X11 RandR extension library
ii  libxrender1               1:0.9.1-3      X Rendering Extension client libra
ii  libxt6                    1:1.0.2-2      X11 toolkit intrinsics library
ii  zlib1g                    1:1.2.3-13     compression library - runtime

Versions of packages iceape-browser recommends:
pn  iceape-gnome-support          <none>     (no description available)

-- no debconf information

Message #10 received at 428765@bugs.debian.org (full text, mbox, reply):

From: Mike Hommey <mh@glandium.org>

To: Simon Valiquette <v.simon@ieee.org>, 428765@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#428765: Segfault on page with sound if you return to the page

Date: Thu, 14 Jun 2007 07:28:16 +0200

reassign 428765 mozilla-plugin-vlc
thanks

On Wed, Jun 13, 2007 at 07:21:38PM -0400, Simon Valiquette <v.simon@ieee.org> wrote:
> Package: iceape-browser
> Version: 1.0.9-0etch1
> Severity: important
> 
>   If you go to this page, leave It and return later to this page, iceape
> will reliably crash each time on Etch PPC.
> 
> http://www.redgreen.com/index.cfm?app=cart&a=menu

Looks like you are using the vlc plugin... and that the problem is
there.

Mike

Message #15 received at 428765@bugs.debian.org (full text, mbox, reply):

From: Simon Valiquette <v.simon@ieee.org>

To: Mike Hommey <mh@glandium.org>

Cc: 428765@bugs.debian.org

Subject: Re: Bug#428765: Segfault on page with sound if you return to the page

Date: Thu, 14 Jun 2007 05:44:57 -0400

Mike Hommey un jour écrivit:
> reassign 428765 mozilla-plugin-vlc
> thanks
> 
> On Wed, Jun 13, 2007 at 07:21:38PM -0400, Simon Valiquette <v.simon@ieee.org> wrote:
>> Package: iceape-browser
>> Version: 1.0.9-0etch1
>> Severity: important
>>
>>   If you go to this page, leave It and return later to this page, iceape
>> will reliably crash each time on Etch PPC.
>>
>> http://www.redgreen.com/index.cfm?app=cart&a=menu
> 
> Looks like you are using the vlc plugin... and that the problem is
> there.
> 

  Yes, you are right.  I uninstalled mozilla-plugin-vlc and iceape 
stopped crashing, even without restarting iceape (It used totem instead).

  So I confirm that It is in fact a mozilla-plugin-vlc bug.


  I checked in case it would be a duplicate of another already reported 
bug, but I didn't find anything obviously the same.  And since my bug 
involve no video (only a .wav), It might be easier to find the problem.

  It could be a duplicate of #405112, but there is no informations on how 
to reproduce It.


  #315979 have many similarities, but It claim that I doesn't crash in 
Mozilla/iceape, only in Firefox.

  I will check if It crash in Firefox as reported in #315979, or if It 
crash as I reported with Iceape (on the second visit).

Simon Valiquette

Message #22 received at 428765@bugs.debian.org (full text, mbox, reply):

From: Simon Valiquette <v.simon@ieee.org>

To: 428765@bugs.debian.org

Subject: Re: Bug#428765: Segfault on page with sound if you return to the page

Date: Wed, 20 Jun 2007 02:37:13 -0400

Simon Valiquette un jour écrivit:
> 
> 
>   #315979 have many similarities, but It claim that I doesn't crash in 
> Mozilla/iceape, only in Firefox.
> 
>   I will check if It crash in Firefox as reported in #315979, or if It 
> crash as I reported with Iceape (on the second visit).
> 

  I just wanted to confirm that mozilla-plugin-vlc crash as I reported 
with both Firefox and Mozilla.  I also tried to reproduce It on an Intel 
PC with Etch (instead of PowerPC), and It still crash almost exactly as 
reported, so It is not a bug specific to PPC as I first thought.

  The only difference I saw than on PPC, is that the memcpy module used 
is not the same (which is obviously normal).  I can send the full output, 
but It is very easy to reproduce this bug.


Simon Valiquette

Message #27 received at 428765-done@bugs.debian.org (full text, mbox, reply):

From: Simon Valiquette <v.simon@ieee.org>

To: 428765-done@bugs.debian.org

Subject: (resolved) segfault of mozilla-plugin-vlc

Date: Wed, 30 Apr 2008 15:25:06 -0400

Package: mozilla-plugin-vlc
Tags: security
Version: 0.8.6-svn20061012.debian-5.1+ecth2

Hello,

  I just wanted to report that the bug I reported was fixed by DSA-1543-1 
(released the 9th of April 2008), so I am closing this bug.  It also 
included a security issue, which is not a big surprise.  Anyway, It is 
fixed now.


Simon Valiquette

Send a report that this bug log contains spam.