Bug#630589: reproducible crash after connecting to a running iceweasel

[Vincent Lefevre]

On 2011-06-15 14:34:43 +0200, Vincent Lefevre wrote:
> Package: iceweasel
> Version: 3.5.19-2
> Severity: important
> 
> To reproduce the crash:
> 1. Run iceweasel.
> 2. Run a second instance on some URL. The URL is opened, but this
>    second instance crashes (making scripts using iceweasel fail to
>    behave correctly).

ypig:~> valgrind --trace-children=yes iceweasel http://localhost/
[...]
==5832== Memcheck, a memory error detector
==5832== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==5832== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
==5832== Command: /usr/lib/iceweasel/firefox-bin http://localhost/
==5832== 
Unable to create nspr log file '~/.mozprofile/nspr.log'
==5832== Invalid read of size 2
==5832==    at 0x51823D0: getenv (getenv.c:84)
==5832==    by 0x1705069F: db_close (cache.c:236)
==5832==    by 0x400E1FB: _dl_fini (dl-fini.c:244)
==5832==    by 0x5182D81: __run_exit_handlers (exit.c:78)
==5832==    by 0x5182DD4: exit (exit.c:100)
==5832==    by 0x516AEB3: (below main) (libc-start.c:260)
==5832==  Address 0x6b16ee8 is not stack'd, malloc'd or (recently) free'd
==5832== 
==5832== 
==5832== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==5832==  Access not within mapped region at address 0x6B16EE8
==5832==    at 0x51823D0: getenv (getenv.c:84)
==5832==    by 0x1705069F: db_close (cache.c:236)
==5832==    by 0x400E1FB: _dl_fini (dl-fini.c:244)
==5832==    by 0x5182D81: __run_exit_handlers (exit.c:78)
==5832==    by 0x5182DD4: exit (exit.c:100)
==5832==    by 0x516AEB3: (below main) (libc-start.c:260)
==5832==  If you believe this happened as a result of a stack
==5832==  overflow in your program's main thread (unlikely but
==5832==  possible), you can try to increase the size of the
==5832==  main thread stack using the --main-stacksize= flag.
==5832==  The main thread stack size used in this run was 8388608.
==5832== 
==5832== HEAP SUMMARY:
==5832==     in use at exit: 0 bytes in 0 blocks
==5832==   total heap usage: 36 allocs, 36 frees, 8,857 bytes allocated
==5832== 
==5832== All heap blocks were freed -- no leaks are possible
==5832== 
==5832== For counts of detected and suppressed errors, rerun with: -v
==5832== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 6 from 6)
zsh: segmentation fault  valgrind --trace-children=yes iceweasel http://localhost/

-- 
Vincent Lefèvre <vincent at vinc17.net> - Web: <http://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Arénaire project (LIP, ENS-Lyon)