[Bug 243963] [NEW] *** glibc detected *** ...firefox-3.0/firefox: free(): invalid next size

[Alex Riesen]

Public bug reported:

Binary package hint: firefox

For reasons unknown. Firefox 3 with flash plugin on 64bit system (through nspluginwrapper. But there wasn't much of Flash, AFAIK).
On stderr (from .xsession-errors):


*** glibc detected *** /usr/lib/firefox-3.0/firefox: free(): invalid next size (fast): 0x00007f18b26040f0 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f18c5cb308a]
/lib/libc.so.6(cfree+0x8c)[0x7f18c5cb6c1c]
/usr/lib/xulrunner-1.9/libmozjs.so[0x7f18c5795ccd]
/usr/lib/xulrunner-1.9/libmozjs.so[0x7f18c57557de]
/usr/lib/xulrunner-1.9/libxul.so[0x7f18c4108413]
... (the complete files will be attached)

Complete backtrace (from the core):
(gdb) bt
#0  0x00007f18c694d69b in raise () from /lib/libpthread.so.0
#1  0x00007f18c4104f26 in nsProfileLock::FatalSignalHandler (signo=6) at nsProfileLock.cpp:212
#2  <signal handler called>
#3  0x00007f18c5c71095 in raise () from /lib/libc.so.6
#4  0x00007f18c5c72af0 in abort () from /lib/libc.so.6
#5  0x00007f18c5caba7b in __libc_message () from /lib/libc.so.6
#6  0x00007f18c5cb308a in _int_free () from /lib/libc.so.6
#7  0x00007f18c5cb6c1c in free () from /lib/libc.so.6
#8  0x00007f18c5795ccd in js_FinalizeStringRT (rt=0x738ec0, str=0x7f18b08737e0, type=6, cx=0x0) at jsstr.c:2652
#9  0x00007f18c57557de in js_GC (cx=0xb73cd0, gckind=GC_NORMAL) at jsgc.c:3341
#10 0x00007f18c4108413 in nsXPConnect::Collect (this=0x766740) at nsXPConnect.cpp:529
#11 0x00007f18c48a1740 in nsCycleCollector::Collect (this=0x7f18c6c1b010, aTryCollections=1) at nsCycleCollector.cpp:2250
#12 0x00007f18c4497067 in nsJSContext::CC () at nsJSEnvironment.cpp:3346
#13 0x00007f18c4497120 in nsJSContext::MaybeCC (aHigherProbability=1) at nsJSEnvironment.cpp:3397
#14 0x00007f18c4497293 in nsJSContext::Notify (this=0x7f18b096f210, timer=<value optimized out>) at nsJSEnvironment.cpp:3438
#15 0x00007f18c4899c75 in nsTimerImpl::Fire (this=0x7f18b2f2bb10) at nsTimerImpl.cpp:403
#16 0x00007f18c489a118 in nsTimerEvent::Run (this=<value optimized out>) at nsTimerImpl.cpp:490
#17 0x00007f18c4897db2 in nsThread::ProcessNextEvent (this=0x6a9010, mayWait=1, result=0x7fffced7617c) at nsThread.cpp:510
#18 0x00007f18c486c181 in NS_ProcessNextEvent_P (thread=0xddf, mayWait=1) at nsThreadUtils.cpp:227
#19 0x00007f18c47eea67 in nsBaseAppShell::Run (this=0x828760) at nsBaseAppShell.cpp:170
#20 0x00007f18c4686c93 in nsAppStartup::Run (this=0x87f310) at nsAppStartup.cpp:181
#21 0x00007f18c40ff723 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>) at nsAppRunner.cpp:3170
#22 0x00000000004014f7 in ?? ()
#23 0x00007f18c5c5d1c4 in __libc_start_main () from /lib/libc.so.6
#24 0x00000000004010f9 in ?? ()
#25 0x00007fffced77798 in ?? ()
#26 0x0000000000000000 in ?? ()
(gdb) 

Versions:

firefox:
  Installed: 3.0+nobinonly-0ubuntu0.8.04.1
  Candidate: 3.0+nobinonly-0ubuntu0.8.04.1
  Version table:
 *** 3.0+nobinonly-0ubuntu0.8.04.1 0
        500 http://archive.ubuntu.com hardy-updates/main Packages
        100 /var/lib/dpkg/status
     3.0~b5+nobinonly-0ubuntu3 0
        500 http://archive.ubuntu.com hardy/main Packages

xulrunner-1.9:
  Installed: 1.9+nobinonly-0ubuntu0.8.04.1
  Candidate: 1.9+nobinonly-0ubuntu0.8.04.1
  Version table:
 *** 1.9+nobinonly-0ubuntu0.8.04.1 0
        500 http://archive.ubuntu.com hardy-updates/main Packages
        100 /var/lib/dpkg/status
     1.9~b5+nobinonly-0ubuntu3 0
        500 http://archive.ubuntu.com hardy/main Packages

libc6:
  Installed: 2.7-10ubuntu3
  Candidate: 2.7-10ubuntu3
  Version table:
 *** 2.7-10ubuntu3 0
        500 http://archive.ubuntu.com hardy/main Packages
        100 /var/lib/dpkg/status

** Affects: firefox (Ubuntu)
     Importance: Undecided
         Status: New

-- 
*** glibc detected *** ...firefox-3.0/firefox: free(): invalid next size
https://bugs.launchpad.net/bugs/243963
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to firefox in ubuntu.