The location of the crash suggests that there might be memory corruption, which is going to be fun to debug. The best way to start doing that is to build Firefox with --enable-valgrind --disable- jemalloc, so that you can run it with memcheck. The fact that this issue only occurs when using the Oracle plugin in an area of code completely unrelated to plugins (which works fine when the plugin isn't loaded) would suggest that it is quite likely to be a bug introduced by the Java plugin.
-- You received this bug notification because you are a member of Desktop Packages, which is subscribed to firefox in Ubuntu. https://bugs.launchpad.net/bugs/1000885 Title: ff crashes on xslt transformation when using oracle java plugin Status in The Mozilla Firefox Browser: New Status in “firefox” package in Ubuntu: New Bug description: Firefox crashes when performing an XSLT transformation when also loading any <applet> stanza when the Oracle java plugin is used. = Environment = * oracle jre 6u31 (*any* oracle/sun java plugin) * Firefox (any version) * Ubuntu 10.04 LTS , 11.04, 11.10 or 12.04 LTS 32-bit * Web page containing xslt reproducer (attached) = Reproducible = 100% (see attachment reproducer) but only with the Oracle Java plugin, not the iced tea plugins in the archive. = Workaround = Use the OpenJDK/IcedTea plugin - this is not a viable option due to the customers application certification. = Further Information = Reproducing on Ubuntu 12.04 LTS 32-bit with Firefox (11.0+build1-0ubuntu4) 1. Download the two JRE's from: http://www.oracle.com/technetwork/java/javase/downloads/index.html 2. Extract both Oracle JRE's: $ bash ./jre-6u31-linux-i586.bin $ tar -xvf jre-7u3-linux-i586.tar.gz $ sudo mv jre1.* /usr/lib/jvm 3. Install the plugins into the alternatives system to switch easily: $ sudo update-alternatives --install /usr/lib/mozilla/plugins/libjavaplugin.so mozilla-javaplugin.so /usr/lib/jvm/jre1.6.0_31/lib/i386/libnpjp2.so 1059 $ sudo update-alternatives --install /usr/lib/mozilla/plugins/libjavaplugin.so mozilla-javaplugin.so /usr/lib/jvm/jre1.7.0_03/lib/i386/libnpjp2.so 1058 4. Unpack the xslt-crash-reproducer.zip $ unzip xslt-crash-reproducer.zip 5. Open Firefox and check "about:plugins", open file:///path/to/test1.html . Repeat with alternating java plugins using alternatives to reconfiure which plugin is active: sudo update-alternatives --config mozilla-javaplugin.so = backtrace = [Thread 0xa38a7b40 (LWP 2384) exited] nsPluginNativeWindowGtk2: call SetWindow with xid=0x3e00291 --DOMWINDOW == 14 (0x811f4368) [serial = 14] [outer = 0x811e7e58] [url = about:blank] Program received signal SIGSEGV, Segmentation fault. 0xb5fd9fbb in AssertActivityIsLegal () at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:167 167 /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp: No such file or directory. (gdb) bt #0 0xb5fd9fbb in AssertActivityIsLegal () at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:167 #1 0xb5fdc8d2 in NS_LogDtor_P (aPtr=0x81405fe0, aType=0xb6a941ab "txInstruction", aInstanceSize=8) at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:1148 #2 0xb5232e0e in txInstruction::~txInstruction (this=0x81405fe0, __in_chrg=<optimized out>) at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/content/xslt/src/xslt/txInstructions.h:64 #3 0xb5237966 in txStartLREElement::~txStartLREElement (this=0x81405fe0, __in_chrg=<optimized out>) at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/content/xslt/src/xslt/txInstructions.h:388 #4 0xb52379a7 in txStartLREElement::~txStartLREElement (this=0x81405fe0, __in_chrg=<optimized out>) at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/content/xslt/src/xslt/txInstructions.h:388 #5 0xb5237187 in nsAutoPtr<txInstruction>::~nsAutoPtr (this=0x81405fc4, __in_chrg=<optimized out>) at ../../../../dist/include/nsAutoPtr.h:105 #6 0xb5232e1c in txInstruction::~txInstruction (this=0x81405fc0, __in_chrg=<optimized out>) To manage notifications about this bug go to: https://bugs.launchpad.net/firefox/+bug/1000885/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
