Bug 2129

Summary: X Server crashes on long URI text in Firefox
Product: xorg Reporter: Stef Walter <stefw>
Component: Server/GeneralAssignee: Xorg Project Team <xorg-team>
Status: RESOLVED FIXED QA Contact:
Severity: critical    
Priority: high CC: ajax, erik.andren
Version: 6.8.1Keywords: want-backtrace
Hardware: Other   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Stef Walter 2004-12-21 09:23:30 UTC
The URL referred to below: 
http://bugzilla.gnome.org/buglist.cgi?bug_id=158454,161236,161237,161238,161239,161240,161241,161242,161243,161244,161245,161246,161247,161248,161249,161250,161251,161252,161253,161254,161255,161256,161257,161258,161259,161260,161261,161262,161263,161264,161265,161266,161267,161268,161269,161270,161271,161272,161273,161274,161275,161276,161277,161278,161279,161280,161281,161282,161283,161284,161285,161286,161287,161288,161289,161290,161291,161292,161293,161294,161295,161296,161297,161298,161299,161300,161301,161302,161303,161304,161305,161306,161307,161308,161309,161310,161311,161312,161313,161314,161315,161316,161317,161318,161319,161320,161321,161322,161323,161324,161325,161326,161327,161328,161329,161330,161331,161332,161333,161334,161335,161336,161337,161338,161339,161340,161341,161342,161343,161344,161345,161346,161347,161348,161349,161350,161351,161352,161353,161354,161355,161356,161357,161358,161359,161360,161361,161362,161363,161364,161365,161366,161367,161368,161369,161370,161371,161372,161373,161374,161375,161376,161377,161378,161379,161380,161381,161382,161383,161384,161385,161386,161387,161388,161390,161391,161392,161393,161394,161395,161396,161397,161398,161399,161400,161401,161402,161403,161404,161405,161406,161407,161408,161409,161410,161411,161412,161413,161414,161415,161416,161417,161418,161419,161420,161421,161422,161423,161424,161425,161426,161427,161428,161429,161430,161431,161432,161433,161434,161435,161436,161437,161439,161440,161441,161442,161443,161444,161445,161446,161447,161448,161449,161450,161451,161452,161453,161454,161455,161456,161457,161458,161459,161460,161461,161462,161463,161464,161465,161466,161467,161468,161469,161470,161471,161472,161473,161474,161475,161476,161477,161478,161479,161480,161481,161482,161483,161484,161485,161486,161487,161488,161489,161490,161491,161492,161493,161494,161495,161496,161497,161498,161499,161500,161501,161502,161503,161504,161505,161506,161507,161508,161509,161510,161512,161513,161514,161515,161516,161517,161518,161519,161520,161521,161522,161523,161524,161525,161526,161527,161528,161529,161530,161531,161532,161533,161534,161535,161536,161537,161538,161539,161540,161541,161542,161543,161544,161545,161546,161547,161548,161549,161550,161551,161552,161553,161554,161555,161556,161557,161558,161559,161560,161561,161562,161563,161564,161565,161566,161567,161568,161569,161570,161571,161572,161573,161574,161575,161576,161577,161578,161579,161580,161581,161582,161583,161584,161585,161586,161587,161588,161589,161590,161591,161592,161593,161594,161595,161596,161597,161598,161600,161601,161602,161603,161604,161605,161606,161607,161608,161609,161610,161611,161612,161613,161614,161615,161616,161617,161618,161619,161620,161621,161622,161623,161624,161625,161626,161627,161628,161629,161630,161631,161632,161633,161634,161635,161636,161637,161638,161639,161640,161641,161642,161643,161644,161645,161646,161647,161648,161649,161650,161651,161652,161653,161654,161655,161656,161657,161658,161659,161660,161661,161662,161663,161664,161665,161666,161667,161668,161669,161670,161671,161672,161673,161674,161675,161676,161677,161678,161679,161680,161681,161682,161683,161684,161685,161686,161687,161688,161689,161690,161691,161692,161693,161694,161695,161696,161697,161698,161699,161700,161701,161702,161703,161704,161705,161706,161707,161708,161709,161710,161711,161712,161713,161714,161715,161716,161717,161718,161719,161720,161721,161722,161723,161724,161725,161726,161727,161728,161729,161730,161731,161732,161733,161734,161735,161736,161737,161738,161739,161740,161741,161742,161743,161744,161745,161746,161747,161748,161749,161750,161751,161752,161753,161754,161755,161756,161757,161758,161759,161760,161761,161762,161763,161764,161765,161766,161767,161768,161769,161770,161771,161772,161773,161774,161775,161776,161777,161778,161779,161780,161781,161782,161783,161784,161785,161786,161787,161788,161789,161790,161791,161792,161793,161794,161795,161796,161797,161798,161799,161800,161801,161802,161803,161804,161805,161806,161807,161808,161809,161810,161811,161812,161813,161814,161815,161816,161817,161818,161819,161820,161821,161822,161823,161824,161825,161826,161827,161828,161829,161830,161831,161832,161833,161834,161835,161836,161837,161838,161839,161840,161841,161842,161843,161844,161845,161846,161847,161848,161849,161850,161851,161852,161853,161854,161856,161857,161858,161859,161860,161861,161862,161863,161864,161865,161866,161867,161868,161869,161870,161871,161872,161873,161874,161875,161876,161877,161878,161879,161880,161881,161882,161883,161884,161885,161886,161887,161888,161889,161890,161891,161892,161893,161894,161895,161896,161897,161898,161899,161900,161901,161902, 
 
1. Paste the above URL into the Firefox address bar. 
2. The X server may crash immediately, but if not ... 
3. Move your mouse over the address bar and hold the mouse button down. 
4. Drag to the left.  
5. Repeat above if necessary, to the right and to the left. 
6. X Server crash. 
7. X Login prompt shows up. 
 
Specifics: 
Fedora Core 3 
X.org: xorg-x11-6.8.1-12.FC3.21 
Linux: kernel-2.6.9-1.681_FC3 
Firefox: firefox-1.0-2.fc3 
 
Note that this build of firefox is built with GTK2 support.  
 
As a side note, I had to submit this using konqueror. Even the presence of the 
above URI in a text box (and scrolling the scrollbar) would cause the crash. 
This occurred both in epiphany (mozilla based) and firefox.
Comment 1 Niels 2005-01-27 19:10:52 UTC
I tried this in my Firefox, but it didn't crash. The text, however, became 
almost black, overwriting itself many times. 
 
But I have a similar problem: Long lines of text in various KDE applications 
crash Xorg. It's _quite_ reproducible. The "nv" driver doesn't crash in the 
same situations. 
 
More information about my problem here: 
http://forums.gentoo.org/viewtopic.php?t=282107 
Comment 2 Niels 2005-01-27 19:18:40 UTC
I played some more with the long link in Firefox, and suddenly it locked up  
the CPU. It went to 100%, completely blocking the machine. It didn't crash for  
several minutes, and then I ctrl-alt-backspace'ed it. 
Comment 3 Adam Jackson 2005-07-03 14:49:14 UTC
starting with the 6.8.99.14 snapshot, on linux systems, the X server can print
its own backtrace when it crashes.  please confirm that these bugs are still
valid with 6.8.99.14 or later, and if they are please attach a the server log
from the crash.
Comment 4 Niels 2005-07-22 21:09:30 UTC
I'm not sure I can do that backtrace, but I'll certainly give it a try when I 
get around to updating. 
 
I've just found another way of crashing X with Firefox. I loaded this 
extension: "View Rendered Source (Firefox Extension) Version 1.0.01". When I 
try to use it, X resets instantly. 
 
Comment 5 Ed Martin 2005-12-07 14:49:07 UTC
i to have experencied this problem, and have found it very very reproducible, i
was writing a php script that made very long urls (over 2KB) and when firefox
reached it crashes almost instantly (if not just try again, quit firefox again
and try it, i get about a 75% crash rate)

i was also able to get a backtrace, but i do not have debuging info in my X
server so it dosen't look useful (you want it, i can get it again, its too easy
to trigger, but it just didn't look very useful, there were about 5 function
names and a bunch of address)

my Stuff is
Slackware 10.2
Gware Rev E. (Gname 2.12.0)
X 6.8.2
Firefox 1.0.7


if i need to try with a newer version or something, i can if it cannot be reproduced

the php script used to trigger the error is below, if any develooper does not
have a server to test this with, just contact me and i will set it up

---Begin PHP --
<?php
session_start();


//store thr current stuff
$new_stuff = serialize(array($_REQUEST, $_SERVER));
$new_stuff = base64_encode($new_stuff);

if($_GET['start']) {
	$_SESSION['hello_world']=1;
	?><script language="javascript">
		location.href="test-here.php?count=1";
	</script><?
} else {
	if($_SESSION['hello_world']) {
		//$_GET['count'] = $_GET['count'] + 1;
		?><script language="javascript">
		location.href="test-here.php?count=<? echo $_GET['count']+1; echo
"&kh=$new_stuff" ?>";
	</script><?
	} else {
		echo "Session stopped after ".$_GET['count']." reloads!";
	}
}

?><br /><form method="POST" action="<? echo $_SERVER['php_self'];
?>?start=1"><input type="submit" value="Start Counter Again"></form>


---End PHP --
Comment 6 Erik Andren 2006-04-22 18:23:59 UTC
I could not reproduce this problem using firefox 1.5.0.2.
Is someone still able to reproduce this problem using a current version of xorg?
Comment 7 Stef Walter 2006-05-18 12:59:52 UTC
No crash for me now. Some display artifacts, but no crash. 
Comment 8 Cameron Braid 2006-06-18 07:29:09 UTC
Lots of people, including myself, are finding that X crashes when using eclipse
when long strings are rendered.

https://bugs.eclipse.org/bugs/show_bug.cgi?id=87299
Comment 9 Hank 2006-09-09 22:28:57 UTC
(In reply to comment #8)
> Lots of people, including myself, are finding that X crashes when using eclipse
> when long strings are rendered.
> 
> https://bugs.eclipse.org/bugs/show_bug.cgi?id=87299

I cannot reproduce the effect with the submitted URL.  However, this URL on MY
SITE crashes X every time, but only in Firefox 1.5.0.6 (32 bit).
http://comptune.com/calc.php?methos=POST&base1=10&base2=10&S1=50&S2=3553&func=bcpow&base3=10&places=500

# sysinfo by Henry Kroll III, www.thenerdshow.com

cat ~/bin/sysinfo &&cat /proc/cpuinfo|grep "model name"|cut -d : -f 2
&&glxinfo|grep OpenGL|tail -n 3|head -n 2|cut -d : -f 2 &&echo " `uname -ri`"&&echo

 AMD Athlon(tm) 64 Processor 2800+
 GeForce 6800/AGP/SSE2
 2.0.2 NVIDIA 87.74
 2.6.17-1.2174_FC5 x86_64

X Window System Version 7.1.1
Release Date: 12 May 2006
X Protocol Version 11, Revision 0, Release 7.1.1
Build Operating System: Linux 2.6.9-34.ELsmp x86_64 Red Hat, Inc.
Current Operating System: Linux localhost.localdomain 2.6.17-1.2174_FC5 #1 SMP
Tue Aug 8 15:30:44 EDT 2006 x86_64
Build Date: 07 August 2006
        Before reporting problems, check http://wiki.x.org
        to make sure that you have the latest version.
Module Loader present
Comment 10 Lonni J Friedman 2006-10-16 13:25:05 UTC
This bug is likely fixed in the 1.0-9625 driver (released last month):
http://www.nzone.com/object/nzone_downloads_rel70betadriver.html

Can someone who has reported it here confirm?
Comment 11 Aaron Plattner 2007-05-03 08:59:26 UTC
Ping timeout.  Marking fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.