191547 - Crash with Flash 6 plugin for linux when an XIM server is used

Status: RESOLVED INVALID

(Core Graveyard :: Plug-ins, defect)

Description

[Hideo Oshima]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3b) Gecko/20030131
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3b) Gecko/20030131

If you open the URL, Mozilla crashes.
Flash's version is:
Shockwave Flash 6.0 r69

I don't know this is Mozilla's bug or Flash's.
But crash happens at many pages which uses Flash.


Reproducible: Always

Steps to Reproduce:
1. Open http://www.macromedia.com/
2.
3.

Actual Results:  
Crash.

Expected Results:  
Not crash.

Stach trace.

#0  0x00000000 in ?? ()
#1  0x42189622 in _XimWrite () from /usr/X11R6/lib/X11/locale/common/ximcp.so.2
#2  0x42189939 in _XimFilterWaitEvent ()
   from /usr/X11R6/lib/X11/locale/common/ximcp.so.2
#3  0x42188a79 in _XimThaiCloseIM ()
   from /usr/X11R6/lib/X11/locale/common/ximcp.so.2
#4  0x418a1f27 in XFilterEvent () from /usr/X11R6/lib/libX11.so.6
#5  0x4241cff2 in _XtOnGrabList () from /usr/X11R6/lib/libXt.so.6
#6  0x4241d11a in XtDispatchEvent () from /usr/X11R6/lib/libXt.so.6
#7  0x42427e5c in XtAppProcessEvent () from /usr/X11R6/lib/libXt.so.6
#8  0x423f8df9 in xt_event_dispatch (source_data=0x8f19f68, call_back=0,
    user_data=0x0) at gtk2xtbin.c:158
#9  0x41c520b9 in g_get_current_time () from /usr/lib/libglib-2.0.so.0
#10 0x41c52e5f in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#11 0x41c53233 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#12 0x41c5390f in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#13 0x419cb71f in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#14 0x41822da2 in nsAppShell::Run() (this=0x8128b70) at nsAppShell.cpp:138
#15 0x417c9a4f in nsAppShellService::Run() (this=0x81063c0)
    at nsAppShellService.cpp:479
#16 0x0804e7e1 in main1 (argc=1, argv=0xbffff5d4, nativeApp=0x0)
    at nsAppRunner.cpp:1273
#17 0x0804f280 in main (argc=1, argv=0xbffff5d4) at nsAppRunner.cpp:1636

Comment 1

[Frederic Bezies]

Is this in some way a duplicate of bug 182931 ?

Comment 2

[Hideo Oshima]

Last stack trace is GTK+2 build.
This is stack trace of GTK+1 build.

#0  0x43758a70 in _XimThaiCloseIM ()
   from /usr/X11R6/lib/X11/locale/common/ximcp.so.2
#1  0x40342f27 in XFilterEvent () from /usr/X11R6/lib/libX11.so.6
#2  0x414bfff2 in _XtOnGrabList () from /usr/X11R6/lib/libXt.so.6
#3  0x414c011a in XtDispatchEvent () from /usr/X11R6/lib/libXt.so.6
#4  0x414cae5c in XtAppProcessEvent () from /usr/X11R6/lib/libXt.so.6
#5  0x41231b1f in xt_event_dispatch (source_data=0x0, current_time=0xbffff2e0,
    user_data=0x8cdf0f0) at gtkxtbin.c:123
#6  0x402d24c8 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#7  0x402d2ad3 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#8  0x402d2c6c in g_main_run () from /usr/lib/libglib-1.2.so.0
#9  0x401f37f7 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#10 0x4167a344 in nsAppShell::Run() (this=0x83bd458) at nsAppShell.cpp:346
#11 0x42793a4f in nsAppShellService::Run() (this=0x83bd410)
    at nsAppShellService.cpp:479

Additional information:
Using atokx that is kana-kanji conversion processor causes crash,
bat kinput + canna does not.

Katakai-san do you have any information about this problem?

Comment 3

[Masaki Katakai]

Hi Oshima-san,

Could you tell me your linux distribution?
I'll try.

Actually it causes core dump in XIM of Xlib.

Comment 4

[Hideo Oshima]

My enveironment:
Distro: Debian GNU/Linux sid(unstable)
XFree86 4.2.1-5
Metacity 2.4.21-2
atokx 1.0-1

Comment 5

[Masaki Katakai]

Reproduced on my environment - VineLinux 2.6,
Mozilla dumps core in xim of Xlib.

I'll look into this. Assigned to myself.

(gdb) where
#0  0x4090aff3 in _XimXFilterWaitEvent () from
/usr/X11R6/lib/X11/locale/common/ximcp.so.2
#1  0x4040936a in XFilterEvent () from /usr/X11R6/lib/libX11.so.6
#2  0x40f6377e in _XtOnGrabList () from /usr/X11R6/lib/libXt.so.6
#3  0x40f63ba9 in XtDispatchEvent () from /usr/X11R6/lib/libXt.so.6
#4  0x40f6eef3 in XtAppProcessEvent () from /usr/X11R6/lib/libXt.so.6
#5  0x40f47912 in xt_event_dispatch () from /usr/lib/libgtkxtbin.so
#6  0x403961b5 in g_main_dispatch (dispatch_time=0xbffff29c) at gmain.c:656
#7  0x40396781 in g_main_iterate (block=1, dispatch=1) at gmain.c:877
#8  0x40396921 in g_main_run (loop=0x833f248) at gmain.c:935
#9  0x402aeeac in gtk_main () from /usr/lib/libgtk-1.2.so.0
#10 0x4085476e in nsAppShell::Run () from
/usr/lib/mozilla-1.1/components/libwidget_gtk.so
#11 0x40836008 in nsAppShellService::Run () from
/usr/lib/mozilla-1.1/components/libnsappshell.so
#12 0x080519fd in getCountry () at eval.c:88
#13 0x0805233e in main () at eval.c:88
#14 0x404befff in __libc_start_main (main=0x80521dc <main>, argc=1,
ubp_av=0xbffff4c4, init=0x804c280 <_init>, fini=0x80539c4 <_fini>, 
    rtld_fini=0x4000c420 <_dl_fini>, stack_end=0xbffff4bc) at
../sysdeps/generic/libc-start.c:129

Comment 6

[Hideo Oshima]

Japanese tester reports VJE-Delta 3.0 and Wnn7/xwnmo
also cause crash.
So I don't think this is ATOKX-specific problem.

Reports in Bugzilla-jp are:
http://bugzilla.mozilla.gr.jp/show_bug.cgi?id=2961#c3
http://bugzilla.mozilla.gr.jp/show_bug.cgi?id=2961#c4

Comment 7

[Masaki Katakai]

It seems that the problem is in X lib or flash plugin, not in Mozilla.

I  have verified that Mozilla XIM codes (under widget/src/gtk) does not
cause this problem. I tried Mozilla built without USE_XIM ifdef and
verified the same problem happens, which means the crash happens
when flash calls XIM API.

I need to debug X lib. For flash, I have submitted a bug report to macromedia.

Comment 8

[KENZ (Kenji Irie)]

Flash 6.0.79.0 is released. I tested it with 1.3 branch nightly build.
{Mozilla/5.0 (X11; U; Linux i686; ja-JP; rv:1.3b) Gecko/20030227}

<http://www.macromedia.com/> is modified, then now I don't see crash when visit
there. but this release doesn't seem to fix the problem.
for example, I have crash when visit my ISP web site: <http://www.tiki.ne.jp/>.

Comment 9

[KENZ (Kenji Irie)]

sorry I had 2 mistakes.
forgot to show stack trace.
and builds I tested is 1.3b build with my some testing patch and
1.3 branch nightly build at 2003-03-04-11-1.3.

stack trace:
#0  0x411dbe34 in _XimThaiCloseIM ()
   from /usr/X11R6/lib/X11/locale/common/ximcp.so.2
#1  0x402f1ff3 in XFilterEvent () from /usr/X11R6/lib/libX11.so.6
#2  0x415ab006 in _XtOnGrabList () from /usr/X11R6/lib/libXt.so.6
#3  0x415ab12e in XtDispatchEvent () from /usr/X11R6/lib/libXt.so.6
#4  0x415b5e70 in XtAppProcessEvent () from /usr/X11R6/lib/libXt.so.6
#5  0x411e1b58 in _init () from /home/kenz/mozilla/libgtkxtbin.so
#6  0x402814c8 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#7  0x40281ad3 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#8  0x40281c6c in g_main_run () from /usr/lib/libglib-1.2.so.0
#9  0x401a27f7 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#10 0x4118dbbc in NSGetModule ()
   from /home/kenz/mozilla/components/libwidget_gtk.so
#11 0x41163996 in NSGetModule ()
   from /home/kenz/mozilla/components/libnsappshell.so
#12 0x08057de9 in getCountry ()
#13 0x080584d5 in main ()
#14 0x403e3a51 in __libc_start_main () from /lib/libc.so.6

Comment 10

[Masaki Katakai]

no reply yet from macromedia about this bug...

Comment 11

[Hideo Oshima]

http://www.macromedia.com/ has been changed.
Now mozilla doesn't crash with flash 6.
I will find the page that causes crash.

Comment 12

[Masaki Katakai]

No reply from macromedia.
I have sent bug report again.

Comment 13

[Ervin Yan]

I just heard MIYASHITA Hisashi ([e-mail]) had found the problem in
X11R6, here is his solution:

================================

I've found what cause this problem accurately.  ximcp.so fails to manage
filter registration under a certain conditaion.

Could all of you test the following patch?

--------------------------------------------------------------------------------
Index: imDefIm.c
===================================================================
RCS file: /cvs/xc/lib/X11/imDefIm.c,v
retrieving revision 1.9
diff -c -r1.9 imDefIm.c
*** imDefIm.c   2001/10/28 03:32:34     1.9
--- imDefIm.c   2003/08/22 05:23:14
***************
*** 2074,2079 ****
--- 2074,2080 ----
            _XimRegisterServerFilter(im);
            return True;
        }
+       _XimShutdown(im);
  #ifdef XIM_CONNECTABLE
      } else if (IS_DELAYBINDABLE(im)) {
        if (_XimDelayModeSetAttr(im))

--------------------------------------------------------------------------------

Comment 14

[Hideo Oshima]

Ervin Yan,
Japanese users report the patch seems good.
http://bugzilla.mozilla.gr.jp/show_bug.cgi?id=2961

Thanks for your great work.

Comment 15

[Denis Vlasenko]

Maybe I'm seeing this bug, maybe not.
Mozilla 1.4 started occasionally crashing since I installed
Java and Flash plugins. The easiest example is http://www.nasa.gov/
Upon clicking "skip intro" Moz dies.

Seems like Flash plugin related problem. Moz does not crash with
flash .so module renamed out of the way in the plugins/.

My Flash is:
Flash Player 6 for Linux
Mozilla Plug-in and Standalone players
Update Version 6.0r79
4 March 2003

Comment 16

[Alvin DUAN]

Attachment: testcase

Testcase for this bug;

Comment 17

[Alvin DUAN]

This bug was already fixed on SuSE, so for currently, it only can be reproduced
on RedHat 9 platform. 

Please use the testcase I attached to reproduce this bug on Redhat platform;

Comment 18

[Jay Yan]

A.D

There is no flash file in your attached testcase:-(

Jay

Comment 19

[Jungshik Shin]

This may or may not be the same as bug 209429, but major Linux distro. vendors
updated XFree86 packages with fixes a while ago and that was rel-noted in
Mozilla i18n rel. notes (see bug 211213 comment #13). I'm not sure what to do
when a bug can be 'fixed' by upgrading a third-party library. 

Comment 20

[Olivier Cahagne]

*** Bug 209429 has been marked as a duplicate of this bug. ***

Comment 21

[Andrew Schultz]

> I'm not sure what to do when a bug can be 'fixed' by upgrading a third-party 
> library.

not a Mozilla bug ==> INVALID

Comment 22

[Jungshik Shin]

*** Bug 211340 has been marked as a duplicate of this bug. ***