170556 - Particular embedding of flash object in html causes Mozilla to crash. [@ nsTextFrame::ComputeWordFragmentDimensions]

Status: VERIFIED DUPLICATE of bug 170225

(Core Graveyard :: Plug-ins, defect)

Description

[Brian Vancil]

Steps to reproduce:
1. install a recent build (I used 2002092408).
2. install the flash plugin
3. browse the above URL
Expected response: Mozilla loads page and displays flash animation.
Actual response: Mozilla crashes with a "Floating point exception".

I'm sorry if this is a dup, but I couldn't find anything quite like it.  I just
happened upon this page that crashed Mozilla.  So I downloaded transform.html,
which, removed from all media, displayed fine locally.  Next I viewed the flash
animation "xslt.swf" with Mozilla, and it displayed fine.  Both the object and
embed tags were present in the html.

Comment 1

[serge (gone)]

WFM rh7.2, mozilla 2002092408, Flash 5.0 r48
any talkback reports on crashes?

Comment 2

[Brian Vancil]

If I did this wrong, let me know, but I think this is the backtrace:

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 1024 (LWP 13443)]
0x41381583 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
(gdb) bt
#0  0x41381583 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#1  0x41382c27 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#2  0x4135617b in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#3  0x41352a17 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#4  0x413526db in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#5  0x4135255b in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#6  0x4135617b in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#7  0x41352a17 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#8  0x413526db in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#9  0x4135255b in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#10 0x4135617b in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#11 0x4132877c in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#12 0x4132855c in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#13 0x41328367 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#14 0x4132820c in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#15 0x41326c08 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#16 0x413263f6 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#17 0x413251a0 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#18 0x4132c9c2 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#19 0x41327b67 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#20 0x4132685b in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#21 0x413263f6 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#22 0x413251a0 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#23 0x413327bf in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#24 0x41343da6 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#25 0x41405406 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#26 0x41404eea in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#27 0x414022c8 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#28 0x413f8c0c in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#29 0x414022c8 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#30 0x414070c5 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#31 0x41340a66 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#32 0x41340d6f in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#33 0x41340aa7 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#34 0x414022c8 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#35 0x41414012 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#36 0x413400ce in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#37 0x413327bf in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#38 0x41387437 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#39 0x4136673c in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#40 0x41372535 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#41 0x413720c6 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libgklayout.so
#42 0x401681a7 in PL_HandleEvent () from /usr/local/mozilla/mozilla/libxpcom.so
#43 0x401680c3 in PL_ProcessPendingEvents () from
/usr/local/mozilla/mozilla/libxpcom.so
#44 0x40169008 in nsEventQueueImpl::ProcessPendingEvents () from
/usr/local/mozilla/mozilla/libxpcom.so
#45 0x40caf303 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libwidget_gtk.so
#46 0x40caf07d in NSGetModule () from
/usr/local/mozilla/mozilla/components/libwidget_gtk.so
#47 0x403919ca in g_io_add_watch () from /usr/lib/libglib-1.2.so.0
#48 0x40392fa5 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#49 0x403935a9 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#50 0x40393738 in g_main_run () from /usr/lib/libglib-1.2.so.0
#51 0x402af1ef in gtk_main () from /usr/lib/libgtk-1.2.so.0
#52 0x40caf6ec in NSGetModule () from
/usr/local/mozilla/mozilla/components/libwidget_gtk.so
#53 0x40c87696 in NSGetModule () from
/usr/local/mozilla/mozilla/components/libnsappshell.so
#54 0x080514ce in getCountry ()
#55 0x08051ccf in main ()
#56 0x405091c4 in __libc_start_main () from /lib/libc.so.6

Comment 3

[serge (gone)]

well, you do not have to run the release build under debugger, that binary has
no debug info and the stack trace you posted is useless:(
All you have to do is to activate talkback agent from mozilla dir type
./componets/talkback/talkback and check out "Turn Talkback On" radio button,
than after crash, talkback will ask you to submit the report, after you submit
it, check out what is report ID, by ./componets/talkback/talkback, and post that
ID into this bug report.
Thanks.

Comment 4

[Brian Vancil]

Talkback Incident ID: TB11508387Q

Comment 5

[serge (gone)]

Attachment: TB11508387Q

crash in nsTextFrame::ComputeWordFragmentDimensions

Comment 6

[serge (gone)]

Brian, TB report shows you crash w/ mozilla Build ID 2002091016,
are you sure you crash w/ 2002092408 also?

Comment 7

[Andrew Schultz]

I'm crashing with linux trunk build 20020924, but the stack
(nsTextFrame::MeasureText) points at bug 170225, which regressed after 20020910

Comment 8

[Brian Vancil]

The talkback component is not packaged with mozilla-i686-pc-linux-gnu.tar.gz, so
I improvised by installing the talkback xpi from the release build
mozilla-i686-pc-linux-gnu-1.2a-sea.tar.gz.  That's why talkback shows a
different build.  Sorry, I should have mentioned that.

Comment 9

[Andrew Schultz]

marking dupe.  I bet the talkback got confused about the stack

*** This bug has been marked as a duplicate of 170225 ***

Comment 10

[shrirang khanzode]

mass duplicate verifications . For filtering purposes, pls use keywd
"massdupverification"