Closed Bug 262867 Opened 20 years ago Closed 15 years ago

Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]

Categories

(Plugins Graveyard :: RealPlayer (Real), defect)

x86
Linux
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED INVALID

People

(Reporter: clint, Unassigned)

References

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041001 Firefox/0.10.1

The embedded Real player works fine as long as there are no <PARAM> tags, but
crashes as soon as one exists.

Using :     Helix DNA Plugin: RealPlayer G2 Plug-In Compatible version 0.4.0.293
built with gcc 3.2.2 on Jul 30 2004

So, this code works : 
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26 
    CONTROLS="PlayButton"/>
</OBJECT>

And this code causes it to crash:
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26>
<PARAM name="CONTROLS" value="PlayButton"/>
</OBJECT>


Reproducible: Always
Steps to Reproduce:
Put this code in a web page and view the page:
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26>
<PARAM name="CONTROLS" value="PlayButton"/>
</OBJECT>

Actual Results:  
Firefox crashes

Expected Results:  
Well...

Still happens when I use a different profile, so unlikely to be related to the
extensions in my user profile.
Is it RealPlayer here that's crashing, or Firefox? If it's RealPlayer, you'll
probably have better luck logging it in the bug tracker on
player.helixcommunity.org.
I have the same problem:

Real Player 10.5 on Windows XP SP2
Firefox 1.0.3 GB

I uninstalled and reinstalled Real Player, this did not solve it.

I have confirmed Real Player still works in IE with the embedded player.

I uninstalled and reinstalled Firefox, including wiping the profile and creating
a new profile. This also did not solve it.

So the crash is in Firefox and not Real Player.

Steps to reproduce:
1) Navigate to: http://news.bbc.co.uk/

2) Click "Watch BBC News In Video" link to open the popup window with embedded
player.

3) Select Real Player as preferred player.

4) Watch Firefox crash and talkback fire up.

I have used talkback to submit this, incident numbers if you can access such
stuff are:
TB5219019W
TB5209547Y
TB5208502M

I had submitted about 10 more of these prior to my reinstall of Mozilla, I'm
afraid I don't have those incident ID's.
Incident ID: 5219019
Stack Signature	nppl3260.dll + 0x4341 (0x63344341) 4653a8e9
Product ID	Firefox10
Build ID	2005041420
Trigger Time	2005-04-19 22:45:00.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	nppl3260.dll + (00004341)
URL visited	
User Comments	
Since Last Crash	6964 sec
Total Uptime	10300 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
nppl3260.dll + 0x4341 (0x63344341)
nppl3260.dll + 0xb15c (0x6334b15c)
nsPluginHostImpl::InstantiateEmbededPlugin  [c:/builds/tinderbox/Fx-Aviary1.0.1-
l10n/WINNT_5.1_Depend/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp, line 
3437]
nsObjectFrame::InstantiatePlugin  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp, line 1447]
nsObjectFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp, line 1284]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsInlineFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 715]
nsInlineFrame::ReflowFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 530]
nsInlineFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 443]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsBlockFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3748]
nsBlockFrame::DoReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3446]
nsBlockFrame::DoReflowInlineFramesAuto  [c:/builds/tinderbox/Fx-Aviary1.0.1-
l10n/WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3347]
nsBlockFrame::ReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3292]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2456]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
CanvasFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsHTMLFrame.cpp, line 554]
nsBoxToBlockAdaptor::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 884]
nsBoxToBlockAdaptor::DoLayout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 626]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 249]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 904]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6401]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6226]
PL_HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/xpcom/threads/plevent.c, line 674]
0x778b0c24
nsMathMLChar::PaintHorizontally  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/mathml/base/src/nsMathMLChar.cpp, line 2346]
0x52f8558d
Assignee: firefox → nobody
Component: General → Plug-ins
Keywords: crash
Product: Firefox → Core
QA Contact: general → plugins
Summary: Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags → Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]
Version: unspecified → 1.7 Branch
*** Bug 308307 has been marked as a duplicate of this bug. ***
*** Bug 311244 has been marked as a duplicate of this bug. ***
*** Bug 354033 has been marked as a duplicate of this bug. ***
Using: 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003 BonEcho/2.0

The page below has EMBED tags and crashes instantly.
http://www.songsouponsea.com/Promenade/Islands.html

Talkback ID:
TB24093071
(In reply to comment #7)
> Using: 
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003
> BonEcho/2.0
> 
> The page below has EMBED tags and crashes instantly.
> http://www.songsouponsea.com/Promenade/Islands.html
> 
> Talkback ID:
> TB24093071
> 

I'm running Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.9a1) Gecko/20061017 SeaMonkey/1.5a and realplayer 10.5 and this page *doesn't* crash, while I usually can't play any external ram/rm file !
This crash is iu the realplayer itself.
Please reopen if you get this with the latest builds.
Status: UNCONFIRMED → RESOLVED
Closed: 15 years ago
Resolution: --- → INVALID
Component: Plug-ins → RealPlayer (Real)
Product: Core → Plugins
QA Contact: plugins → real-player
Version: 1.7 Branch → unspecified
Version: unspecified → 6.x
Crash Signature: [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]
Product: Plugins → Plugins Graveyard
You need to log in before you can comment on or make changes to this bug.