Closed Bug 307905 Opened 19 years ago Closed 14 years ago

Flash 7 kills Firefox [@ NPSWF32.dll + 0x5b06a]

Categories

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

x86
Windows XP
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: mkohaku, Assigned: msintov)

Details

(Keywords: crash, Whiteboard: [FP 10.1.53.64])

Crash Data

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6 (ax)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6 (ax)

From 7/29/05 to Today (9/10/08) i have been having trouble with Flash killing
Firefox it started off as something that happened ever so often and didnt 
bother me now i see the "Mozilla Quality Feedback Agent -FireFox10" at least 2-3
 times a day

the Incident Ids if they help for 9/10/05 are
TB9214780E
TB9216798E

Reproducible: Always

Steps to Reproduce:
1.http://www.funimation.com OR just about any other Flash site
2.Xp Crash Error comes and and has to close then i get the "Talkback.exe"
feedback agent
3.

Actual Results:  
Error Out

Expected Results:  
run the projected flash site(s)

TB9216798E, TB9214780E, TB9166343Q, TB9165479Y, TB9131544E, TB9131473H,
TB9056063H, TB9011483W, TB9011463Y, TB8941759W, TB8933372Y, TB8932969H,
TB8811738X, TB8350050M, TB8117927X, TB8117137K, TB8034661H, TB8025121Y, TB7928418Y

Screen shot of "Mozilla Quality Feedback Agent" id reports along with date and times
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050910
Firefox/1.4 ID:2005091004

WFM
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20050909 Firefox/1.6a1
ID:2005090916

The Flash crashes that you reported are crashes in the Flash plugin itself and
not Firefox. Please see bug 291427 commment 3. Nevertheless, this WFM.
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → INVALID
Severity: normal → critical
Status: RESOLVED → UNCONFIRMED
Component: General → Plug-ins
Keywords: crash
Product: Firefox → Core
Resolution: INVALID → ---
Summary: Flash kills Firefox → Flash kills Firefox [@ NPSWF32.dll + 0x5b06a]
Version: unspecified → Trunk
Assignee: nobody → msintov
Are you currently seeing the crash with Flash Player 7? Do you still see this
crash with the Flash Player 8 public beta
(http://www.macromedia.com/software/flashplayer/public_beta/)? Does the crash
happen immediately or after you've been on the site for some period of time?
(In reply to comment #4)
> Are you currently seeing the crash with Flash Player 7? Do you still see this
> crash with the Flash Player 8 public beta
> (http://www.macromedia.com/software/flashplayer/public_beta/)? Does the crash
> happen immediately or after you've been on the site for some period of time?

Well the crash happens the second the page loads and tend to avoid the flash
sites  for the above reasons
http://img3.imageshack.us/img3/4676/screenshot0056jm.jpg  is a screen shot of 
the "Error" screen that comes up it about crashes like the old 98 would you get
an error then everything dies and crashes not sure if i got a bad install or
just a faulty plugin

as for my versions i got Slim for the shockwave thing and 7 for the flashplayer
Flash Player 8 has just been released. Please test the released version (8r22)
from here:
http://www.macromedia.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash

Do you still crash with this version?
Well oddly everything is working fine but im willing to bet its the Adblock 0.5
D2 Nightly Build 39 is Part of the problem cause i just done a fresh version of
windows seeing if it was something Windows related and it didnt fix it but i did
notice that now that i have Adblock on here the Flash dont show up but it dont
crash it acts as if Flash dont exist once i uninstall the adblock extention the
flash loads and so far works as expected
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060112 Firefox/1.6a1 ID:2006011216

I'm also getting the same crash, with the same stack signature (happened on http://kraftcanada.com Flash Player 7):

Incident ID: TB13947820
Stack Signature	npswf32.dll + 0x5b06a (0x064fb06a) 04aa077e
Product ID	FirefoxTrunk
Build ID	2006011216
Trigger Time	2006-01-14 07:37:48.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	npswf32.dll + (0005b06a)
URL visited	kraftcanada.com
User Comments	
Since Last Crash	20633 sec
Total Uptime	20633 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
npswf32.dll + 0x5b06a (0x064fb06a)
SwSupport.dll + 0x1256 (0x69001256)
SwSupport.dll + 0x25dd (0x690025dd)
Flash.ocx + 0x94e3c (0x06ac4e3c)
0x56006900

It's worth noting this only happens occasionaly, I'll try to get more TB reports as they occur (might test beta 8 too).

Confirming.
Status: UNCONFIRMED → NEW
Ever confirmed: true
(In reply to comment #8)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060112
> Firefox/1.6a1 ID:2006011216
> 
> I'm also getting the same crash, with the same stack signature (happened on
> http://kraftcanada.com Flash Player 7):

http://kraftcanada.com/magprev/nke/magazine.html?smid=151848

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060114 Firefox/1.6a1
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060114 SeaMonkey/1.5a

Shockwave Flash 7.0 r19

> Flash.ocx + 0x94e3c (0x06ac4e3c)

Flash.ocx is ActiveX, do you have ActiveX enabled in IE, or installed for Firefox?

> It's worth noting this only happens occasionaly, I'll try to get more TB
> reports as they occur (might test beta 8 too).

If it crashes, does it crash instantly? Or could you save the URL loading the flash to notepad or another editor, so you can access it, if it crashes.
 
Do you have Adblock installed?
(In reply to comment #9)
> 
> Flash.ocx is ActiveX, do you have ActiveX enabled in IE, or installed for
> Firefox?

Hmm, I had run an IE tab earlier, although that wasn't the page that had caused the error.
> 
> > It's worth noting this only happens occasionaly, I'll try to get more TB
> > reports as they occur (might test beta 8 too).
> 
> If it crashes, does it crash instantly? Or could you save the URL loading the
> flash to notepad or another editor, so you can access it, if it crashes.

As soon as the flash file for the animation loaded, poof.
> 
> Do you have Adblock installed?

I do, but I don't think any filters exist for that site.

Robin
> 
Please confirm this bug is reproducible with Flash Player 8r22, which you can get here: http://www.macromedia.com/go/getflashplayer

You should install both the Netscape plug-in as well as the ActiveX install.
(In reply to comment #11)
> Please confirm this bug is reproducible with Flash Player 8r22, which you can
> get here: http://www.macromedia.com/go/getflashplayer
> 
> You should install both the Netscape plug-in as well as the ActiveX install.
> 

crashed with "Shockwave Flash 8.5 b246"
Could you please provide the TB for the crash with the Flash Player 8.5 beta? Or, preferably, if you have time to try the latest Flash Player 9 beta and provide the TB for that if you crash, I'd appreciate it: http://labs.adobe.com/technologies/flashplayer9/

Please also provide the version of Firefox you are using and whether you have any special configuration, such as adblock.
There is a known Adblock Plus issue that I couldn't reproduce myself yet: Object Tabs (the option is called "Show tabs on Flash and Java" in Adblock Plus 0.7, see http://adblockplus.mozdev.org/faq_features.html#objecttabs) in conjunction with Mozilla ActiveX Plugin cause Flash to crash. The same problem seems to occur with Adblock as well, and is likely to be the subject of this bug.

My guess so far: Object Tabs make ActiveX discard its security policy and apply to all objects for some reason (this thread has a warning concerning that: http://forums.mozillazine.org/viewtopic.php?t=206213). I think that because Flash is often inserted as an EMBED inside an OBJECT, it is loaded twice here - once as a plugin and once as ActiveX. Somehow this causes the crash. But that's only a guess of course.
QA Contact: general → plugins
I believe I can confirm this bug in TB19431630K

Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

Plugins:
- NPSWF32.dll 9.0.0.296 (dated 4/24/06); ditto for Flash9a.ocx
- npul32.dll 1.0.0.15

Extensions:
- DOM Inspector 1.8.0.4
- Talkback 1.5.0.4
Sorry, that was a hasty cut & paste.  about:plugins is also reporting:

- Java(TM) 2 Platform Standard Edition 5.0 Update 4
- QuickTime Plug-in 5.0.2
I'm sorry, that TB link in comment 15 doesn't work for me.
Adblock Plus 0.7.0.2 implements a workaround for this issue (not inserting anything inside the object tag). Also bug 340852 has been fixed on trunk - it should fix this issue as well.
Wladimir, are you saying THIS bug should be duped to bug 340852 ?
I think so but I can't be sure of course. A new version of the ActiveX Plugin would prove it for sure.
Am seeing this crash on a Windows 98 box running Firefox 2.0.0.4 and Shockwave Flash 9.0 r45. (Both are the current latest releases.)
URL:
http://www.coresecurity.com/download/files/Webinars/PenTestingABCs/ABCsOfPenetrationTesting.htm

TB32889519Y

FIREFOX caused an exception c0000006H in module NPSWF32.DLL at 0167:30132200.
Registers:
EAX=000000d1 CS=0167 EIP=30132200 EFLGS=00010202
EBX=0784b034 SS=016f ESP=0538fc80 EBP=000000d1
ECX=00000030 DS=016f ESI=05c82ffd FS=49e7
EDX=000000d1 ES=016f EDI=0782408d GS=0000
Bytes at CS:EIP:
f3 a5 8b cd 83 e1 03 f3 a4 8b 7b 10 8b 74 24 18 
Stack dump:
07818000 0538fd0c 0538fcbc 00000c00 05c82fed 301311cb 00000000 000000d1 04281798 30130e2f 07799120 05c82fed 000000d1 0538fcbc 0770c000 ffffffff
Unfortunately, we (the Flash Player team) aren't yet able to reproduce the bug with the various instructions listed in this bug.
(In reply to comment #22)
> Unfortunately, we (the Flash Player team) aren't yet able to reproduce the bug
> with the various instructions listed in this bug.
> 


Michelle,

    See if this additional information will help. This looks like the same bug, but the OS here is Linux:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.6) Gecko/20070730
SUSE/2.0.0.6-10.1 Firefox/2.0.0.6
^^^^^^^^^^^^^^^^^

Firefox / Shockwave crashes when trying to open http://www.cafeoflifepikespeak.com/Videos/Licensed%20To%20Pill.swf

(the clip is humorous too)

The file crashes firefox everytime. I can download the file and play it in
konqueror without problems, but even if I rename the file to remove the %20 the
file still crashed firefox. In case the above link is down, See:

http://www.3111skyline.com/Licensed%20To%20Pill.swf

This appears to be a firefox/shockwave issue.  And it does occur when I start firefox in safe mode useing:

     /usr/bin/firefox -safe-mode 

There is no talkback in normal mode, everything (Firefox) just crashes and dissapears without a trace. When running safe mode from the konsole, the following is returned:

/usr/lib/firefox/firefox-bin: symbol lookup error: /opt/gnome/lib/mozilla/plugins/libswfdecmozilla.so: undefined symbol: swfdec_gtk_player_new

So, where does the _new symbol come from and need to be defined??

Which version of the Flash Player are you using? So far we are unable to reproduce this problem on SUSE 10.1 and Ubuntu 7 with recent Flash Player 9 releases.
On openSuSE 10.2

[root Rankin-P35a:/srv/www/htdocs] # rpm -qa | grep flash
flash-player-9.0.48.0-1.1
Unfortunately, the Flash Player supports up to SUSE 10.1 Enterprise, but not openSUSE.
(In reply to comment #26)
> Unfortunately, the Flash Player supports up to SUSE 10.1 Enterprise, but not
> openSUSE.

What type of double-speak is that? Are you saying "I'm passing the buck because Flash Player doesn't support your kind of Linux?" That's not the open source way of doing things. Don't you care if Firefox is crashing on shockwave files? Since when does Mozilla care what version of suse Flashplayer supports before wanting to address an issue with its browser? 

I'm sorry if I took your answer in a way other than it was meant or intended, but quite frankly it is a non-answer and doesn't attempt to address the crash in any way.

Flashplayer works just fine in konqueror.....

Now, is there something else I can provide you with that will help us all learn (Mozilla, Flash Player, the rest of the open source community) why the latest release of firefox is crashing on the shockwave file provided?

For the benefit of the opensource community, the offending files that were causing Firefox to crash on opensuse 10.2 were:

swfdec-tools-0.5.2-0.pm.5
libswfdec-gtk2_0-0.5.2-0.pm.5
swftools-0.8.1-0.pm.2
swfdec-browser-plugin-0.5.2-0.pm.5
libswfdec0-0.5.2-0.pm.5

After removing the files, firefox handles shockwave files just fine using:

flashplayer.xpt
libflashplayer.so

Thank you for your help.
(In reply to comment #28)
Since the offending library is not from Adobe, and since the openSUSE crash is not what this particular bug was originally about, a separate bug should be filed for this issue.
I have a dual-celeron machine with XP SP2, the latest Flash (updated yesterday), the latest Firefox.  Some sites with Flash (probably the ones with embedded Flash) crash Firefox consistently.  Youtube works OK.  The problem is this: the NPSWA32 dll is trying to execute MMX code on this non-MMX machine.  According to Intel, FP exceptions are generated in this situation.  Apparently, one or more are not being handled correctly.  If I run under the debugger, the 1st fault is at xxx55767 byte '0x0F' 'bad instruction'.  NOPing it out brings us to an 'In al, 0F', which is privileged.   

This is annoying.

I can write down more info if someone decides to work on this....
comment 30 is bug 341632

bugs about swfdec are easily found by searching for summary:swfdef ...

note that this bug is very clearly related to the macromedia/adobe flash player plugin for *windows*.

all things considered, i don't think this bug should remain alive, it seems like it's just collecting random noise at this point, the original bug is about flash player plugin 7 and gecko 1.7, we're now post flash 9 and gecko 1.9.

sadly, i can't take that path.
http://crash-stats.mozilla.com/report/list?query_search=signature&query_type=contains&query=0x5b06a&date=&range_value=1&range_unit=weeks&do_query=1&signature=NPSWF32.dll%400x5b06a

All four crashes are from npswf32.dll 	7.0.19.0

Signature	NPSWF32.dll@0x5b06a
UUID	8fc747b5-801e-11dd-980c-001a4bd43e5c
Time	2008-09-11 09:27:23-07
Uptime	9108
Product	Firefox
Version	3.0.1
Build ID	2008070208
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	AuthenticAMD family 6 model 8 stepping 1
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x6ac7000
Comments	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	NPSWF32.dll 	NPSWF32.dll@0x5b06a 	
1 	NPSWF32.dll 	NPSWF32.dll@0x30218 	
2 	NPSWF32.dll 	NPSWF32.dll@0x4bd6f 	
3 	NPSWF32.dll 	NPSWF32.dll@0x5f9da 	
4 	NPSWF32.dll 	NPSWF32.dll@0x5d52d 	
5 	user32.dll 	InternalCallWinProc 	
6 	user32.dll 	UserCallWinProcCheckWow 	
7 	user32.dll 	CallWindowProcAorW 	
8 	user32.dll 	CallWindowProcA 	
9 	xul.dll 	PluginWindowEvent::Run 	mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp:440
10 	xul.dll 	nsThread::ProcessNextEvent 	mozilla/xpcom/threads/nsThread.cpp:510
11 	xul.dll 	nsBaseAppShell::Run 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
12 	nspr4.dll 	PR_GetEnv 	
13 	firefox.exe 	wmain 	mozilla/toolkit/xre/nsWindowsWMain.cpp:87
14 	firefox.exe 	firefox.exe@0x217f 	
15 	kernel32.dll 	BaseProcessStart 	

Signature	NPSWF32.dll@0x5b06a
UUID	c941970f-7da2-11dd-ba3d-001a4bd43ef6
Time	2008-09-08 05:34:18-07
Uptime	2277
Product	Firefox
Version	3.0.1
Build ID	2008070208
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 1 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
Comments	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	NPSWF32.dll 	NPSWF32.dll@0x5b06a 	
1 	NPSWF32.dll 	NPSWF32.dll@0x57c92 	
2 	NPSWF32.dll 	NPSWF32.dll@0x4979f 	
3 	NPSWF32.dll 	NPSWF32.dll@0x50dbe 	
4 	NPSWF32.dll 	NPSWF32.dll@0x60e54 	
5 	xul.dll 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
6 	xul.dll 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393

Signature	NPSWF32.dll@0x5b06a
UUID	96e75399-7f30-11dd-9ae6-001cc45a2c28
Time	2008-09-10 05:04:11-07
Uptime	60
Product	Firefox
Version	3.0
Build ID	2008052906
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 4 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x5a51000
Comments	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	NPSWF32.dll 	NPSWF32.dll@0x5b06a 	
1 	NPSWF32.dll 	NPSWF32.dll@0x30218 	
2 	NPSWF32.dll 	NPSWF32.dll@0x4bd6f 	
3 	NPSWF32.dll 	NPSWF32.dll@0x5f9da 	
4 	NPSWF32.dll 	NPSWF32.dll@0x5d52d 	
5 	user32.dll 	user32.dll@0x8733 	
6 	user32.dll 	user32.dll@0x8815 	
7 	user32.dll 	user32.dll@0x1a012 	
8 	user32.dll 	user32.dll@0x1a997 	
9 	xul.dll 	PluginWindowEvent::Run 	mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp:440
10 	xul.dll 	nsThread::ProcessNextEvent 	mozilla/xpcom/threads/nsThread.cpp:510
11 	xul.dll 	nsBaseAppShell::Run 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
12 	nspr4.dll 	PR_GetEnv 	
13 	firefox.exe 	wmain 	mozilla/toolkit/xre/nsWindowsWMain.cpp:87
14 	firefox.exe 	firefox.exe@0x217f 	
15 	kernel32.dll 	kernel32.dll@0x17066 	

Signature	NPSWF32.dll@0x5b06a
UUID	d656dbd7-7ed1-11dd-83d8-001cc4e2bf68
Time	2008-09-09 17:46:57-07
Uptime	39
Product	Firefox
Version	3.0.1
Build ID	2008070208
OS	Windows NT
OS Version	5.2.3790 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
Comments	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	NPSWF32.dll 	NPSWF32.dll@0x5b06a 	
1 	NPSWF32.dll 	NPSWF32.dll@0x57c92 	
2 	NPSWF32.dll 	NPSWF32.dll@0x4979f 	
3 	NPSWF32.dll 	NPSWF32.dll@0x50dbe 	
4 	NPSWF32.dll 	NPSWF32.dll@0x60e54 	
5 	xul.dll 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
6 	xul.dll 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393

I think the right path is to blacklist flash 7. i'm sure there are security vulnerabilities, and i'm fairly certain both mozilla and adobe would rather users use a less vulnerable plugin.

i think that the later comments about flash block and friends are other unrelated bugs and should be left to other bugs.
Summary: Flash kills Firefox [@ NPSWF32.dll + 0x5b06a] → Flash 7 kills Firefox [@ NPSWF32.dll + 0x5b06a]
(In reply to comment #31)
>
> I think the right path is to blacklist flash 7. i'm sure there are security
> vulnerabilities, and i'm fairly certain both mozilla and adobe would rather
> users use a less vulnerable plugin.
> 
> i think that the later comments about flash block and friends are other
> unrelated bugs and should be left to other bugs.

who does blacklisting?  perhaps even version 8 should be blacklisted?
Wayne, check https://wiki.mozilla.org/Blocklisting how to ask to get something blocklisted.
(In reply to comment #33)
> Wayne, check https://wiki.mozilla.org/Blocklisting how to ask to get something
> blocklisted.

Thanks Henrik. Looks like it's already being considered - but it's a tangled mess in bug 436348
Component: Plug-ins → Flash (Adobe)
Product: Core → Plugins
QA Contact: plugins → adobe-flash
Version: Trunk → unspecified
The Flash Player team supports the latest version 10 and one version back, 9. Please blacklist any older versions to require users to update to the latest secure versions.

Here's our latest build for testing:
http://labs.adobe.com/downloads/flashplayer10.html
UTR in 10.1.53.64. Flash Player now adds several OOM protections.
Status: NEW → RESOLVED
Closed: 19 years ago14 years ago
Resolution: --- → WORKSFORME
Whiteboard: [FP 10.1.53.64]
Target Milestone: --- → Jun 2010
Crash Signature: [@ NPSWF32.dll + 0x5b06a]
Version and milestone values are being reset to defaults as part of product refactoring.
Target Milestone: Jun 2010 → ---
Product: External Software Affecting Firefox → External Software Affecting Firefox Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: