1330610 - Crash in npswf32_24_0_0_194.dll@0x3da43d while opening Webside with Flash content

Status: RESOLVED INCOMPLETE

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[Robert Hartmann]

This bug was filed from the Socorro interface and is 
report bp-22705b40-100c-4d26-8917-ed59a2170112.
=============================================================

0 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x3da43d 	
Ø 1 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x3fd308 	
Ø 2 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x405d71 	
Ø 3 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x40586d 	
Ø 4 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x3fca15 	
Ø 5 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x404712 	
Ø 6 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x3f941a 	
Ø 7 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x3f963f 	
Ø 8 	npswf32_24_0_0_194.dll 	npswf32_24_0_0_194.dll@0x401b89


=======

Name Firefox
Version 50.1.0
Build-ID 20161208153507
Update-Kanal release

NPSWF32_24_0_0_194.dll

User-Agent Mozilla/5.0 (Windows NT 6.3; WOW64; (URL removed)) Gecko/20100101 Firefox/50.0
Betriebssystem Windows_NT 6.3 
(= Windows 8.1)


Installed Adobe Flashplayer Version 24.0.0.194
from https://get.adobe.com/de/flashplayer/


perhaps related to Bug 1323808 - but for npswf32_24_0_0_194.dll and not for npswf32_24_0_0_186.dll like in Bug 1323808

Comment 1

[Marco Castelluccio [:marco]]

Are you able to reproduce the crash consistently? What are the steps to reproduce it?

Comment 2

[Robert Hartmann]

Attachment: Screenshot WinXP_SP3-32bit_ger Oracle_Flash_login_Firefox_50_1_0.jpg

At office PC (Windows 8.1 64bit) I could reproduce the crash 3 times 
(just by trying to open flash based "Oracle EM Express Login" of our DBMS)
after that I hat no other time (tomorrow I try it again - starting Firefox via WinDbg)

At Home PC (Windows XP SP3 32bit, same Firefox version but with NPSWF32_24_0_0_186.dll) I could *not* reproduce it. 
now I install the newer Flashplayer on XP.
The result is that in Firefox Extras->Add-ons->Plugins there is an entry Shockwave Flash 24.0.0.186
with two files listed: NPSWF32_24_0_0_186.dll, NPSWF32_24_0_0_194.dll
With the newer Flash-Plugin on my Win XP I can't reproduce the crash, but
I can't zoom in or out to get the Oracle login dialog complete displayed (see attached screenshot)

Comment 3

[Robert Hartmann]

Attachment: Firefox_50_1_0_Flash_plugin_two_dlls.jpg

Just to show, how two dlls are shown in Add-On view (Firefox, WinXP), what I mentioned in Comment 2 .

Comment 4

[Loic]

It's not normal to have 2 DLLs of Flash plugin.
Can you uninstall Flash by using the Adobe tool:
https://fpdownload.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe

Then reinstall the latest Flash executable for Firefox (NPAPI):
https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player.exe

Comment 5

[Robert Hartmann]

After uninstall and reinstall on WinXP like you say, I could zoom in or better zoom out via Firefox menue Ansicht->Zoom (but *not* with keyboard  "Strg" and "+" better "Strg" and "-"). Login works. So I can't reproduce crash on Win XP or other strange behavior. 

So I test ist tomorrow at office on Win 8.1 (I just have noticed that Microsoft hat published flash related updated for Win 8.1, I'll install it tomorrow at office and have a look what happend than; I don't think that MS update for IE has impact on Firefox...)

Comment 6

[Loic]

Flash update in WU are for the plugin included in Edge.

Comment 7

[Robert Hartmann]

Attachment: WinDbg.exe log: firefox_50.1.0-FlashPlayer_Crash_2017-01-13_0d28_2017-01-13_09-14-46-901.log

Outside of Windbg.exe Scorro-Interface 
bp-052dec55-2d27-4a94-9f58-6a0c02170113
reproducible catch the Flash-Crash.

Starting Firefox from Inside WinDbg.exe 
I got this attachment.

some qote from that:

SYMSRV:  c:\symbols\NPSWF32.pdb\4EB3710233544687A9723893CD5DBC491\NPSWF32.pdb not found
SYMSRV:  http://symbols.mozilla.org/firefox/NPSWF32.pdb/4EB3710233544687A9723893CD5DBC491/NPSWF32.pdb not found
SYMSRV:  C:\Program Files (x86)\Debugging Tools for Windows (x86)\sym\NPSWF32.pdb\4EB3710233544687A9723893CD5DBC491\NPSWF32.pdb not found
SYMSRV:  https://crash-stats.mozilla.com/symbols/NPSWF32.pdb/4EB3710233544687A9723893CD5DBC491/NPSWF32.pdb not found
SYMSRV:  c:\symbols\NPSWF32.pdb\4EB3710233544687A9723893CD5DBC491\NPSWF32.pdb not found
SYMSRV:  http://symbols.mozilla.org/thunderbird/NPSWF32.pdb/4EB3710233544687A9723893CD5DBC491/NPSWF32.pdb not found
SYMSRV:  c:\symbols\NPSWF32.pdb\4EB3710233544687A9723893CD5DBC491\NPSWF32.pdb not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/NPSWF32.pdb/4EB3710233544687A9723893CD5DBC491/NPSWF32.pdb not found
SYMSRV:  c:\symbols\NPSWF32.pdb\4EB3710233544687A9723893CD5DBC491\NPSWF32.pdb not found
DBGHELP: C:\Windows\SYSTEM32\Macromed\Flash\NPSWF32.pdb - file not found
DBGHELP: NPSWF32.pdb - file not found
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_194.dll - 
DBGHELP: NPSWF32_24_0_0_194 - export symbols

[...]

###!!! [Parent][MessageChannel::Call] Error: Channel error: cannot send/recv


###!!! [Parent][MessageChannel::Call] Error: (msgtype=0xBC0007,name=PPluginScriptableObject::Msg_HasMethod) Channel error: cannot send/recv

ModLoad: 6f840000 6f92d000   C:\Windows\SysWOW64\uxtheme.dll

###!!! [Parent][MessageChannel::Call] Error: (msgtype=0xBC000D,name=PPluginScriptableObject::Msg_HasProperty) Channel error: cannot send/recv


###!!! [Parent][MessageChannel::Call] Error: (msgtype=0xBC0007,name=PPluginScriptableObject::Msg_HasMethod) Channel error: cannot send/recv

ModLoad: 757c0000 7593d000   C:\Windows\SysWOW64\combase.dll
ModLoad: 6edc0000 6edda000   C:\Windows\SysWOW64\dwmapi.dll

###!!! [Parent][MessageChannel] Error: (msgtype=0xB80005,name=PPluginInstance::Msg_CreateChildPopupSurrogate) Channel error: cannot send/recv


###!!! [Parent][MessageChannel] Error: (msgtype=0xB80020,name=PPluginInstance::Msg_AsyncSetWindow) Channel error: cannot send/recv

[...]

and memory access error:

         c:\symbols\xul.pdb\9E743A30C47F4D99BE0BB7203EA7D5CA2\xul.pdb
008df21c 6280aea3 USER32!MsgWaitForMultipleObjectsEx+0x163
008df268 6258e235 xul!mozilla::widget::WinUtils::WaitForMessage(
			unsigned long aTimeoutMs = 0xffffffff)+0x3b [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\widget\windows\winutils.cpp @ 746]
008df2a8 628712ea xul!nsAppShell::ProcessNextNativeEvent(
			bool mayWait = true, 
			<Type information missing error> aOther = <Type information missing error>)+0x1ee [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\widget\windows\nsappshell.cpp @ 383]
008df2b8 6258d94b xul!nsBaseAppShell::DoProcessNextNativeEvent(
			bool mayWait = true)+0x22 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\widget\nsbaseappshell.cpp @ 139]
008df2d4 6258e4fe xul!nsBaseAppShell::OnProcessNextEvent(
			class nsIThreadInternal * thr = <Value unavailable error>, 
			bool mayWait = true, 
			<Type information missing error> aThread = <Type information missing error>, 
			<Type information missing error> aErr = <Type information missing error>)+0x148 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\widget\nsbaseappshell.cpp @ 289]
008df36c 6257236f xul!nsThread::ProcessNextEvent(
			bool aMayWait = <Memory access error>, 
			bool * aResult = 0x008df387, 
			<Type information missing error> aRawPtr = <Type information missing error>, 
			class nsAutoTObserverArray<mozilla::NotNull<nsCOMPtr<nsIThreadObserver> >,2> * aArray = <Value unavailable error>, 
			unsigned int aVal = <Value unavailable error>)+0xe6 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\xpcom\threads\nsthread.cpp @ 1050]
008df388 6258d790 xul!NS_ProcessNextEvent(
			class nsIThread * aThread = 0x00000002, 
			bool aMayWait = true, 
			<Type information missing error> aErr = <Type information missing error>)+0x16 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\xpcom\glue\nsthreadutils.cpp @ 290]
008df3ac 6271bd3a xul!mozilla::ipc::MessagePump::Run(
			class base::MessagePump::Delegate * aDelegate = 0xfc5750c0, 
			<Type information missing error> aThread = <Type information missing error>, 
			<Type information missing error> aErr = <Type information missing error>)+0xcb [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\ipc\glue\messagepump.cpp @ 133]
008df3e4 6271bd09 xul!MessageLoop::RunHandler(void)+0x20 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\ipc\chromium\src\base\message_loop.cc @ 226]
008df404 627d6639 xul!MessageLoop::Run(void)+0x19 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\ipc\chromium\src\base\message_loop.cc @ 206]
008df410 627d63b0 xul!nsBaseAppShell::Run(void)+0x32 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\widget\nsbaseappshell.cpp @ 158]
008df41c 627d6368 xul!nsAppShell::Run(void)+0x24 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\widget\windows\nsappshell.cpp @ 262]
008df42c 627e2159 xul!nsAppStartup::Run(void)+0x20 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\toolkit\components\startup\nsappstartup.cpp @ 285]
008df610 626b6d5b xul!XREMain::XRE_mainRun(
			<Type information missing error> aErr = <Type information missing error>, 
			<Type information missing error> aSmartPtr = <Type information missing error>)+0x515 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\toolkit\xre\nsapprunner.cpp @ 4297]
008df63c 626b7139 xul!XREMain::XRE_main(
			int argc = <Value unavailable error>, 
			char ** argv = 0xfc501050, 
			struct nsXREAppData * aAppData = <Value unavailable error>)+0x1aa [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\toolkit\xre\nsapprunner.cpp @ 4424]
008df7a4 01091912 xul!XRE_main(
			int argc = 0n1, 
			char ** argv = 0xfc501050, 
			struct nsXREAppData * aAppData = 0x008df7f0, 
			unsigned int aFlags = 0)+0x39 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\toolkit\xre\nsapprunner.cpp @ 4516]
008dfa3c 01093af7 firefox!do_main(
			int argc = 0n1, 
			char ** argv = 0x00000724, 
			char ** envp = 0xfe4aef10, 
			class nsIFile * xreDirectory = 0xfc506220, 
			char * arg = <Value unavailable error>, 
			<Type information missing error> _Ptr = <Type information missing error>, 
			class nsIFile * aNewValue = 0xfc549110)+0x382 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\browser\app\nsbrowserapp.cpp @ 247]
008dfdc8 010954e9 firefox!wmain(
			int argc = 0n1, 
			wchar_t ** argv = 0x021fdf40, 
			char ** envp = 0xfe4aef10, 
			char * arg = <Value unavailable error>, 
			<Type information missing error> aSymbols = <Type information missing error>)+0x407 [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\toolkit\xre\nswindowswmain.cpp @ 115]
008dfe14 75607c04 firefox!__scrt_common_main_seh(void)+0xff [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 255]
008dfe28 770bab8f KERNEL32!BaseThreadInitThunk+0x24
008dfe70 770bab5a ntdll!__RtlUserThreadStart+0x2f
008dfe80 00000000 ntdll!_RtlUserThreadStart+0x1b

Comment 8

[Robert Hartmann]

Attachment: Screenshot Firefox_50.1.0_Win8.1_64bit_FlashPlugin_NPSWF32_24_0_0_194.dll_Crash.jpg

Screenshot reproducible crash of FlashPlayer on Win 8.1 64 bit

Comment 9

[Loic]

Is the crash reproducible at 100%? If yes, could you manage to build a testcase, maybe a link to a testing server with Oracle EM Express installed (if no public demo exists).

Comment 10

[Robert Hartmann]

Outside of Windbg.exe the crash signatur fetched from Socorro interface changed to 
bp-87b7c2f4-321b-4fd3-9054-199c72170116 
perhaps symbols are now available for the Socorro interface. 

I'll ask our Server and Network Admin, if they create a testinstance with public IP.

Best regards,
Robert

Comment 11

[Marco Castelluccio [:marco]]

(In reply to Robert Hartmann from comment #10)
> Outside of Windbg.exe the crash signatur fetched from Socorro interface
> changed to 
> bp-87b7c2f4-321b-4fd3-9054-199c72170116 
> perhaps symbols are now available for the Socorro interface. 

Yes, symbols are now available (bug 1323808).

Comment 12

[Robert Hartmann]

Our network admins answerd me, that I should give them a defined group of IP-addresses of external developers who want to connect to the server.

Best regards,
Robert

Comment 13

[Marco Castelluccio [:marco]]

I think this is exclusively a Flash crash, so there isn't much we can do. Benjamin, confirm?

Robert, can you open a new bug on https://tracker.adobe.com/ and link it here?

Comment 14

[Benjamin Smedberg]

Yes, this is a Flash crash that we probably can't fix on our side. So I'm going to close this in our tracker and you should file with Adobe. If you have precise and repeatable STR, Adobe would really like to see those: many of the F139 crashes are random and nonrepeateable.