144942 - Crash occurs when clicking link at ESPN.com

Status: VERIFIED WORKSFORME

(Camino Graveyard :: Page Layout, defect)

Description

[Chris Petersen]

Build: 0.2.7
Platform: OS X 10.1.4
Expected Results: Link should load in browser 
What I got: App crashs


**********

Date/Time:  2002-05-16 00:47:42 -0700
OS Version: 10.1.4 (Build 5Q125)

Command:    Navigator
PID:        541

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x0492c68c

Thread 0:
 #0   0x043409e8 in 0x43409e8
 #1   0x044d6640 in 0x44d6640
 #2   0x038a45ac in nsPluginInstanceOwner::Notify(nsITimer *)
 #3   0x00231ac0 in nsTimerImpl::Fire(void)
 #4   0x00231bfc in handleTimerEvent(TimerEventType *)
 #5   0x0022cd74 in PL_HandleEvent
 #6   0x0022cc5c in PL_ProcessPendingEvents
 #7   0x0022dc24 in nsEventQueueImpl::ProcessPendingEvents(void)
 #8   0x02835d98 in -[EventQueueHandler eventTimer:]
 #9   0x708d06e8 in __NSFireTimer
 #10  0x70196cd0 in __CFRunLoopDoTimer
 #11  0x7017c258 in __CFRunLoopRun
 #12  0x701b7100 in CFRunLoopRunSpecific
 #13  0x7017b8e0 in CFRunLoopRunInMode
 #14  0x7312d8f4 in RunEventLoopInModeUntilEventArrives
 #15  0x73140794 in ReceiveNextEventCommon
 #16  0x731715ec in BlockUntilNextEventMatchingListInMode
 #17  0x70bd70b8 in _DPSNextEvent
 #18  0x70bfe5d8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
 #19  0x70c23468 in -[NSApplication run]
 #20  0x70c91ed0 in NSApplicationMain
 #21  0x0000214c in _start
 #22  0x00001f7c in start

Thread 1:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body
 #5   0x90010008 in 0x90010008

Thread 2:
 #0   0x700252fc in select
 #1   0x0015b758 in poll
 #2   0x00157e70 in _pr_poll_with_poll
 #3   0x0228630c in nsSocketTransportService::Run(void)
 #4   0x0022f7e4 in nsThread::Main(void *)
 #5   0x0015932c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 3:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00154418 in PR_WaitCondVar
 #3   0x022904a0 in nsDNSService::DequeuePendingQ(void)
 #4   0x0228fea8 in nsDNSService::Run(void)
 #5   0x0022f7e4 in nsThread::Main(void *)
 #6   0x0015932c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 4:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x001541b4 in pt_TimedWait
 #4   0x0015442c in PR_WaitCondVar
 #5   0x0023326c in TimerThread::Run(void)
 #6   0x0022f7e4 in nsThread::Main(void *)
 #7   0x0015932c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00154418 in PR_WaitCondVar
 #3   0x00230904 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x00231258 in nsThreadPoolRunnable::Run(void)
 #5   0x0022f7e4 in nsThread::Main(void *)
 #6   0x0015932c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 6:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7086c34c in -[NSConditionLock lockWhenCondition:]
 #3   0x70ba1358 in -[NSUIHeartBeat _heartBeatThread:]
 #4   0x70842358 in forkThreadForFunction
 #5   0x7002054c in _pthread_body


PPC Thread State:
  srr0: 0x043409e8 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x2000001c   lr: 0x0439d918  ctr: 0x043409e0   mq: 0x00000000
    r0: 0x043409e0   r1: 0xbfffea40   r2: 0x03ebe3ba   r3: 0x044dc304
    r4: 0xbfffeac8   r5: 0xbfffeae8   r6: 0x0000021b   r7: 0x0000011e
    r8: 0x000000ff   r9: 0x04191a3c  r10: 0x00000000  r11: 0x72138171
   r12: 0x0492c68c  r13: 0x00000000  r14: 0x00000033  r15: 0x0007aa60
   r16: 0x0007aa90  r17: 0xbfffee90  r18: 0x0007aa90  r19: 0x00003407
   r20: 0x00000000  r21: 0x0000001c  r22: 0x70004234  r23: 0x700042c8
   r24: 0x00000004  r25: 0x000003a4  r26: 0x70002d84  r27: 0x70002e10
   r28: 0x00000000  r29: 0xbfffef00  r30: 0x00000000  r31: 0x00000001

**********

Comment 1

[Chris Petersen]

Steps to reproduce:

1) Go to url
2) Click on "scores" located beneath the MLB title.
3) As current page is about be exited, the application crashes.

Tested with Shockwave Flash 6.0 r29

Comment 2

[Tom]

Build 0.2.8 produces the same results with the MLB scores page on 
espn.com.

Steps:

1) <a HREF="www.espn.com">Go to espn.com's main page.</a> Click 
on "Scores" under "MLB" in the left hand column.

2) Instead of going to the live scores page, the browser will completely 
bomb and produce the following dump.


Date/Time:  2002-05-28 22:19:13 -0500
OS Version: 10.1.4 (Build 5Q125)
Host:       localhost

Command:    Navigator
PID:        324

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x05452d4c

Thread 0 Crashed:
 #0   0x05452d4c in 0x5452d4c
 #1   0x056e1930 in 0x56e1930
 #2   0x02c8cff0 in nsPluginInstanceOwner::Notify(nsITimer *)
 #3   0x00234b3c in nsTimerImpl::Fire(void)
 #4   0x00234c98 in handleTimerEvent(TimerEventType *)
 #5   0x0022fdc0 in PL_HandleEvent
 #6   0x0022fca8 in PL_ProcessPendingEvents
 #7   0x00230c70 in nsEventQueueImpl::ProcessPendingEvents(void)
 #8   0x03c79d90 in -[EventQueueHandler eventTimer:]
 #9   0x708d06e8 in __NSFireTimer
 #10  0x70196cd0 in __CFRunLoopDoTimer
 #11  0x7017c258 in __CFRunLoopRun
 #12  0x701b7100 in CFRunLoopRunSpecific
 #13  0x7017b8e0 in CFRunLoopRunInMode
 #14  0x7312d8f4 in RunEventLoopInModeUntilEventArrives
 #15  0x73140794 in ReceiveNextEventCommon
 #16  0x731715ec in BlockUntilNextEventMatchingListInMode
 #17  0x70bd70b8 in _DPSNextEvent
 #18  0x70bfe5d8 in -[NSApplication 
nextEventMatchingMask:untilDate:inMode:dequeue:]
 #19  0x70c23468 in -[NSApplication run]
 #20  0x70c91ed0 in NSApplicationMain
 #21  0x0000249c in _start
 #22  0x000022cc in start

Thread 1:
 #0   0x700252fc in select
 #1   0x0015f758 in poll
 #2   0x0015be70 in _pr_poll_with_poll
 #3   0x03452264 in nsSocketTransportService::Run(void)
 #4   0x00232830 in nsThread::Main(void *)
 #5   0x0015d32c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00158418 in PR_WaitCondVar
 #3   0x0345c5c4 in nsDNSService::DequeuePendingQ(void)
 #4   0x0345bfcc in nsDNSService::Run(void)
 #5   0x00232830 in nsThread::Main(void *)
 #6   0x0015d32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x001581b4 in pt_TimedWait
 #4   0x0015842c in PR_WaitCondVar
 #5   0x002362c0 in TimerThread::Run(void)
 #6   0x00232830 in nsThread::Main(void *)
 #7   0x0015d32c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00158418 in PR_WaitCondVar
 #3   0x00233960 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x002342d4 in nsThreadPoolRunnable::Run(void)
 #5   0x00232830 in nsThread::Main(void *)
 #6   0x0015d32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7086c34c in -[NSConditionLock lockWhenCondition:]
 #3   0x70ba1358 in -[NSUIHeartBeat _heartBeatThread:]
 #4   0x70842358 in forkThreadForFunction
 #5   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x7017bf98 in __CFRunLoopRun
 #3   0x701b7100 in CFRunLoopRunSpecific
 #4   0x7017b8e0 in CFRunLoopRunInMode
 #5   0x7061be08 in 
XIOAudioDeviceManager::NotificationThread(XIOAudioDeviceManager *)
 #6   0x706141c0 in CAPThread::Entry(CAPThread *)
 #7   0x7002054c in _pthread_body

Thread 7:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

PPC Thread State:
  srr0: 0x05452d4c srr1: 0x4200f030                vrsave: 0x00000000
   xer: 0x2000000d   lr: 0x02f0af48  ctr: 0x05452d4c   mq: 0x00000000
    r0: 0x05452d4c   r1: 0xbfffea20   r2: 0x042c2070   r3: 0x045f6954
    r4: 0xbfffeaa8   r5: 0xbfffeac8   r6: 0x0000021b   r7: 0x0000013a
    r8: 0x000000ff   r9: 0x04eb132c  r10: 0x00000000  r11: 0x7269abcf
   r12: 0x042c2668  r13: 0x00000000  r14: 0x00000000  r15: 0x00000000
   r16: 0x00000001  r17: 0x00000000  r18: 0x00000000  r19: 0x00000000
   r20: 0xbffff118  r21: 0x00000000  r22: 0x00000000  r23: 0x00000000
   r24: 0x00100870  r25: 0x00000001  r26: 0x00000137  r27: 0x10d2bfa4
   r28: 0xbfffeac0  r29: 0x04ea3080  r30: 0xbfffeac8  r31: 0x00234a84

**********

Comment 3

[Mike Pinkerton (not reading bugmail)]

plugin crash -> beard

Comment 4

[Greg K.]

Confirmed using Chimera/20020602.

Comment 5

[saari (gone)]

please test with 0.3, this may be fixed

Comment 6

[Chris Petersen]

Based on the steps provided, I can't reproduce the crash I reported. There are
number painting problems caused by the flash content (when scrolling) but that
is a different issue. Tested under NB 2002-06-10-05 and 0.3.0.

Comment 7

[Sören 'Chucker' Kuklau (gone)]

v wfm