165227 - Flash Content Causes Browser to Crash [@nsHttpChannel::ProcessNormal]

Status: VERIFIED FIXED

(Camino Graveyard :: Plug-ins, defect)

Description

[Thien Pham]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0.1) Gecko/20020828
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0.1) Gecko/20020828

Loading the page from this site causes the brower to crash. I believe it has to
do with the flash plugin because the rest of the page is simple and basic HTML
which doesn't look like it could cause any damage.

Reproducible: Always

Steps to Reproduce:
1.Load Chimera
2.Enter into address: http://www.kungfoolx.com/
3.Crashes Browser

Actual Results:  
Standard crash window. Creates 2 crash logs. One for Navigator another for
SystemUIServer.

Expected Results:  
Should have loaded the page with no browser crash.

Comment 1

[Thien Pham]

Attachment: Navigator Log

Comment 2

[Thien Pham]

Attachment: SystemUIServer log

Comment 3

[Brian Nesse (gone)]

*** Bug 164960 has been marked as a duplicate of this bug. ***

Comment 4

[Brian Nesse (gone)]

This seems to have been introduced recently... more fallout from the 1.0 ->
1.0.1 change? Seems to be Flash related, but no plugin code in the stack...

Comment 5

[Chris Petersen]

FWIW, after loading this url in latest mozilla build, I got the spinning color
cursor of death. Can't use the app at this point. If you take a look at the url
in MS IE 5.2, the leafs are animating in flash object without the same problem.
Tested under 10.2.

Comment 6

[sairuh (rarely reading bugmail)]

also crashes on 10.1.5 (and 10.2 for chris) when visiting the Apple quicktime
movie trailer page (http://www.apple.com/trailers/) and the Fox page
(http://fox.com).

i'll see if this occurs with builds from 8/24 and 8/23.

Comment 7

[sairuh (rarely reading bugmail)]

interesting --when i test using http://www.apple.com/trailers/ it crashes with
today's build, but not with y'day's (2002.08.27.05). kinda strange, since pink
saw the same crash y'day (but at http://fox.com/).

Comment 8

[sairuh (rarely reading bugmail)]

i also see the spinning color wheel of death when loading kungfoolx.com.

i also got the spinning color wheel of death (hang) when loading the following
two urls in two tabs with y'day's build --would that be this bug or another? let
me know if i should spin this off separately...

http://www.apple.com/trailers/disney/spirited_away.html
http://www.spiritedaway.net

Comment 9

[Chris Petersen]

Attachment: Reduced testcase from Apple's QT trailer site

Comment 10

[sairuh (rarely reading bugmail)]

Attachment: Sampler log of hang when QT is loading

pls let me know if this hang is the same as this bug, or if it should be filed
seperately. here's how i generated the Sampler report:

1. visited http://www.apple.com/trailers/disney/spirited_away.html
2. clicked on the QT image to start loading the movie trailer.
3. when i got the spinning color wheel of doom (hung chimera), i ran Sampler
for about 5sec (attached).

note: once the trailer finished loading, the spinning wheel went away and i
regained control over chimera.

Comment 11

[sairuh (rarely reading bugmail)]

unclear if the hang i saw (comment 10) is caused by this bug, so spun off bug
165325 for now.

Comment 12

[Adam Carrington]

This has little to do with the website. Chimera crashes on www.macromedia.com as
well as www.homestarrunner.com and www.joecartoon.com.

Comment 13

[Simon Fraser [no longer active]]

My debug build does not crash, but an opt build on my machine does.

Comment 14

[Chris Petersen]

*** Bug 164989 has been marked as a duplicate of this bug. ***

Comment 15

[Chris Petersen]

*** Bug 165224 has been marked as a duplicate of this bug. ***

Comment 16

[Chris Petersen]

*** Bug 165291 has been marked as a duplicate of this bug. ***

Comment 17

[Chris Petersen]

*** Bug 165316 has been marked as a duplicate of this bug. ***

Comment 18

[Simon Fraser [no longer active]]

This is happening because of the "leak" fix in bug 164276. The 'delete listener' has been 
removed on the trunk.

Comment 19

[Simon Fraser [no longer active]]

Attachment: Remove the 'delete listener' call that was wrongly transferred from the trunk

Comment 20

[Simon Fraser [no longer active]]

Taking

Comment 21

[Simon Fraser [no longer active]]

Fix checked in, r=bryner

Comment 22

[Simon Fraser [no longer active]]

Fixed.

Comment 23

[Chris Petersen]

Verified in the 2002-08-29-05 NB. There is a different issue when loading the 
http://www.kungfoolx.com/ that causes the spinning color cursor to appear
multiple times. Sarah L mention that is related to 151917.