190007 - reproducible flash crash [@ VarHashTable::HashKey ]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Jamie Zawinski]

Mozilla 1.2
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2) Gecko/20021203
Linux 2.4.9-13smp #1 SMP Tue Oct 30 19:06:50 EST 2001 i686 unknown
Red Hat Linux release 7.2 (Enigma)
Shockwave Flash 6.0 r60


gdb /usr/lib/mozilla-1.2.1/mozilla-bin
...
(gdb) r http://www.divstivs.plus.com/iconwar/
Starting program: /usr/lib/mozilla-1.2.1/mozilla-bin
http://www.divstivs.plus.com/iconwar/
(no debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...[New Thread 1024 (LWP 11358)]
[New Thread 2049 (LWP 11388)]
[New Thread 1026 (LWP 11389)]
[New Thread 2051 (LWP 11390)]
[New Thread 3076 (LWP 11403)]
[New Thread 4101 (LWP 11404)]
[New Thread 5126 (LWP 11413)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 11358)]
0x41df5b0e in VarHashTable::HashKey ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
(gdb) bt
#0  0x41df5b0e in VarHashTable::HashKey ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#1  0x41df58f5 in HashTable::LookupItem ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#2  0x41ebc4aa in FontDirectory::Find ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#3  0x41eb8042 in PlatformEDevice::FindFont ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#4  0x41eb87e9 in PlatformEDevice::CreatePlatformFont ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#5  0x41eb93cd in PlatformEDevice::SetCharFormat ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#6  0x41eb9130 in PlatformECharFormat::SetPlatformCharFormat ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#7  0x41e046ed in ECharFormat::CalcMetrics ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#8  0x41e0cf3c in RichEdit::CalcLineMetrics ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#9  0x41e058a1 in RichEdit::CalcMaxVScrollIndex ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#10 0x41e0e910 in RichEdit::NotifyScroller ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#11 0x41e3c0a9 in SObject::Modify ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#12 0x41e623b0 in CorePlayer::UpdateEditText ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#13 0x41e6233b in UpdateEditTextProc ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#14 0x41df56ec in HashTable::ForEach ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#15 0x41e62460 in CorePlayer::UpdateEditText ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#16 0x41e61b33 in CorePlayer::DoActions ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#17 0x41e52a3c in ScriptPlayer::PushDataComplete ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#18 0x41e46c10 in ScriptPlayer::PushImageData ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#19 0x41e6a46c in CorePlayer::UrlStreamWriteNotify ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#20 0x41e6a437 in CorePlayer::UrlStreamWrite ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#21 0x41e74e34 in URLStream::StreamWrite ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#22 0x41ec4b8a in NPP_Write ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#23 0x41ec2dd4 in Private_Write ()
   from /usr/lib/mozilla-1.2.1/plugins/libflashplayer.so
#24 0x40eb2c47 in ns4xPluginStreamListener::OnDataAvailable ()
   from /usr/lib/mozilla-1.2.1/components/libgkplugin.so
#25 0x40eb8ddb in nsPluginStreamListenerPeer::OnDataAvailable ()
   from /usr/lib/mozilla-1.2.1/components/libgkplugin.so
#26 0x407174c2 in nsStreamListenerTee::OnDataAvailable ()
   from /usr/lib/mozilla-1.2.1/components/libnecko.so
#27 0x40754341 in nsHttpChannel::OnDataAvailable ()
   from /usr/lib/mozilla-1.2.1/components/libnecko.so
#28 0x407167fd in nsOnDataAvailableEvent::HandleEvent ()
   from /usr/lib/mozilla-1.2.1/components/libnecko.so
#29 0x4070102b in nsARequestObserverEvent::HandlePLEvent ()
   from /usr/lib/mozilla-1.2.1/components/libnecko.so
#30 0x4018541f in PL_HandleEvent () from /usr/lib/libxpcom.so
#31 0x4018532d in PL_ProcessPendingEvents () from /usr/lib/libxpcom.so
#32 0x4018641f in nsEventQueueImpl::ProcessPendingEvents ()
   from /usr/lib/libxpcom.so
#33 0x40b4ee06 in event_processor_callback ()
   from /usr/lib/mozilla-1.2.1/components/libwidget_gtk.so
#34 0x40b4eb55 in our_gdk_io_invoke ()
   from /usr/lib/mozilla-1.2.1/components/libwidget_gtk.so
#35 0x40395a7a in g_io_unix_dispatch (source_data=0x80ae468, 
    current_time=0xbffff660, user_data=0x8163478) at giounix.c:137
#36 0x40397055 in g_main_dispatch (dispatch_time=0xbffff660) at gmain.c:656
#37 0x40397659 in g_main_iterate (block=1, dispatch=1) at gmain.c:877
#38 0x403977e8 in g_main_run (loop=0x8190830) at gmain.c:935
#39 0x402b3203 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#40 0x40b4f24e in nsAppShell::Run ()
   from /usr/lib/mozilla-1.2.1/components/libwidget_gtk.so
#41 0x40b33472 in nsAppShellService::Run ()
   from /usr/lib/mozilla-1.2.1/components/libnsappshell.so
#42 0x08053394 in main1 ()
#43 0x08053ca5 in main ()
#44 0x40537336 in __libc_start_main (main=0x8053b48 <main>, argc=2, 
    ubp_av=0xbffffa74, init=0x804d130 <_init>, fini=0x8055570 <_fini>, 
    rtld_fini=0x4000d2fc <_dl_fini>, stack_end=0xbffffa6c)
    at ../sysdeps/generic/libc-start.c:129
(gdb) quit

Comment 1

[Boris Zbarsky [:bzbarsky]]

looks like a crash in the hacky ("we won't use the X font mechanism just
because") font code in the plugin itself... 

Comment 2

[Olivier Cahagne]

fwiw, I don't crash on Win2k using build 20030125 + Flash 6.0r65.

Comment 3

[Olivier Cahagne]

do you still crash using Flash 6.0r81 ? I couldn't get FF 20040319 on Linux to
crash.

Comment 4

[Jamie Zawinski]

That URL does not crash for me using Flash 6.0 r79 and
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040116

(It also doesn't do anything: the flash plugin is running
(right button menu pops up) but the page is blank.)

Comment 5

[Olivier Cahagne]

The Flash URL is a 404, can you try this URL which has the same Flash movie I
believe ?
http://www.anycities.com/user/volkomen/iconwars.html

Comment 6

[Jamie Zawinski]

That one ran fine.

Comment 7

[Olivier Cahagne]

Marking WFM then.