262867 - Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]

Status: RESOLVED INVALID

(Plugins Graveyard :: RealPlayer (Real), defect)

Description

[Clinton Gormley]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041001 Firefox/0.10.1

The embedded Real player works fine as long as there are no <PARAM> tags, but
crashes as soon as one exists.

Using :     Helix DNA Plugin: RealPlayer G2 Plug-In Compatible version 0.4.0.293
built with gcc 3.2.2 on Jul 30 2004

So, this code works : 
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26 
    CONTROLS="PlayButton"/>
</OBJECT>

And this code causes it to crash:
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26>
<PARAM name="CONTROLS" value="PlayButton"/>
</OBJECT>


Reproducible: Always
Steps to Reproduce:
Put this code in a web page and view the page:
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26>
<PARAM name="CONTROLS" value="PlayButton"/>
</OBJECT>

Actual Results:  
Firefox crashes

Expected Results:  
Well...

Still happens when I use a different profile, so unlikely to be related to the
extensions in my user profile.

Comment 1

[Ryan Gammon]

Is it RealPlayer here that's crashing, or Firefox? If it's RealPlayer, you'll
probably have better luck logging it in the bug tracker on
player.helixcommunity.org.

Comment 2

[David Kitchen]

I have the same problem:

Real Player 10.5 on Windows XP SP2
Firefox 1.0.3 GB

I uninstalled and reinstalled Real Player, this did not solve it.

I have confirmed Real Player still works in IE with the embedded player.

I uninstalled and reinstalled Firefox, including wiping the profile and creating
a new profile. This also did not solve it.

So the crash is in Firefox and not Real Player.

Steps to reproduce:
1) Navigate to: http://news.bbc.co.uk/

2) Click "Watch BBC News In Video" link to open the popup window with embedded
player.

3) Select Real Player as preferred player.

4) Watch Firefox crash and talkback fire up.

I have used talkback to submit this, incident numbers if you can access such
stuff are:
TB5219019W
TB5209547Y
TB5208502M

I had submitted about 10 more of these prior to my reinstall of Mozilla, I'm
afraid I don't have those incident ID's.

Comment 3

[timeless]

Incident ID: 5219019
Stack Signature	nppl3260.dll + 0x4341 (0x63344341) 4653a8e9
Product ID	Firefox10
Build ID	2005041420
Trigger Time	2005-04-19 22:45:00.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	nppl3260.dll + (00004341)
URL visited	
User Comments	
Since Last Crash	6964 sec
Total Uptime	10300 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
nppl3260.dll + 0x4341 (0x63344341)
nppl3260.dll + 0xb15c (0x6334b15c)
nsPluginHostImpl::InstantiateEmbededPlugin  [c:/builds/tinderbox/Fx-Aviary1.0.1-
l10n/WINNT_5.1_Depend/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp, line 
3437]
nsObjectFrame::InstantiatePlugin  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp, line 1447]
nsObjectFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp, line 1284]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsInlineFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 715]
nsInlineFrame::ReflowFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 530]
nsInlineFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 443]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsBlockFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3748]
nsBlockFrame::DoReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3446]
nsBlockFrame::DoReflowInlineFramesAuto  [c:/builds/tinderbox/Fx-Aviary1.0.1-
l10n/WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3347]
nsBlockFrame::ReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3292]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2456]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
CanvasFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsHTMLFrame.cpp, line 554]
nsBoxToBlockAdaptor::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 884]
nsBoxToBlockAdaptor::DoLayout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 626]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 249]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 904]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6401]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6226]
PL_HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/xpcom/threads/plevent.c, line 674]
0x778b0c24
nsMathMLChar::PaintHorizontally  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/mathml/base/src/nsMathMLChar.cpp, line 2346]
0x52f8558d

Comment 4

[u63580]

*** Bug 308307 has been marked as a duplicate of this bug. ***

Comment 5

[Adam Guthrie]

*** Bug 311244 has been marked as a duplicate of this bug. ***

Comment 6

[Ria Klaassen (not reading all bugmail)]

*** Bug 354033 has been marked as a duplicate of this bug. ***

Comment 7

[Omer Kehri]

Using: 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003 BonEcho/2.0

The page below has EMBED tags and crashes instantly.
http://www.songsouponsea.com/Promenade/Islands.html

Talkback ID:
TB24093071

Comment 8

[Olivier Vit (just a reporter)]

(In reply to comment #7)
> Using: 
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003
> BonEcho/2.0
> 
> The page below has EMBED tags and crashes instantly.
> http://www.songsouponsea.com/Promenade/Islands.html
> 
> Talkback ID:
> TB24093071
> 

I'm running Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.9a1) Gecko/20061017 SeaMonkey/1.5a and realplayer 10.5 and this page *doesn't* crash, while I usually can't play any external ram/rm file !

Comment 9

[Matthias Versen [:Matti]]

This crash is iu the realplayer itself.
Please reopen if you get this with the latest builds.