Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]

RESOLVED INVALID

Status

Plugins Graveyard
RealPlayer (Real)
--
critical
RESOLVED INVALID
14 years ago
2 years ago

People

(Reporter: Clinton Gormley, Unassigned)

Tracking

({crash})

Details

(crash signature)

(Reporter)

Description

14 years ago
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041001 Firefox/0.10.1

The embedded Real player works fine as long as there are no <PARAM> tags, but
crashes as soon as one exists.

Using :     Helix DNA Plugin: RealPlayer G2 Plug-In Compatible version 0.4.0.293
built with gcc 3.2.2 on Jul 30 2004

So, this code works : 
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26 
    CONTROLS="PlayButton"/>
</OBJECT>

And this code causes it to crash:
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26>
<PARAM name="CONTROLS" value="PlayButton"/>
</OBJECT>


Reproducible: Always
Steps to Reproduce:
Put this code in a web page and view the page:
<OBJECT DATA="http://dostreceradio.net/archives/smil.smil" 
    TYPE="audio/x-pn-realaudio-plugin" WIDTH=26 HEIGHT=26>
<PARAM name="CONTROLS" value="PlayButton"/>
</OBJECT>

Actual Results:  
Firefox crashes

Expected Results:  
Well...

Still happens when I use a different profile, so unlikely to be related to the
extensions in my user profile.

Comment 1

14 years ago
Is it RealPlayer here that's crashing, or Firefox? If it's RealPlayer, you'll
probably have better luck logging it in the bug tracker on
player.helixcommunity.org.

Comment 2

13 years ago
I have the same problem:

Real Player 10.5 on Windows XP SP2
Firefox 1.0.3 GB

I uninstalled and reinstalled Real Player, this did not solve it.

I have confirmed Real Player still works in IE with the embedded player.

I uninstalled and reinstalled Firefox, including wiping the profile and creating
a new profile. This also did not solve it.

So the crash is in Firefox and not Real Player.

Steps to reproduce:
1) Navigate to: http://news.bbc.co.uk/

2) Click "Watch BBC News In Video" link to open the popup window with embedded
player.

3) Select Real Player as preferred player.

4) Watch Firefox crash and talkback fire up.

I have used talkback to submit this, incident numbers if you can access such
stuff are:
TB5219019W
TB5209547Y
TB5208502M

I had submitted about 10 more of these prior to my reinstall of Mozilla, I'm
afraid I don't have those incident ID's.

Comment 3

13 years ago
Incident ID: 5219019
Stack Signature	nppl3260.dll + 0x4341 (0x63344341) 4653a8e9
Product ID	Firefox10
Build ID	2005041420
Trigger Time	2005-04-19 22:45:00.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	nppl3260.dll + (00004341)
URL visited	
User Comments	
Since Last Crash	6964 sec
Total Uptime	10300 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
nppl3260.dll + 0x4341 (0x63344341)
nppl3260.dll + 0xb15c (0x6334b15c)
nsPluginHostImpl::InstantiateEmbededPlugin  [c:/builds/tinderbox/Fx-Aviary1.0.1-
l10n/WINNT_5.1_Depend/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp, line 
3437]
nsObjectFrame::InstantiatePlugin  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp, line 1447]
nsObjectFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp, line 1284]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsInlineFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 715]
nsInlineFrame::ReflowFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 530]
nsInlineFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 443]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsBlockFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3748]
nsBlockFrame::DoReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3446]
nsBlockFrame::DoReflowInlineFramesAuto  [c:/builds/tinderbox/Fx-Aviary1.0.1-
l10n/WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3347]
nsBlockFrame::ReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3292]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2456]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockReflowContext.cpp, line 
547]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3068]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2334]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
CanvasFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/html/base/src/nsHTMLFrame.cpp, line 554]
nsBoxToBlockAdaptor::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 884]
nsBoxToBlockAdaptor::DoLayout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 626]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 249]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 904]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6401]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.
1_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6226]
PL_HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/
mozilla/xpcom/threads/plevent.c, line 674]
0x778b0c24
nsMathMLChar::PaintHorizontally  [c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/
WINNT_5.1_Depend/mozilla/layout/mathml/base/src/nsMathMLChar.cpp, line 2346]
0x52f8558d
Assignee: firefox → nobody
Component: General → Plug-ins
Keywords: crash
Product: Firefox → Core
QA Contact: general → plugins
Summary: Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags → Firefox crashes when an embedded real audio file using OBJECT includes PARAM tags [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]
Version: unspecified → 1.7 Branch

Comment 4

13 years ago
*** Bug 308307 has been marked as a duplicate of this bug. ***

Comment 5

13 years ago
*** Bug 311244 has been marked as a duplicate of this bug. ***
*** Bug 354033 has been marked as a duplicate of this bug. ***

Comment 7

12 years ago
Using: 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003 BonEcho/2.0

The page below has EMBED tags and crashes instantly.
http://www.songsouponsea.com/Promenade/Islands.html

Talkback ID:
TB24093071
(In reply to comment #7)
> Using: 
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003
> BonEcho/2.0
> 
> The page below has EMBED tags and crashes instantly.
> http://www.songsouponsea.com/Promenade/Islands.html
> 
> Talkback ID:
> TB24093071
> 

I'm running Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.9a1) Gecko/20061017 SeaMonkey/1.5a and realplayer 10.5 and this page *doesn't* crash, while I usually can't play any external ram/rm file !
This crash is iu the realplayer itself.
Please reopen if you get this with the latest builds.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → INVALID

Updated

8 years ago
Component: Plug-ins → RealPlayer (Real)
Product: Core → Plugins
QA Contact: plugins → real-player
Version: 1.7 Branch → unspecified

Updated

8 years ago
Version: unspecified → 6.x
(Assignee)

Updated

7 years ago
Crash Signature: [@ nppl3260.dll + 0x4341 (0x63344341) 4653a8e9]
(Assignee)

Updated

2 years ago
Product: Plugins → Plugins Graveyard
You need to log in before you can comment on or make changes to this bug.