27558 - [FLASH] buy a bug. crash the browser. on http://www.vw.com/autoshow/index_flash.html

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P3)

Description

[chris hofmann]

trying to look at the vw auto show.

are we shipping the flash plugin?

stack trace to below.

Incident ID 5295344 
0x00000000 
ns4xPluginInstance::Initialize 
[d:\builds\seamonkey\mozilla\modules\plugin\nglsrc\ns4xPluginInstance.cpp, line 
362] 
nsPluginHostImpl::SetUpPluginInstance 
[d:\builds\seamonkey\mozilla\modules\plugin\nglsrc\nsPluginHostImpl.cpp, line 
1729] 
nsPluginHostImpl::InstantiateEmbededPlugin 
[d:\builds\seamonkey\mozilla\modules\plugin\nglsrc\nsPluginHostImpl.cpp, line 
1462] 
nsObjectFrame::InstantiatePlugin 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 946] 
nsObjectFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 844] 
nsLineLayout::ReflowFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 990] 
nsInlineFrame::ReflowInlineFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 505] 
nsInlineFrame::ReflowFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 357] 
nsInlineFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 265] 
nsLineLayout::ReflowFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 990] 
nsBlockFrame::ReflowInlineFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3888] 
nsBlockFrame::DoReflowInlineFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3777] 
nsBlockFrame::DoReflowInlineFramesAuto 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3719] 
nsBlockFrame::ReflowInlineFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3665] 
nsBlockFrame::ReflowLine 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2841] 
nsBlockFrame::ReflowDirtyLines 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2546] 
nsBlockFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1534] 
nsBlockReflowContext::ReflowBlock 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line 
450] 
nsBlockFrame::ReflowBlockFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3422] 
nsBlockFrame::ReflowLine 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2739] 
nsBlockFrame::ReflowDirtyLines 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2546] 
nsBlockFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1534] 
nsAreaFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 277] 
nsContainerFrame::ReflowChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
661] 
RootFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 334] 
nsContainerFrame::ReflowChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
661] 
nsScrollPortFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollPortFrame.cpp, line 
406] 
nsContainerFrame::ReflowChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
661] 
nsGfxScrollFrameInner::ReflowFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1257] 
nsGfxScrollFrameInner::ReflowScrollArea 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1322] 
nsGfxScrollFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
509] 
nsContainerFrame::ReflowChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
661] 
ViewportFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 531] 
nsHTMLReflowCommand::Dispatch 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 
145] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1952] 
ReflowEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1852] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 527] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 490] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 
977] 
KERNEL32.DLL + 0x35d9 (0xbff735d9) 
KERNEL32.DLL + 0x2222f (0xbff9222f) 
0x00688bec

Comment 1

[chris hofmann]

020809 build on win95.

Comment 2

[ekrock's old account (dead)]

Don't recall if we've publicly announced what our plans are/aren't for Flash 
bundling with Netscape 6. cc:ing johng who will know.

Does the content use LiveConnect? If so, behavior will be unpredictable on Nav6 
when using existing, not-upgraded-to-Mozilla Flash binary.

Comment 3

[chris hofmann]

we should release note if we can't fix.

Comment 4

[shrirang khanzode]

Yes, This page does use Liveconnect (swLiveConnect=TRUE). Unless this variable 
is set to 'false', the plugin won't work.  

Comment 5

[ekrock's old account (dead)]

OK, so, just so everyone's clear, we don't expect the LiveConnect calls to work 
on Mozilla w/ the existing Flash binary (they should fail silently), but the 
browser definitely shouldn't crash. 

Do we know whether the LiveConnect call is causing the crash or merely 
coincidental on the page with the crash? (We'd definitely like to know if 
LiveConnect calls with old plug-in binaries can crash the browser; that would be 
very important news for our plug-in developer community. amusil thought that 
crashes were unlikely, but you never know.) If the LiveConnect call is causing 
the crash, this is a lower priority as most Flash content on the web doesn't use 
LiveConnect.

Comment 6

[shrirang khanzode]

Attachment: Attached a testcase with swLiveConnect=FALSE (this file should play)

Comment 7

[leger]

Putting on PDT+ radar for the CRASH fix for beta1.

Comment 8

[Joseph Elwell]

doesn't crash on winNT build 2000021608. Followed the Flash through, clicking on
all sorts of things.

Comment 9

[Jim Roskind]

It sounds like this is no longer a crasher, and should be marked as resolved.
With the lack of confidence in the bug, I've added the annotation that this bug
will become PDT- on 3/3.

Comment 10

[shrirang khanzode]

no...this page still crashes with liveconnect set to 'true'. My testcase 
attached on '2000-02-14 14:52' was to show that mozilla does not crash with 
Liveconnect set to 'false' and that is what [e-mail] confirmed. 

Comment 11

[av (gone)]

The problem with this one is that it does not crash with debug build, making 
debugging senseless. I am trying to create optimized but instrumented with 
symbols build to see if this will help. Meanwhile adding LiveConnect owner to 
the cc list.

Comment 12

[Jim Roskind]

It sounds like we need more info on this bug, or we need to give up for it in 
beta1.  I'm adjusting the transition date to be 3/7

Comment 13

[rods (gone)]

I'm taking this bug from av and I'm building a non-debug build to try to figure 
out what is going on.

Comment 14

[rods (gone)]

It dies in:
NS_IMETHODIMP ns4xPluginInstance :: Initialize(nsIPluginInstancePeer* peer)
{
  return InitializePlugin(peer);
}

I am adding an attachment of a snapshot of the window showing the peer arg's 
state. I am not sure if this helps, and I don't have a clue as to what to do 
with this bug at this point. Assigning this back to av

Comment 15

[rods (gone)]

Attachment: shows the values of "peer"

Comment 16

[Jim Roskind]

It is not pleasant to ship a beta with a known crasher... but we're not seeing
progress on this, and the 3/7 date has passed.
Marking PDT- for beta1
PDT+ for beta2

If there is a sudden understanding of this bug that can change the perspective,
please re-nominate... but time is running out for beta1

Comment 17

[av (gone)]

*** Bug 32563 has been marked as a duplicate of this bug. ***

Comment 18

[av (gone)]

Attachment: Purify output for debug build

Comment 19

[av (gone)]

How can we get Macromedia people to look at the Purify attachment above? Any 
other help would be really appreciated.

Comment 20

[rickg]

Major priority bug for m16

Comment 21

[ekrock's old account (dead)]

Marking beta2 and flash. We should definitely fix this for beta2 as Flash is one 
of the two most popular plug-ins on the Internet.

Comment 22

[leger]

Putting on beta2 keyword radar since this was "plus for beta2" during beta1 
triaging

Comment 23

[shrirang khanzode]

*** Bug 36383 has been marked as a duplicate of this bug. ***

Comment 24

[av (gone)]

I still do not know why it crashes. Possible MS optimizer bug. For now checked 
in try/catch block around the call in question. No exceptions caught, everything 
seems to work.

Comment 25

[shrirang khanzode]

I do not see the crash anymore on today's windows build (2000051808). But at the 
end of the animation, when I click on a link inside the plugin to load a 
webpage, the browser freezes. I will log a seperate bug for that. Marking this 
as verified since I crash no more.

Comment 26

[Stephen Walker]

*** Bug 36056 has been marked as a duplicate of this bug. ***