285356 - mozilla crashes on SEGV loading site with Flash, when run in X-VNC, 8bit [@ PlatformBitBuffer::CreateScreenBits]

Status: RESOLVED INVALID

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[paolo]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041129 Firefox/1.0 (Debian package 1.0-3.backports.org.1)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041129 Firefox/1.0 (Debian package 1.0-3.backports.org.1)

I was running mozilla 1.7.5 remotely through a VNC session with -depth 8 bit,
when it got killed by SEGV upon access given sample URL. www.tele2.it loads a
Flash menu, reminding of the infamous shm bug for flashplugin in NS4.x running
off a remote Xsession, I tried other flash-sites and got same trouble. 
I don't have any debugger there, but am quite confident the bug is triggered by
the Flash stuff.
Flash Plug-in is: 7.0 r25



Reproducible: Always

Steps to Reproduce:
1.run vncserver -depth 8
2.connect with xvnc4viewer 
3.run mozilla, in vnc session, go to a site with Flash elements 

Actual Results:  
Segmentation fault      mozilla -browser

Expected Results:  
display the site being visited

Comment 1

[paolo]

hurm... sorry, that's the version string from FF I'm reporting from. The guilty
lizard shows instead:

Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.7.5) Gecko/20050105 Debian/1.7.5-1

Comment 2

[R.K.Aa.]

Dup of bug 208947? There's a crash in 16-bit VNC there but it probably crashes
regardless. This may be flash crashing, taking mozilla with it. If talkback
triggers, please provide the talkback ID.

Comment 3

[paolo]

Attachment: part of (unreadable) TB agent window

Comment 4

[paolo]

[grrr ... is bugzilla supposed to wipe out comments upon upload attchments?!?]

ok, shortly, again: 
- yes, looks like ol'same bug 208947
- TalkBack: sorry, Debian pkg seems without the feedback agent
- TalkBack: anyway, I could run mozy.1.7.5 on remote system, same as before
  (Debian Sarge) but mozy is from official tarball - however can't do much 
  with it, see previous posting, that's how TB window looks like. 
  Anyway, if needed/useful I can retrieve and send/post .pak file which I guess
  keeps data collected by TB agent.
- got gdb there though, here's the bt:

(gdb) bt
#0  0x41934c47 in PlatformBitBuffer::CreateScreenBits ()
   from /opt/mozilla/plugins/libflashplayer.so
#1  0x41934622 in PlatformBitBuffer::PlatformBitBuffer ()
   from /opt/mozilla/plugins/libflashplayer.so
#2  0x4190534e in CorePlayer::UpdateBuffer ()
   from /opt/mozilla/plugins/libflashplayer.so
#3  0x41904a43 in CorePlayer::DrawScreen ()
   from /opt/mozilla/plugins/libflashplayer.so
#4  0x4197d89d in PlatformPlayer::HandleXEvent ()
   from /opt/mozilla/plugins/libflashplayer.so
#5  0x4127a7e1 in XtDispatchEventToWidget () from /usr/X11R6/lib/libXt.so.6
#6  0x4127b11d in _XtOnGrabList () from /usr/X11R6/lib/libXt.so.6
#7  0x4127b43f in XtDispatchEvent () from /usr/X11R6/lib/libXt.so.6
#8  0x412875e7 in XtAppProcessEvent () from /usr/X11R6/lib/libXt.so.6
#9  0x40dbaa45 in ?? () from /opt/mozilla/libgtkxtbin.so
#10 0x08711308 in ?? ()
#11 0x00000001 in ?? ()
#12 0x00000000 in ?? ()
#13 0x402d736a in g_tree_search () from /usr/lib/libglib-1.2.so.0
#14 0x402cc03d in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#15 0x402cc4f4 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#16 0x402cc724 in g_main_run () from /usr/lib/libglib-1.2.so.0
#17 0x401d825f in gtk_main () from /usr/lib/libgtk-1.2.so.0
#18 0x40faf976 in ?? () from /opt/mozilla/components/libwidget_gtk.so
#19 0x08091d60 in ?? ()
#20 0xbffff9e8 in ?? ()
#21 0xbffff8e8 in ?? ()
#22 0x08065d6e in nsCOMPtr_base::assign_with_AddRef ()
#23 0x40f948e4 in ?? () from /opt/mozilla/components/libnsappshell.so
#24 0x08091d60 in ?? ()
#25 0x080fb4c0 in ?? ()
#26 0xbffffa78 in ?? ()
#27 0x08056e0d in getCountry ()
#28 0x08056e0d in getCountry ()
#29 0x08057980 in main ()

Comment 5

[Matthias Versen [:Matti]]

The flash plugin itself caused the crash -> invalid

Comment 6

[Andrew Schultz]

*** Bug 208947 has been marked as a duplicate of this bug. ***

Comment 7

[BMO Automation]

Version and milestone values are being reset to defaults as part of product refactoring.