321872 - seamonkey crash when click "help" on video.google.com

Status: RESOLVED INVALID

(Core Graveyard :: Plug-ins, defect)

Description

[Masanari Iida]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20051229 SeaMonkey/1.5a
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20051229 SeaMonkey/1.5a

seamonkey-1.5a.en-US.linux-i686-gtk1 crash when I click "help" link on video.google.com.  It also happened when I select "back" button.
The crash happened with gtk1 version of seamonkey.
But the crash doesn't happen with seamonkey-1.5a.en-US.linux-i686.


Reproducible: Always

Steps to Reproduce:
1. Access video.google.com with gtk1 version of seamonkey.
2. View any video.
3.1 Click "video help" link just next to "search" button on video.google.com. 
3.2 Or, use "Back" button on seamonkey browser.

Actual Results:  
Browser crashed.

Expected Results:  
Brwoser display video help page or back to previous page.


File name: libflashplayer.so
Shockwave Flash 7.0 r61
OS Linux (kernel 2.6.15-rc6-git4)

Comment 1

[Adam Guthrie]

Could you install with talkback and get a talkback ID for the crash? http://kb.mozillazine.org/Talkback

Comment 2

[Masanari Iida]

The talkback IDs are 13454436, 13219190 and 13075279.
Thanks for support.

Comment 3

[Andrew Schultz]

Attachment: valgrind log

it looks like flash doesn't kill a timer when it gets shut down.

Comment 4

[Andrew Schultz]

this looks like a bug in Flash itself

Comment 5

[Andrew Schultz]

resolving INVALID -- not a Mozilla bug.

Comment 6

[Michelle Sintov]

We (the Flash Player team) are unable to reproduce this crash with the version of Seamonkey you specified as well as the most recent version. Could you try the most recent version of Seamonkey? Thanks.

Comment 7

[Andrew Schultz]

Michelle: I was testing a trunk build (latest CVS).  The bug doesn't guarantee a crash.  If the memory used by the timer is reused after it's freed, then the read/write will result in bogus behavior and memory corruption instead of a crash.  Running under valgrind, I was able to verify that the bug also affects firefox (trunk).