328204 - illegal operation in plug-in quicktime 7.0.2 (and 7.0.4 ) while trying to play a m4a audio file on apple.com site [@ QuickTime.qts ][@ ntdll.dll + 0x11f52 - QuickTime.qts + 0xf0d04]

Status: RESOLVED WORKSFORME

Description

[Jean-Michel Reghem]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

http://www.apple.com/fr/macosx/features/voiceover/
--> click on "navigation: avance" on the right
--> it open the link http://www.apple.com/euro/macosx/features/voiceover/audio/MacOSX-VoiceOver-Forward.m4a

I got an error message box:
"QuickTime Plug-in 7.0.2

The plug-in performed an illegal operation. You are stringly advised to restart Firefox"

Press ok, then, try to do something else (like reload the page, etc ...)
--> crash

Reproducible: Always

Steps to Reproduce:
1.go to url http://www.apple.com/euro/macosx/features/voiceover/audio/MacOSX-VoiceOver-Forward.m4a with firefox 
2.press ok after illegal plug-in operation error dialog box
3.reload the page

Actual Results:  
it crash

Expected Results:  
it should works 

I have 2 talkback (next post)
I've check with this talkback for other bugs without find a similar recent (7 bug found but marked as expired etc ...)

Comment 1

[Jean-Michel Reghem]

TB15420279E

Stack Signature	 ntdll.dll + 0x11f52 (0x7c911f52) c92c2458
Product ID	Firefox15
Build ID	2006011112
Trigger Time	2006-02-21 00:59:25.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (00011f52)
URL visited	playing a .mov from apple computer --> Quicktime plugin illegal operation
User Comments	(quicktime 7) I wanted to view in FF the first video on the site www.apple.fr --> Mac OS X --> VoiceOver -->1st video on the right
Since Last Crash	822608 sec
Total Uptime	975148 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x11f52 (0x7c911f52)
QuickTime.qts + 0xf0d04 (0x668f0d04)
QuickTime.qts + 0x113819 (0x66913819)
QuickTimeWebHelper.qtx + 0xb2dc (0x6748b2dc)



The only bug open which seems similar is https://bugzilla.mozilla.org/show_bug.cgi?id=102587
but it concerns tiff image, not m4a movie

Comment 2

[Jean-Michel Reghem]

TB15479075H
TB15479143Y

Comment 3

[timeless]

i'm having trouble deciding which heap free related function we're actually crashing in, but it doesn't really matter, this is heap corruption presumably from quicktime. do we have any quicktime plugin contacts?

Comment 4

[Simon Fraser]

Does it happen with QuickTime 7.0.4?

Comment 5

[Jean-Michel Reghem]

yes ...
fresh install of Quicktime for windows 7.0.4.80
--> from this bugzilla page, click on link 
http://www.apple.com/euro/macosx/features/voiceover/audio/MacOSX-VoiceOver-Forward.m4a
--> the "illegal operation in plugin" box doesn't pop up ... but the movie is played in 1/2 seconds (without image, just the progress bar which go from begin to end ...)
--> click back
--> illegal operation in plugin box + crash
(or even, for 2nd talkback crash: direct crash without the illegal operation box)
TB15518004Q
TB15518031Y

Comment 6

[Simon Fraser]

Installing QT 7.0.4 fixed the crash at
http://www.apple.com/euro/macosx/features/voiceover/audio/MacOSX-VoiceOver-Forward.m4a
for me.

Comment 7

[Jean-Michel Reghem]

not for me ... the behaviour was different (no crash before play, it try to play, but nothing happens ... but try to click "history back" or other miscellanous operation, and you will got the crash and the illegal plugin

Comment 8

[Jean-Michel Reghem]

Bug still there with QT 7.0.4 (Windows XP SP2)

Firefox 1.5.0.4: TB19591659Y
Bon Echo alpha 3: TB19592144E
MineField Nighly 2006060604: TB19592688W

Same stack (ntdll.dll + quicktime.qts)

Step to reproduce: 
http://www.apple.com/fr/macosx/features/voiceover/
--> click on link "A l'écoute de VoiceOver - Navigation:Avance", in a box on the right of the page below the box "Explorez Mac OS X"

Comment 9

[Bryan Bach]

It happens for me using Firefox 2.0b1 and QuickTime 7.0.3

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1

Reproducible: Always.

http://apple.com
--> Click on Mac OS X
--> Click on Mail 3 (which is a link to http://apple.com/leopard/mail.html).

While loading the embedded QuickTime, I get an error message box that says:
"QuickTime Plug-in 7.0.3

The plug-in performed an illegal operation. You are stringly advised to restart
Firefox."

Firefox crashes immediately afterward. It seems to be a flat crash; there is no Talkback or MS debug window.

Comment 10

[Jean-Michel Reghem]

strange ...
i've test with 2.0b1 20060815
and 1.5.0.6 ... 
both with QT 7.0.4 ...

ant it don't crash

Comment 11

[Wayne Mery (:wsmwk)]

Jean-Michel, so would you say it is fixed by QT 7.0.4?  That would make this bug invalid.

Comment 12

[Jean-Michel Reghem]

No, the bug is still there ...
but as comment #10 or comment #6 it is not always reproducible.
I've tested this morning with Firefox 2.0.0.1 (build 2006120418) and Quicktime 7.0.4.

Step to reproduce was in this case: 
* open http://www.apple.com/fr/macosx/features/voiceover/ in a tab
* --> click on link "A l'écoute de VoiceOver - Navigation:Avance", in a box on
the right of the page below the box "Explorez Mac OS X"
* --> the quicktime plugin is opening and i listen to the "bip" ...
* --> 2 times was OK ...
* I was pressing F5 to reload page
* --> Illegal operation appairs in pop up and then FF crash
* --> TB29568367W

Incident ID: 29568367
Stack Signature	nsPluginDOMContextMenuListener::Destroy 60b3f453
Product ID	Firefox2
Build ID	2006120418
Trigger Time	2007-02-22 00:29:55.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	FIREFOX.EXE + (002ea2ba)
URL visited	bug
User Comments	
Since Last Crash	1613820 sec
Total Uptime	1613820 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/generic/nsObjectFrame.cpp, line 2266
Stack Trace 	
nsPluginDOMContextMenuListener::Destroy  [mozilla/layout/generic/nsObjectFrame.cpp, line 2266]
nsPluginInstanceOwner::Destroy  [mozilla/layout/generic/nsObjectFrame.cpp, line 3888]
nsObjectFrame::Destroy  [mozilla/layout/generic/nsObjectFrame.cpp, line 772]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsFrameList.cpp, line 138]
CanvasFrame::Destroy  [mozilla/layout/generic/nsHTMLFrame.cpp, line 230]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsFrameList.cpp, line 138]
nsHTMLScrollFrame::Destroy  [mozilla/layout/generic/nsGfxScrollFrame.cpp, line 172]
nsPositionedInlineFrame::Destroy  [mozilla/layout/generic/nsInlineFrame.cpp, line 1078]
DocumentViewerImpl::Hide  [mozilla/layout/base/nsDocumentViewer.cpp, line 2023]
nsDocShell::SetVisibility  [mozilla/docshell/base/nsDocShell.cpp, line 3782]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsFrameList.cpp, line 138]
nsBoxFrame::Destroy  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1120]
nsBoxFrame::Destroy  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1120]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsFrameManager.cpp, line 705]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10123]
PresShell::ContentRemoved  [mozilla/layout/base/nsPresShell.cpp, line 5572]
nsDocument::ContentRemoved  [mozilla/content/base/src/nsDocument.cpp, line 2471]
nsXULDocument::ContentRemoved  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 1192]
nsGenericElement::RemoveChildAt  [mozilla/content/base/src/nsGenericElement.cpp, line 2913]
nsXULElement::RemoveChildAt  [mozilla/content/xul/content/src/nsXULElement.cpp, line 1273]
nsGenericElement::RemoveChild  [mozilla/content/base/src/nsGenericElement.cpp, line 3658]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1396]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3950]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1415]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1490]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4359]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsXBLPrototypeHandler::ExecuteHandler  [mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 505]
nsXBLEventHandler::HandleEvent  [mozilla/content/xbl/src/nsXBLEventHandler.cpp, line 86]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2229]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6425]
PresShell::HandleEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6323]
nsEventStateManager::CheckForAndDispatchClick  [mozilla/content/events/src/nsEventStateManager.cpp, line 3207]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nsEventStateManager.cpp, line 2170]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6497]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6261]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1389]
nsWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6433]
ChildWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6680]
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1577]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16fd7 (0x7c816fd7)


I restart Firefox, and choose "continue session"
--> the m4u reopen in a tab and i got the "illegal operation" immediatly and then firefox crash

--> TB29568383K

Incident ID: 29568383
Stack Signature	ntdll.dll + 0x11e58 (0x7c911e58) 9a182b4f
Product ID	Firefox2
Build ID	2006120418
Trigger Time	2007-02-22 00:31:07.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (00011e58)
URL visited	bug
User Comments	
Since Last Crash	24 sec
Total Uptime	1613844 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x11e58 (0x7c911e58)
ntdll.dll + 0x10d5c (0x7c910d5c)
QuickTime.qts + 0xf4404 (0x668f4404)
QuickTime.qts + 0x111ec8 (0x66911ec8)
QuickTime.qts + 0x55eae (0x66855eae)
0xc00006df




The first Talkback is interressant because it is the first time we got a real correct stack for this crash

It appairs there is a problem in nsresult nsPluginDOMContextMenuListener::Destroy(nsObjectFrame *aFrame)

Comment 13

[Jean-Michel Reghem]

Setting it to new as comment #9 confirm the bug


i believe it is also present in trunk ...
I've test it with minefield in juni 2006 and it was the case.
Is somebody can test it with Gran Paradiso alpha 2?

Comment 14

[Jean-Michel Reghem]

Confirmed bug Quitcktime 7.0.4 and Gran Paradiso alpha 2 (windows XP SP2)
--> open the page in tab, click on the m4a, listen the sound twice and press reload page icon --> crash (EVEN without illegal operation plugin popup --> i got directly the Talkback)

TB29569623G

Incident ID: 29569623
Stack Signature	ntdll.dll + 0x10f29 (0x7c910f29) e3f948f3
Product ID	FirefoxTrunk
Build ID	2007020617
Trigger Time	2007-02-22 01:43:33.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (00010f29)
URL visited	bug 328204
User Comments	
Since Last Crash	167 sec
Total Uptime	167 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x10f29 (0x7c910f29)
ntdll.dll + 0x10d5c (0x7c910d5c)
QuickTime.qts + 0xf4404 (0x668f4404)
QuickTimeWebHelper.qtx + 0x7100 (0x67647100)
nsObjectFrame::StopPlugin   nsObjectFrame::Destroy   nsLineBox::DeleteLineList   nsFrameList::DestroyFrames   CanvasFrame::Destroy   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameManager::Destroy   DocumentViewerImpl::Destroy   DocumentViewerImpl::Show   nsPresContext::EnsureVisible   nsPluginInstanceOwner::Init   nsObjectFrame::PrepareInstanceOwner   nsPluginStreamListener::OnStartRequest   nsDocumentOpenInfo::OnStartRequest   0x0012f804

--> setting to trunk

Comment 15

[Osama]

(In reply to comment #14)
> Confirmed bug Quitcktime 7.0.4 and Gran Paradiso alpha 2 (windows XP SP2)
> --> open the page in tab, click on the m4a, listen the sound twice and press
> reload page icon --> crash (EVEN without illegal operation plugin popup --> i
> got directly the Talkback)
> 
> TB29569623G
> 
> Incident ID: 29569623
> Stack Signature ntdll.dll + 0x10f29 (0x7c910f29) e3f948f3
> Product ID      FirefoxTrunk
> Build ID        2007020617
> Trigger Time    2007-02-22 01:43:33.0
> Platform        Win32
> Operating System        Windows NT 5.1 build 2600
> Module  ntdll.dll + (00010f29)
> URL visited     bug 328204
> User Comments   
> Since Last Crash        167 sec
> Total Uptime    167 sec
> Trigger Reason  Access violation
> Source File, Line No.   N/A
> Stack Trace     
> ntdll.dll + 0x10f29 (0x7c910f29)
> ntdll.dll + 0x10d5c (0x7c910d5c)
> QuickTime.qts + 0xf4404 (0x668f4404)
> QuickTimeWebHelper.qtx + 0x7100 (0x67647100)
> nsObjectFrame::StopPlugin   nsObjectFrame::Destroy   nsLineBox::DeleteLineList 
>  nsFrameList::DestroyFrames   CanvasFrame::Destroy   nsFrameList::DestroyFrames
>   nsFrameList::DestroyFrames   nsFrameManager::Destroy  
> DocumentViewerImpl::Destroy   DocumentViewerImpl::Show  
> nsPresContext::EnsureVisible   nsPluginInstanceOwner::Init  
> nsObjectFrame::PrepareInstanceOwner   nsPluginStreamListener::OnStartRequest  
> nsDocumentOpenInfo::OnStartRequest   0x0012f804
> 
> --> setting to trunk
> 

The same thing happens for me aswell.

Comment 16

[Jean-Michel Reghem]

Bug 102587 seems similar
... very old Netscape 6.2 bug ... it seems fixed in 2001 but the bug involved to become similar to this one ...
However, this one has a reproducible way to crash, so I propose to set bug 102587 duplicate as this one ...

Comment 18

[Antti Tervasmäki]

This is still present with QT 7.1.6 and current trunk build:

TB31952178X and  TB31952251H

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070508 Minefield/3.0a5pre ID:2007050804 [cairo]

Comment 19

[Sandra Gresham]

as of today - 5/20/2007 - it is still present on

Firefox v 2.0.0.3
Mozilla/5.0 (Windows;U;Windows NT 5.1;en-US;
rv:1.8.1.3) Gecko/20070309

Attempting to view a QT movie stream

PS: I have had 11 such incidents in May 2007 so far...
starting with TB31720399E,TB31760059G,TB31834628Q,TB31857563W,TB31864555K,
TB31912129Z,TB32265859H,TB32266353q,TB32284814M,TB32286214Q,TB32336626E. 5/01-20.07

Comment 20

[Sandra Gresham]

Sorry, I meant to mention:
WinXP SP 2, FULLY UPDATED; HP Presario, 512MB RAM, AMD ATHLON 3600 6 MOS OLD, UPDATED BIOS,et c.
thanx, i know nothing about the workings of it. Any and all help would be greatly appreciated.