353507 - Flash advertisement crashes firefox [@ SCharacterParser::BuildEdges] in libflashplayer.so

Status: VERIFIED INVALID

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[Jesse Frederick]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4) Gecko/20060614 Fedora/1.5.0.4-1.2.fc5 Firefox/1.5.0.4 pango-text
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4) Gecko/20060614 Fedora/1.5.0.4-1.2.fc5 Firefox/1.5.0.4 pango-text

This is an advertisement I found embedded in the messages boards at rivals.com. Going to this address crashes firefox every time. I have tried this on Windows and Linux using the latest stable release of Firefox and the latest nightly build.

Reproducible: Always

Steps to Reproduce:
1.Open http://view.atdmt.com/TUR/iview/dvrtmtur0040000028tur/direct/01?click=http://servedby.advertising.com/click/site=0000689783/mnum=0000376693/optn=64?trg=


Actual Results:  
Crash and burn! 

Expected Results:  
In internet explorer it shows an advertisement for dungeons and dragons online.

Comment 1

[Ria Klaassen (not reading all bugmail)]

No crash here with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7

Comment 2

[Adam Guthrie]

Can you download the Firefox debug package and get a stack for this using gdb?

Once you get the debug package you'll want to do:
gdb firefox
handle SIG33 noprint nostop
run
<do what you need to do to crash Firefox>
bt

"bt" should output a stack. Please paste this stack in the bug.

Comment 3

[Jesse Frederick]

Hmm... this might be a flash player problem. I managed to finally get firefox to run in a debugger. I built 1.5.0.7 from source on Linux. Here is backtrace. 

(gdb) bt
#0  0x01d6ea32 in SCharacterParser::BuildEdges () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#1  0x01d71605 in SObject::BuildEdges () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#2  0x01d744a1 in SObject::Draw () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#3  0x01d7454b in SObject::Draw () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#4  0x01d7454b in SObject::Draw () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#5  0x01d7454b in SObject::Draw () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#6  0x01d55d72 in DisplayList::UpdateRect () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#7  0x01d5606c in DisplayList::Update () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#8  0x01da82df in CorePlayer::UpdateBuffer () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#9  0x01da7a43 in CorePlayer::DrawScreen () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#10 0x01da8237 in CorePlayer::UpdateScreen () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#11 0x01d9ca6a in CorePlayer::DoPlay () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#12 0x01ddb7dc in UnixCommonPlayer::OnTimer () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#13 0x01e1fa29 in gtkTimerCallback () from /home/jfrederick/.mozilla/plugins/libflashplayer.so
#14 0x00a1d876 in g_source_get_current_time () from /usr/lib/libglib-2.0.so.0
#15 0x00a1d15d in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#16 0x00a203ef in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#17 0x00a20799 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#18 0x00d7d634 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#19 0x00b2b810 in nsAppShell::Run (this=0x9aa09c8) at nsAppShell.cpp:139
#20 0x04113df6 in nsAppStartup::Run (this=0x9aa0980) at nsAppStartup.cpp:150
#21 0x080522e0 in XRE_main (argc=1, argv=0xbfedd254, aAppData=0x806b7a0) at nsAppRunner.cpp:2374
#22 0x0804b3ac in main (argc=Cannot access memory at address 0x0
) at nsBrowserApp.cpp:61
(gdb) 

Comment 4

[Jesse Frederick]

I just updated my flash player and the problem goes away. Odd that I had the same old buggy version installed on both my windows and linux machines. 

Comment 5

[Adam Guthrie]

Thanks for the QAing this. Marking as VERIFIED.

Comment 6

[Adam Guthrie]

*** Bug 353586 has been marked as a duplicate of this bug. ***

Comment 7

[Adam Guthrie]

Jesse, which version of Flash did you upgrade to? (It's listed in about:plugins.)

Comment 8

[Jesse Frederick]

I believe the buggy version of flash on Linux was 7.0 r25. I upgraded to 7.0 r68 by downloading the installer from Adobe's site. I looked at the site indicated in bug #353586. I have Fedora 5 running in a virtual machine with version 1.5.0.4 of Firefox that did not have a flash plugin installed before visiting that site. I clicked on the broken image to install the flash plugin and Firefox downloaded the 7.0 r25 version of the flash plugin. The site http://www.telelistas.net renders just fine for me with no crashes using the old buggy plugin. I then tried the URL I provided for this bug and it crashed as expected.