374630 - crash [@ Flash_EnforceLocalSecurity] on Firefox 2.0.0.2 on Intel Mac 10.4.9

Status: RESOLVED DUPLICATE of bug 498971

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[(not reading, please use [e-mail] instead)]

crash [@ Flash_EnforceLocalSecurity] on Firefox 2.0.0.2 on Intel Mac 10.4.9

another crash report from Gen.  Gen writes:  "I'm getting a bunch of crashes recently."

I'll attach his crash report.

possibly a dup of bug #351912?

Comment 1

[(not reading, please use [e-mail] instead)]

Attachment: crash report from Gen Kanai

Comment 2

[(not reading, please use [e-mail] instead)]

Attachment: another crash report from Gen Kanai

Comment 3

[(not reading, please use [e-mail] instead)]

calling all mac gurus, any ideas here?  

I've emailed Gen to see which pages he might be visiting that are using Flash, so we can get some steps-to-reproduce.

Comment 4

[Gen Kanai [:gen]]

Seth asked me to provide some information on pages I was visiting and plugins.

Shockwave Flash 9.0 r28
QuickTime Plug-in 7.1.2
Java Embedding Plugin 0.9.6

I don't remember the specific URL, but I do remember that one of the pages was a BusinessWeek page.

I'll try to grab urls the next time it crashes.

Comment 5

[(not reading, please use [e-mail] instead)]

given that it is a crasher and that gen hits this frequently, marking critical

marcia, do you see anything like this showing up in hendrix?

Comment 6

[Josh Aas]

This looks a lot like bug 330100.

Comment 7

[Brian Crowder]

The testcase in bug 330100 doesn't crash my BonEcho local debug build.

Comment 8

[Brian Crowder]

Can't get the crash in that bug with an optimized trunk build, either.

Comment 9

[Brian Crowder]

I'm inclined to agree with comment 0 that this is more like 351912

Comment 10

[Marcia Knous [:marcia]]

I just crashed in this stack on my PPC mac running 2.0.0.3, TB30465848X. I can also attach the Apple crash report if is useful.

Comment 11

[Marcia Knous [:marcia]]

Attachment: Apple crash report

Comment 12

[Samuel Sidler (old account; do not CC)]

This looks to me like it's happening with the Flash Player not within Firefox. 

Michelle, does any of this ring any bells on your end?

From the talkback reports, it looks like most of the crashes are happening while people are away from their computers and have left a site open that has Flash running and coming back they get the Talkback app.

Comment 13

[(not reading, please use [e-mail] instead)]

> From the talkback reports, it looks like most of the crashes are happening
> while people are away from their computers and have left a site open that has
> Flash running and coming back they get the Talkback app.

For the record, if we have talkback reports, they would be for PPC macs, right?

For Gen's problem, he's on Intel Mac, and we don't have talkback there.

Of course, it could be crashing on PPC and Intel for the same reason.

Comment 14

[Gen Kanai [:gen]]

Attachment: 3rd crash report from Gen Kanai

I was browsing the WSJ review of the Apple TV when Firefox crashed.

http://online.wsj.com/public/article/SB117443716237743525-AC8bUe8X978hZmC7A85mAccsld8_20080320.html

Comment 15

[Gen Kanai [:gen]]

I can now replicate this crash regularly.  When closing the Firefox window (the WSJ review page) Firefox crashes.

Comment 16

[Samuel Sidler (old account; do not CC)]

(In reply to comment #13)
> For the record, if we have talkback reports, they would be for PPC macs, right?

Yeah, that's right.

Comment 17

[Samuel Sidler (old account; do not CC)]

That URL(In reply to comment #14)
> http://online.wsj.com/public/article/SB117443716237743525-AC8bUe8X978hZmC7A85mAccsld8_20080320.html

This URL will fairly reliably crash Firefox for me. Sometimes it happens on a hard reload, sometimes when closing the window (with no other tabs/windows open). It gives me the same stack Gen had.

For the record, I had to upgrade to Flash 9.0r28 to see this crash. I couldn't reproduce with r20 (maybe I didn't try hard enough?). I'm going to go back to the r20 version and see if I can reproduce with that.

Comment 18

[Marcia Knous [:marcia]]

using Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.3) Gecko/2007030919 Firefox/2.0.0.3 with both the Shockwave Flash 9.0 r28 version as well as the earlier r20 version, I have not yet been able to crash, following similar steps to what ss did in Comment 17.

Comment 19

[Brian Crowder]

I was able to capture this in a debugger, here's what I see:

#7  0x43399539 in Flash_EnforceLocalSecurity ()
#8  0x2c058697 in ns4xPluginInstance::Stop (this=0x45e8c4e0) at /Users/crowder/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp:953
#9  0x152ed27a in nsObjectFrame::StopPlugin (this=0x42fe5970) at /Users/crowder/mozilla/layout/generic/nsObjectFrame.cpp:1392

(gdb) f 8
#8  0x2c058697 in ns4xPluginInstance::Stop (this=0x45e8c4e0) at /Users/crowder/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp:953
953       NS_TRY_SAFE_CALL_RETURN(error, CallNPP_DestroyProc(fCallbacks->destroy, &fNPP, &sdata), fLibrary, this);

We're here destroying the plugin due to the window closing (see full stack attached shortly).

(gdb) p *fCallbacks
$23 = {
  size = 60, 
  version = 14, 
  newp = 0x4339a57c <Flash_EnforceLocalSecurity+4228>, 
  destroy = 0x43399524 <Flash_EnforceLocalSecurity+44>, 
  setwindow = 0x43399780 <Flash_EnforceLocalSecurity+648>, 
  newstream = 0x43399b44 <Flash_EnforceLocalSecurity+1612>, 
  destroystream = 0x4339b822 <Flash_EnforceLocalSecurity+9002>, 
  asfile = 0x4339953e <Flash_EnforceLocalSecurity+70>, 
  writeready = 0x4339b0bc <Flash_EnforceLocalSecurity+7108>, 
  write = 0x4339b210 <Flash_EnforceLocalSecurity+7448>, 
  print = 0x43399544 <Flash_EnforceLocalSecurity+76>, 
  event = 0x433995bc <Flash_EnforceLocalSecurity+196>, 
  urlnotify = 0x43399902 <Flash_EnforceLocalSecurity+1034>, 
  javaClass = 0x0, 
  getvalue = 0x43399694 <Flash_EnforceLocalSecurity+412>, 
  setvalue = 0
}

These look correct; the nearest address exported from the plugin DLL happens to be Flash_EnforceLocalSecurity, but this is otherwise meaningless, I think.

(gdb) p fNPP 
$24 = {
  pdata = 0x3b386000, 
  ndata = 0x45e8c4e0
}

ndata == this, as it should.  pdata is managed internally to the dll, presumably.  To me it looks like a floating-point value, which might make sense for Flash, but I have no idea.


(gdb) p sdata
$26 = (NPSavedData *) 0x0


I will attach the full stack separately.

Comment 20

[Brian Crowder]

Attachment: callstack of the full crash, with debug info

This makes me think the bug is a Flash bug.

Comment 21

[Michelle Sintov]

We are investigating. From the stacks it indeed looks like a Flash bug.

Comment 22

[Brian Crowder]

Michelle:  If you can provide me a flash plugin with debugging symbols, I may be able to recreate again and provide more info.  Are you able to recreate this crash?

Comment 23

[(not reading, please use [e-mail] instead)]

Attachment: 4th crash report from gen, on youtube (flash again)

Comment 24

[Michelle Sintov]

Thanks for all the help. So far we have been unable to reproduce the crash in house, but we will investigate the stack dumps. If there are other steps we can follow to repro the crash consistently, please post them to this bug. Thank you!

Comment 25

[Brian Crowder]

My best success with reproducing this was opening and closing the WSJ link below. (on my intel mac 10.4.9).

Comment 27

[Marcia Knous [:marcia]]

I hit this stack during my testing of Alpha 4, Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a4) Gecko/2007042705 GranParadiso/3.0a4. When I try to print the espn.go.com front page, I crash 100% of the time. Running on Intel Mac, 10.4.9 with 512 MB.

Comment 28

[Michelle Sintov]

Thanks so much, Marcia. The Flash Player team will investigate.

Comment 29

[(not reading, please use [e-mail] instead)]

Attachment: another crash report from Gen

Comment 32

[(not reading, please use [e-mail] instead)]

Attachment: crash report from gen

Comment 33

[(not reading, please use [e-mail] instead)]

Attachment: crash on 5/16 from gen

Comment 34

[(not reading, please use [e-mail] instead)]

from gen:  "This was the URL it crashed on:  http://www.flabber.nl/archief/020275.php"

Comment 35

[Rainer Grohmann]

I'd like to add a me-too report for this bug. However, I'm running 2.0.0.4 on linux (ubuntu 6.10) on an Intel-based notebook.

I experienced a crash on the wsj.com-page mentioned above as well.
In fact, I regularily experience a crash when visiting the following site: 
www.ba-ca.com/de/index.html
These crashes are reproducable, no matter whether I start Firefox with the -safe-mode parameter or not. 

Unfortunately, there's no talkback-thing installed (and not available within the ubuntu-repositories). I tried hard to produce a traceback using gdb, but failed miserably. 

Comment 36

[Samuel Sidler (old account; do not CC)]

This crash is Mac-specific. If you're seeing another, similar crash, please file a new bug report on it. Also, please reproduce it with an official mozilla.com build and get a Talkback ID from Talkback which comes with official builds.

Comment 37

[Rainer Grohmann]

Thank you for that information! Sorry for wasting your time.

Comment 38

[Michelle Sintov]

Unfortunately, we are still unable to reproduce this crash. Can someone still reproduce it with our latest beta for Flash Player 9 Update 3? http://labs.adobe.com/technologies/flashplayer9/

Comment 39

[Marcia Knous [:marcia]]

Michelle: I still get the espn.go.com print crash when using the new version. I also tested today's nightly on a different machine with the old plugin (r45 version) and I also crash.

I am running an Intel Mac, 10.4.10. Here are my STR:

1. Go to espn.go.com using the latest trunk build.
2. Select Print and try to print only the first page. I get an immediate crash.

Breakpad is not accessible at the moment, but I suspect it is crashing in the same stack. As soon as the system is up and I can confirm the stack, I will report back.

(In reply to comment #38)
> Unfortunately, we are still unable to reproduce this crash. Can someone still
> reproduce it with our latest beta for Flash Player 9 Update 3?
> http://labs.adobe.com/technologies/flashplayer9/
> 

Comment 40

[Toli Kuznets]

Marcia:
I have an Intel OSX 10.4.10 as well, with FF 2.0.4 and i installed the latest Flash update: Shockwave Flash 9.0 r60 in about:plugins

Printing front page of ESPN site works for me.

I've had Flash crashes before, i'll update this if i get another one with latest flash release.

Comment 41

[Marcia Knous [:marcia]]

Toli: I don't see the crash either using 2.0.0.4, but I do see it on the trunk.

(In reply to comment #40)
> Marcia:
> I have an Intel OSX 10.4.10 as well, with FF 2.0.4 and i installed the latest
> Flash update: Shockwave Flash 9.0 r60 in about:plugins
> 
> Printing front page of ESPN site works for me.
> 
> I've had Flash crashes before, i'll update this if i get another one with
> latest flash release.
> 

Comment 42

[Marcia Knous [:marcia]]

Here is the Breakpad crash information from my crash today: http://crash-stats.mozilla.com/report/index/9987da9e-2b34-11dc-afa9-001a4bd43e5c

Comment 43

[Tony Chung [:tchung]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; es-ES; rv:1.9a7pre) Gecko/2007070504 Minefield/3.0a7pre

I've also repro'd it on today's nightly when attempting to print a flash intensive page over the network.  (eg. engadget)
report at: http://crash-stats.mozilla.com/report/index/d4d0f8c2-2b36-11dc-a19a-001a4bd43e5c

should these last two attachments be reported in a separate bug since the original issue here was reported on talkback?

Seth, can you take a look?

Comment 44

[(not reading, please use [e-mail] instead)]

> Seth, can you take a look?

Tony I'm going to see if a Mac / Plugins expert (like josh) could help out here.

Comment 45

[Steven Michaud [:smichaud] (Retired)]

I crash 100% of the time when I try to print the site Marcia mentioned
(http://espn.go.com) in recent Minefield and Camino trunk nightlies (I
don't crash on the 1.8 branch).

But I just noticed something interesting -- I _don't_ crash (in
Camino) if I turn on Flashblock ("Block Flash animations" in the "Web
Features" tab), load http://espn.go.com, and then try to print.

This seems like an important clue.  Anyone have any idea what it
means?

Comment 46

[Steven Michaud [:smichaud] (Retired)]

> But I just noticed something interesting -- I _don't_ crash (in
> Camino) if I turn on Flashblock ("Block Flash animations" in the
> "Web Features" tab), load http://espn.go.com, and then try to print.

This may be less interesting than I first realized -- "Block Flash
animations" seems to block all Flash content, not just animations.

Comment 47

[Johnny Stenback (:jst)]

Based on the information seen so far it sounds like this is a flash player bug and not a firefox bug, it appears in both trunk and 2.0 builds, and always a couple of frames into flash code. Please renominate if there's information pointing more strongly at Firefox here (i.e. a regression window or similar).

Comment 48

[Michelle Sintov]

Did I miss a comment that said it happens in 2.0? I believe the most recent comments say it only happens on the trunk.

Comment 49

[Marcia Knous [:marcia]]

Michelle: I did not see the crash on 2.0.0.4 using the r60 version, and it looks as if Steven and Toli did not either. So right now it looks as if it is only present on the trunk with the r60 version.

(In reply to comment #48)
> Did I miss a comment that said it happens in 2.0? I believe the most recent
> comments say it only happens on the trunk.
> 

Comment 50

[Steven Michaud [:smichaud] (Retired)]

I'm pretty sure the printing problem is a bug on the trunk.  Crashes
also happen (also in ns4xPluginInstance::Print()) when printing pages
with at least one QuickTime object, in both Minefield and Camino.

I'll say more as I find out more.

Comment 51

[Steven Michaud [:smichaud] (Retired)]

I've opened bug 388082 to spin off the printing crashes from this bug.

I suspect the other bugs reported here (via crashlog) are completely
unrelated to bug 388082.  I also suspect these logs correspond to
several different, mutually unrelated bugs.  And I'm pretty sure there
isn't enough information here to resolve any of them (or even to
decide who's "at fault" -- the browser or the plugin).

Part of the reason I think this is that I believe _none_ of the
crashes reported here (or anywhere else, on any platform) actually
took place in Flash_EnforceLocalSecurity.  More about this in my next
comment.

Comment 52

[Steven Michaud [:smichaud] (Retired)]

As I said in my previous message, my current theory is that none of
the crashes reported (here or elsewhere) as happening in
Flash_EnforceLocalSecurity() actually take place in that function.  I
believe they're happening in one or more non-exported (static,
non-public) functions that gdb (and other debugging software) doesn't
know about.  But by chance the public (exported, non-static)
definition of Flash_EnforceLocalSecurity() is nearby in the Flash
plugin's machine code (it's the nearest public function above the
private function(s) where the crashes actually happen).  So gdb (and
other debugging software) "guesses" that the crashes happen in
Flash_EnforceLocalSecurity().

Flash_EnforceLocalSecurity() and its counterpart
Flash_DisableLocalSecurity() are documented by Adobe at
http://www.adobe.com/devnet/flash/articles/fplayer8_security_08.html.
According to what Adobe says, these functions appear to be optional
and for external use -- they'd only be called by a browser, and then
only if the browser wanted to change the Flash plugin's default
security behavior (quite unlikely).  They're also supposed to be
called as the Flash plugin is loaded (which usually happens only once
per browser session).  But the logs (posted here and elsewhere) that
seem to document crashes in Flash_EnforceLocalSecurity() imply that it
can be called at any time, and that it can even be called recursively
(that it can call itself).

What I think clinches the case, though, is the following experiment
that I performed:

I set a breakpoint (in ns4xPluginInstance::Print()) just before the
browser calls Flash's implementation of NPP_Print().  When gdb reached
that breakpoint, I set 'step-mode' to 'on' and kept issuing the 'step'
command until the crash happened.  The first few times I issued the
'step' command, gdb couldn't even guess the name of the function that
was currently running (Flash's non-exported implementation of
NPP_Print()), so after each command it displayed something like
"0x25903e64 in ??".

After a while the results of the step command changed to "0x297d4180
unuse_netscape_plugin_Plugin ()" (this is another of the Flash
plugin's public functions).  But the address of this symbol was
0x297d38a0, so I could tell that gdb wasn't actually running in
unuse_netscape_plugin_Plugin().  Later on the results of step changed
to "0x297d6eac in Flash_EnforceLocalSecurity ()".  But
Flash_EnforceLocalSecurity's actual address was 0x297d502c.  So gdb
was wrong once again.

Comment 53

[Steven Michaud [:smichaud] (Retired)]

[Oops, I dropped the following from my previous message.]

Among the first things I tried when I started to work on this bug was
to "break" on Flash_EnforceLocalSecurity in gdb -- which should make
gdb stop the program's execution whenever Flash_EnforceLocalSecurity
is called.  This never happened.

Comment 54

[Michelle Sintov]

Steven, you are correct, it is not Flash_EnforceLocalSecurity that is crashing. That is merely the closest symbol to the actual crash point.

Comment 56

[Steven Michaud [:smichaud] (Retired)]

Stuart, I'm not sure if it makes sense to dup other bugs to this one.

As I say in comment #51 and following, all that an (apparent) crash in
Flash_EnforceLocalSecurity means is that the crash took place
somewhere in the Flash plugin.  But that encompasses many different
kinds of mutually unrelated bugs.

(No crashes actually take place in Flash_EnforceLocalSecurity.)

Comment 57

[xarene]

I hope this is relevant here. I have not had flash problems, but FF is crashing with Quicktime (I think. i have had problems with non-Quicktime pages too). This is happening too frequently... 
Sites that crash 100% just to name a few which I've tested repeatedly.
http://www.vjbook.com
http://showstudio.com/projects/guy/guy_movies.html
http://www.ubu.com/aspen/aspen5and6/film.html

I have:
Intel Mac OS X 10.4.10
Firefox/2.0.0.5

I'm current on all my updates.

Comment 58

[Bob]

Flash will only work after most recent installation of Flash but will not work after program shutdown and restart.  
I am able to view Flash media but only after program restarted and only for one session. 

The media will not work until Flash re-installed and the browser is restarted.  
I have done this fifteen times.  

I have completely removed Firefox browser and re-installed it three times and each time the Flash media on every page where Flash is used there is a Quicktime symbol with a question mark in the center. Flash files will not display.  

Every other browser I have the Flash media files work fine.  Only works when I re-install Flash and then only that session.  

I have the latest version Mac OS 10.4.10 and the latest Flash and the latest Firefox (Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.8) Gecko/20071008 Firefox/2.0.0.8).  
I am running Power PC G5.

Comment 59

[xarene]

I take back my report #57... crash problem with FLASH not Quicktime. 
I am running latest OS X on MacBook Pro with latest Firefox and Flash. 
Flash media work only once and need re-installing repeatedly... exact problem as #58 report.

Comment 60

[Stuart Morgan]

(In reply to comment #56)
> Stuart, I'm not sure if it makes sense to dup other bugs to this one.
> 
> As I say in comment #51 and following, all that an (apparent) crash in
> Flash_EnforceLocalSecurity means is that the crash took place
> somewhere in the Flash plugin.  But that encompasses many different
> kinds of mutually unrelated bugs.

I'm not CC'd to this bug, so I hadn't seen this comment; I'm well aware of that, but the bug I duped here has an extremely similar offset pattern to several of the crashes here, which is strong evidence that if we had good symbol information the stacks would match. I duped based on that, not the symbol name that was showing up.

Comment 64

[Chris Lawson (gone)]

(In reply to comment #33)
> Created an attachment (id=265408) [details]
> crash on 5/16  from gen

That doesn't have any Flash code in it at all; I think that's probably a different bug (and it looks like it's in Flip4Mac code).

Comment 65

[Chris Lawson (gone)]

From a comment I made in one of the recently-duped bugs:

I wonder if maybe there are two distinct bugs here. Even allowing for the bogus offsets in the Flash plugin trace, the Gecko offsets seem legitimate. About half the stacks here are a crash with ns4xPluginInstance::Stop() as the last "good" symbol (which then leads into Flash code) and the other half are ns4xPluginInstance::HandleEvent().

Attachment 259179 [details], attachment 259266 [details], attachment 259292 [details], and attachment 264084 [details] are of the ::Stop() variety.

Attachment 259128 [details], attachment 259257 [details], attachment 259718 [details], and attachment 265408 [details]
are of the ::HandleEvent() variety.

cl

Comment 66

[Samuel Sidler (old account; do not CC)]

(In reply to comment #64)
> That doesn't have any Flash code in it at all; I think that's probably a
> different bug (and it looks like it's in Flip4Mac code).

Huh? The stack clearly has Flash in it and the URL in comment 34 has Flash on the page. I'm not sure what you're talking about...

Comment 67

[Chris Lawson (gone)]

Sorry, I meant the one in comment 32, which definitely crashed in the WMV plugin. Attachment 265407 [details].

cl

Comment 68

[Toli Kuznets]

Attachment: Crash log for FF 2.0.0.12 and Flash 9.0.115.0

Just got the same crash again while viewing a page
Crash log attached. 
This is in FF 2.0.0.12 with Flash 9.0.115.0
got a segfault coming from Flash_EnforceLocalSecurity

Comment 69

[Toli Kuznets]

On the plus side it seems to be reproducible off this link http://www.theimperialindia.com/home.htm 

In addition to that tab, i have Gmail/G-Calendar/Gmail-for-work/NYTimes.com open.

navigating to above page and clicking around after entering the Flash site crashes FF with the segfault coming from Flash.

Comment 70

[Chris Lawson (gone)]

That makes a fifth crash log in this bug where the browser appears -- and someone help me out here if this isn't an accurate assessment, since I don't know the plugin code that well -- to be asking a plugin to unload. That suggests (at least to me) that maybe the Flash plugin has a refcounting problem somewhere, that maybe it's trying to over-release something or it's releasing something early and then trying to use it later (which might explain the crazy-huge offsets, too).

I don't know if that helps, Michelle, but it might be worth a look. Can you guys reproduce Toli's latest crash yourselves?

Comment 71

[Michelle Sintov]

Toli, could you clarify your reproduction steps:
1. What are your sequence of clicks on theimperialindia.com? Or, is the crash truly random and you can't really list the steps?
2. When you say you have "Gmail/G-Calendar/Gmail-for-work/NYTimes.com" open, are you saying you have 4 additional tabs open? Do you need to have these items open to get the crash?

Comment 72

[Toli Kuznets]

Michelle, 
Unfortunately, I can no longer reliably reproduce the bug. 
At the time, i always had Gmail/g-cal/gmail-for-work open b/c that was always hardwired to start with those three.
I had just clicked on "enter the site" and then "history" or one of the other top-level links at the top, and it'd crash.

Doesn't seem to crash for me anymore. I'll post more information if i can reproduce it again. 

Comment 73

[Philip Machanick]

Another example (with FF 2.0.0.14, Mac OS X 10.4.11, Intel): at http://news.bbc.co.uk/2/hi/africa/7355538.stm I opened one of the videos on the side ("No answers"), viewed it, then went away to another tab. A fair amount of time later, the crash happened when I was typing into gmail.

I haven't investigated this systematically but similar crashes as I recall have only happened when the Flash content has been in a tab which is not currently visible.

I've been getting this particular crash since 2.0.0.12.

Let me know if more info e.g. crash log would be useful.

Comment 74

[massey]

This also happens on linux it appears, fedora core 4 and fedora 7,8. Happens randomly so no good steps to reproduce.
When loading or reloading a page after a debug built browser is running for a long time(maybe days) I get this:

WARNING: WriteDataCacheBlocks() failed., file /mnt/agnesOpt/kioskBrowser/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp, line 523
###!!! ASSERTION: Flush() failed: 'NS_SUCCEEDED(rv)', file /mnt/agnesOpt/kioskBrowser/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp, line 463
Break: at file /mnt/agnesOpt/kioskBrowser/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp, line 463
###!!! ASSERTION: deleting dirty buffer: 'mBufDirty == PR_FALSE', file /mnt/agnesOpt/kioskBrowser/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp, line 757
Break: at file /mnt/agnesOpt/kioskBrowser/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp, line 757
--DOMWINDOW == 11

++DOMWINDOW == 12

For application/x-shockwave-flash found plugin /root/.mozilla/plugins/libflashplayer.so
LoadPlugin() /root/.mozilla/plugins/libflashplayer.so returned b0ced28
nsPluginNativeWindowGtk2: NPPVpluginNeedsXEmbed=0
nsPluginNativeWindowGtk2: call SetWindow with xid=0x1a4eb6b
About to create new ws_info...
About to create new xtbin of 800 X 381 from 0xb05e980...
About to show xtbin(0xb058a10)...
completed gtk_widget_show(0xb058a10)
nsPluginNativeWindowGtk2: NPPVpluginNeedsXEmbed=0
nsPluginNativeWindowGtk2: call SetWindow with xid=0x1a4eb6b
nsPluginNativeWindowGtk2: NPPVpluginNeedsXEmbed=0
nsPluginNativeWindowGtk2: call SetWindow with xid=0x1a4eb6b

Program ./kiosk-bin (pid = 30728) received signal 11.

----------------------
kiosk-bin is just my custom firefox build. Tested also on recent ff3, 2.0.0.x

Comment 75

[massey]

Attachment: Crash backtrace

Flash plugin crash backtrace from linux. This crash only seems to happen right after assertions from nsDiskCacheStreams.cpp

Comment 76

[massey]

I have put up a testcase html page that reloads an swf every 10 seconds that will trigger the crash on linux. The testcase does not seem to crash ff on mac(osX 10.4.11) but causes ff to stop displaying the video and makes the browser unresponsive, non functional

Test case link: http://stlouis-shopper.com/~massey/flashcrash/flashCrasher.html

Load the page and just let it run, reloading every 10 seconds, in a while ff will crash on linux and on mac will become non functional

Comment 77

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Was anyone able to reproduce the crash with the latest Flash Player v10 meanwhile? There are no reports with this stack listed on Soccorro.

Comment 78

[Chris Lawson (gone)]

I've seen a similar crash once since I started using Flash 10, but given the bogus offset issues, I can't be certain it was really the same thing. I also don't remember if it was on Intel or PPC. (I can't find it on my PPC machine, so maybe it was Intel.) I vaguely recall that the circumstances were similar -- a crash substantially after loading some Flash content, maybe while closing the tab in which it was loaded.

I certainly don't see this with anywhere near the regularity people were once seeing it, and I didn't see it again on re-visiting the page that caused it the one time I did see it.

Comment 79

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Chris, can you check with about:crashes if the specific crash report is still listed?

Comment 80

[Chris Lawson (gone)]

Sorry, meant to mention that this was in Camino, and if it was on the Intel, I won't have access to that machine again until at least the 29th.

Comment 81

[Bob Clary [:bc] (inactive)]

crashes in Flash_EnforceLocalSecurity are a catch all for any number of different bugs in Flash. 1.8 isn't supported anymore and I can't reproduce this on wsj with Mac with Flash 10.0.32.18. -> WFM

Comment 83

[BMO Automation]

Version and milestone values are being reset to defaults as part of product refactoring.