404105 - Crash in [@ Flash Player@0x38fcf9 0x1c95bcf9] clicking "Next Channel" rapidly on justin.tv, using Shockwave Flash 9.0 r98

Status: RESOLVED WORKSFORME

(Plugins Graveyard :: Shockwave (Adobe), defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b2pre) Gecko/2007111604 Minefield/3.0b2pre

Summary: Crash in [@ Flash Player@0x38fcf9 0x1c95bcf9] clicking "Next Channel" rapidly on justin.tv, using Shockwave Flash 9.0 r98

Sorry for the egregiously long and convoluted summary; I was going for discoverability in Bugzilla.

Steps to Reproduce:

1. On Mac trunk, install Shockwave Flash 9.0 r98 from http://labs.adobe.com/technologies/flashplayer9/
2. From the top bar on http://www.justin.tv, load any content feed.
3. Rapidly and repeatedly click "Next Channel"

Expected Results:

Browser stays alive

Actual Results:

We die, here:

0  	Flash Player@0x38fcf9  	
1 	Flash Player@0x3bf79c 	
2 	Flash Player@0xdc821 	
3 	Flash Player@0xdcf40 	
4 	Flash Player@0xdd670 	
5 	Flash Player@0x38e853 	
6 	libSystem.B.dylib@0x24226

See http://crash-stats.mozilla.com/report/index/d576d3a1-949d-11dc-9be8-001a4bd43ed6?date=2007-11-16-23 for the "full" stack information.

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Josh, this looks a lot like a flashplayer bug right? Anything pointing towards that it would be us?

Michelle: Is this something that adobe would want to look at?

Comment 2

[Michelle Sintov]

Thanks for the bug report. The Flash Player team will investigate.

Comment 3

[Michelle Sintov]

We do not reproduce this bug with Firefox 2.0 on Mac Intel (or on PPC, for that matter). Do you see the same? If yes, then it seems like the bug was injected on the trunk.

Comment 4

[Marcia Knous [:marcia]]

I just tested this on the trunk today using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b2pre) Gecko/2007112904 Minefield/3.0b2pre on Leopard, I don't get a crash when follow the STR and using r98.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Still happens, even with 9.0.115: http://crash-stats.mozilla.com/report/index/a6a087d7-a310-11dc-b704-001a4bd46e84?date=2007-12-05-09

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

The interesting part of the stack seems to be:

.
.
Flash Player@0x3a8668
ns4xPluginInstance::Stop()             ns4xPluginInstance.cpp:938
DoStopPlugin(nsPluginInstanceOwner*)   nsLineBox.cpp:1526
nsObjectFrame::StopPluginInternal(int) nsLineBox.cpp:1596
nsObjectFrame::Destroy()               nsLineBox.cpp:528
.
.

Above that is just flash frames, below is just frame teardown code.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

I gave this a thorough thrashing, and can no longer reproduce.  -> wfm.