Closed Bug 453787 Opened 16 years ago Closed 16 years ago

<object> with pdf inside div crashes firefox on div remove from dom/tab close/navigation (adobe 8.21 or 9.x plugin)

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Version:
3.0 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 434593

People

(Reporter: fabalint, Unassigned)

References

Details

(Keywords: crash) 

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; hu; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1

The error occurs when the plugin is closing.
The test HTML is (Info.pdf is valid, displayable, crashfree when I click on it inside firefox):


<html>
  <head>
  </head>
  <body>
    <div>
      <OBJECT DATA="./info.pdf" TYPE="application/pdf" WIDTH="100%" HEIGHT="100%">
        Please install pdf plugin or download the file... <a href="./info.pdf">here</a>
      </OBJECT>
    </div>
  </body>
</html>

Reproducible: Always

Steps to Reproduce:
1.Open the html page with the contents in the details field
2.Navigate back/forward, or remove the div any other ways from the page.
3.Crash.
Actual Results:  
The crash handler appeared :)

Expected Results:  
I expect to use the browser to look at more pdfs and maybe other websites also.

Default installation, adobe 8.21 or 9.x plugin. (here 8.21)

Add-ons: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03,{c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.6,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1
BuildID: 2008070208
CrashTime: 1220603121
Email: fabalint@gmail.com
InstallTime: 1220601266
ProductName: Firefox
SecondsSinceLastCrash: 849
StartupTime: 1220603111
Theme: classic/1.0
UserID: ff36c4f2-3440-46dd-9614-27aa54c862f0
Vendor: Mozilla
Version: 3.0.1
Version: unspecified → 3.0 Branch
Keywords: crash
We need the crash ID of the crash and not the crash details, see http://mversen.de/crash/
Oops, misunderstood somathing, here they are:
4b73d445-7b58-11dd-a8c3-001cc4e2bf68
1b910e87-7b58-11dd-8a7c-001a4bd43ef6
Earlier, similar:
5fa55833-7b23-11dd-ab8c-0013211cbf8a
9765e754-7b21-11dd-b6a2-001321b13766
1b910e87-7b58-11dd-8a7c-001a4bd43ef6:
0  	mozcrt19.dll  	arena_dalloc_small  	
1 	mozcrt19.dll 	arena_dalloc 	
2 	mozcrt19.dll 	free 	
3 	js3250.dll 	js_GC 	
4 	js3250.dll 	JS_GC 	
5 	xul.dll 	nsXPConnect::Collect 	
6 	xul.dll 	nsCycleCollector::Collect 	
7 	xul.dll 	nsCycleCollector_collect 	
8 	xul.dll 	nsJSContext::CC 	
9 	xul.dll 	xul.dll@0x2ce090 	

4b73d445-7b58-11dd-a8c3-001cc4e2bf68 :
0  	js3250.dll  	js_DefineNativeProperty  	
1 	js3250.dll 	js_DefineProperty 	
2 	js3250.dll 	DefineProperty 	
3 	js3250.dll 	JS_DefineProperty 	
4 	xul.dll 	xul.dll@0x7b87ef 	

5fa55833-7b23-11dd-ab8c-0013211cbf8a :
0  	xul.dll  	nsRecyclingAllocator::Malloc  	
1 	xul.dll 	nsSegmentedBuffer::AppendNewSegment 	
2 	xul.dll 	nsPipe::GetWriteSegment 	
3 	xul.dll 	nsPipeOutputStream::WriteSegments 	
4 	xul.dll 	nsAStreamCopier::Process 	
5 	xul.dll 	nsAStreamCopier::Run 	
6 	xul.dll 	nsThreadPool::Run 	
7 	xul.dll 	nsThread::ProcessNextEvent 	
8 	xul.dll 	nsThread::ThreadFunc 	
9 		@0x15fff6b

9765e754-7b21-11dd-b6a2-001321b13766 :
0  	freebl3.dll  	HMAC_Update  	
1 	user32.dll 	InternalCallWinProc 	
2 	user32.dll 	UserCallWinProcCheckWow 	
3 	user32.dll 	CallWindowProcAorW 	
4 	user32.dll 	CallWindowProcA 	
5 	nppdf32.dll 	nppdf32.dll@0x68ee 	
6 	user32.dll 	InternalCallWinProc 	
7 	user32.dll 	UserCallWinProcCheckWow 	
8 	user32.dll 	DispatchClientMessage 	
9 	user32.dll 	__fnDWORD 	
10 	ntdll.dll 	KiUserCallbackDispatcher 	
11 	nppdf32.dll 	nppdf32.dll@0x67e4 	
12 	user32.dll 	RealDefWindowProcW 	
13 	user32.dll 	DefWindowProcW 	
14 	user32.dll 	InternalCallWinProc 	
15 	user32.dll 	UserCallWinProcCheckWow 	
16 	user32.dll 	CallWindowProcAorW 	
17 	user32.dll 	CallWindowProcW 	
18 	xul.dll 	nsWindow::WindowProc
Severity: normal → critical
One more ID: 32db6794-7b67-11dd-bfd9-001cc4e2bf68
1st step: view pdf in div,
2nd: remove div from dom;
3rd: tab change to the previous and back (or minimize then maximise the browser);
result: visual problems, some parts of  the page are missing, some are there some are not (images an others); hover over a button works but on click comes the crash.
Summary: <object> with pdf inside div crashes firefox on div remove from dom/tab close/navigation → <object> with pdf inside div crashes firefox on div remove from dom/tab close/navigation (adobe 8.21 or 9.x plugin)
rsherry, can you look into bp-9765e754-7b21-11dd-b6a2-001321b13766 ?
Aoobe PDF-Plugin version in "Raw Dump".
> Module|nppdf32.dll|8.1.0.137|Nppdf32.pdb|(snip)
Marked as duplicate, it's the same problem as bug 434593.
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
Someone please check if the duping of bug 478005 is correct because I can't access bug 434593 - Thanks
The fourth crash, with "CallWindowProcW" on the stack, is definitely the same as 434593.  The others don't look like duplicates.  The two with malloc would, IMHO, indicate a corrupted heap.  434593 is not a heap-smashing bug but a call-to-obsolete-pointer bug.
You need to log in before you can comment on or make changes to this bug.