Closed Bug 453787 Opened 16 years ago Closed 16 years ago

<object> with pdf inside div crashes firefox on div remove from dom/tab close/navigation (adobe 8.21 or 9.x plugin)

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Version:
3.0 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 434593

People

(Reporter: fabalint, Unassigned)

References

Details

(Keywords: crash)

User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; hu; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1 The error occurs when the plugin is closing. The test HTML is (Info.pdf is valid, displayable, crashfree when I click on it inside firefox): <html> <head> </head> <body> <div> <OBJECT DATA="./info.pdf" TYPE="application/pdf" WIDTH="100%" HEIGHT="100%"> Please install pdf plugin or download the file... <a href="./info.pdf">here</a> </OBJECT> </div> </body> </html> Reproducible: Always Steps to Reproduce: 1.Open the html page with the contents in the details field 2.Navigate back/forward, or remove the div any other ways from the page. 3.Crash. Actual Results: The crash handler appeared :) Expected Results: I expect to use the browser to look at more pdfs and maybe other websites also. Default installation, adobe 8.21 or 9.x plugin. (here 8.21) Add-ons: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03,{c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.6,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1 BuildID: 2008070208 CrashTime: 1220603121 Email: fabalint@gmail.com InstallTime: 1220601266 ProductName: Firefox SecondsSinceLastCrash: 849 StartupTime: 1220603111 Theme: classic/1.0 UserID: ff36c4f2-3440-46dd-9614-27aa54c862f0 Vendor: Mozilla Version: 3.0.1
Version: unspecified → 3.0 Branch
Keywords: crash
We need the crash ID of the crash and not the crash details, see http://mversen.de/crash/
Oops, misunderstood somathing, here they are: 4b73d445-7b58-11dd-a8c3-001cc4e2bf68 1b910e87-7b58-11dd-8a7c-001a4bd43ef6 Earlier, similar: 5fa55833-7b23-11dd-ab8c-0013211cbf8a 9765e754-7b21-11dd-b6a2-001321b13766
1b910e87-7b58-11dd-8a7c-001a4bd43ef6: 0 mozcrt19.dll arena_dalloc_small 1 mozcrt19.dll arena_dalloc 2 mozcrt19.dll free 3 js3250.dll js_GC 4 js3250.dll JS_GC 5 xul.dll nsXPConnect::Collect 6 xul.dll nsCycleCollector::Collect 7 xul.dll nsCycleCollector_collect 8 xul.dll nsJSContext::CC 9 xul.dll xul.dll@0x2ce090 4b73d445-7b58-11dd-a8c3-001cc4e2bf68 : 0 js3250.dll js_DefineNativeProperty 1 js3250.dll js_DefineProperty 2 js3250.dll DefineProperty 3 js3250.dll JS_DefineProperty 4 xul.dll xul.dll@0x7b87ef 5fa55833-7b23-11dd-ab8c-0013211cbf8a : 0 xul.dll nsRecyclingAllocator::Malloc 1 xul.dll nsSegmentedBuffer::AppendNewSegment 2 xul.dll nsPipe::GetWriteSegment 3 xul.dll nsPipeOutputStream::WriteSegments 4 xul.dll nsAStreamCopier::Process 5 xul.dll nsAStreamCopier::Run 6 xul.dll nsThreadPool::Run 7 xul.dll nsThread::ProcessNextEvent 8 xul.dll nsThread::ThreadFunc 9 @0x15fff6b 9765e754-7b21-11dd-b6a2-001321b13766 : 0 freebl3.dll HMAC_Update 1 user32.dll InternalCallWinProc 2 user32.dll UserCallWinProcCheckWow 3 user32.dll CallWindowProcAorW 4 user32.dll CallWindowProcA 5 nppdf32.dll nppdf32.dll@0x68ee 6 user32.dll InternalCallWinProc 7 user32.dll UserCallWinProcCheckWow 8 user32.dll DispatchClientMessage 9 user32.dll __fnDWORD 10 ntdll.dll KiUserCallbackDispatcher 11 nppdf32.dll nppdf32.dll@0x67e4 12 user32.dll RealDefWindowProcW 13 user32.dll DefWindowProcW 14 user32.dll InternalCallWinProc 15 user32.dll UserCallWinProcCheckWow 16 user32.dll CallWindowProcAorW 17 user32.dll CallWindowProcW 18 xul.dll nsWindow::WindowProc
Severity: normal → critical
One more ID: 32db6794-7b67-11dd-bfd9-001cc4e2bf68 1st step: view pdf in div, 2nd: remove div from dom; 3rd: tab change to the previous and back (or minimize then maximise the browser); result: visual problems, some parts of the page are missing, some are there some are not (images an others); hover over a button works but on click comes the crash.
Summary: <object> with pdf inside div crashes firefox on div remove from dom/tab close/navigation → <object> with pdf inside div crashes firefox on div remove from dom/tab close/navigation (adobe 8.21 or 9.x plugin)
rsherry, can you look into bp-9765e754-7b21-11dd-b6a2-001321b13766 ?
Aoobe PDF-Plugin version in "Raw Dump". > Module|nppdf32.dll|8.1.0.137|Nppdf32.pdb|(snip)
Marked as duplicate, it's the same problem as bug 434593.
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
Someone please check if the duping of bug 478005 is correct because I can't access bug 434593 - Thanks
The fourth crash, with "CallWindowProcW" on the stack, is definitely the same as 434593. The others don't look like duplicates. The two with malloc would, IMHO, indicate a corrupted heap. 434593 is not a heap-smashing bug but a call-to-obsolete-pointer bug.
You need to log in before you can comment on or make changes to this bug.