476580 - Crash when visiting Blackberry site while spoofing as IE [@ Flash Player@0x38efcf]

Status: RESOLVED FIXED

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[Chris Lawson (gone)]

While investigating bug 476551, I visited http://na.blackberry.com/eng/update/ and spoofed my UA as IE. Camino pretty much immediately crashed and launched Talkback.

I know we don't "support" spoofing, but we shouldn't be crashing if we get IE-specific code, either. :-p

I doubt the stacks are of much help, but I'll attach it just in case. Flash is in both reports, but not in the crashed thread (which looks sort of bogus to me anyway).

Comment 1

[Chris Lawson (gone)]

Attachment: First crash report

Comment 2

[Chris Lawson (gone)]

Attachment: Second crash report

Comment 3

[Chris Lawson (gone)]

Attachment: Crash report from a totally clean profile, only this bug and Blackberry site open

Comment 4

[Chris Lawson (gone)]

This crashes Firefox 3 as well.

http://crash-stats.mozilla.com/report/index/522bc6eb-6efe-444c-b3db-877632090202

Definitely Flash, so kicking to Core and cc'ing msintov.

Comment 5

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Attachment: Cm2 debug/Intel

Also crashes for me on Intel.  I see the "This page reguires IE 5.5 running on Windows; please use IE" page while waiting on the beachball to become a crash.

Comment 6

[Chris Lawson (gone)]

http://crash-stats.mozilla.com/report/index/f1cc59b8-58f8-407b-aaa6-261e32090202?p=1

with a totally fresh Fx profile, too, just in case that's useful. Wheeeeee! Guess I'll confirm this...

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to comment #6)
> http://crash-stats.mozilla.com/report/index/f1cc59b8-58f8-407b-aaa6-261e32090202?p=1

Socorro can't pull that crash up .. "we are processing".

can you reproduce with v3.5 or soon to be v3.6?

Comment 8

[Chris Lawson (gone)]

(In reply to comment #7)
> (In reply to comment #6)
> > http://crash-stats.mozilla.com/report/index/f1cc59b8-58f8-407b-aaa6-261e32090202?p=1
> 
> Socorro can't pull that crash up .. "we are processing".

Probably because it's been eight months since it was filed :-p

> can you reproduce with v3.5 or soon to be v3.6?

Yep.

http://crash-stats.mozilla.com/report/pending/fb498728-249c-4e7c-8039-275472091014

Comment 9

[Wayne Mery (:wsmwk)]

msintov, does this help?

bp-fb498728-249c-4e7c-8039-275472091014
0	Flash Player	Flash Player@0x38efcf	
1	Flash Player	Flash Player@0x2ebd42	
2	XUL	nsNPAPIPluginInstance::SetWindow	modules/plugin/base/src/nsNPAPIPluginInstance.cpp:1085
3	XUL	nsPluginNativeWindow::CallSetWindow	nsPluginNativeWindow.h:99
4	XUL	nsObjectFrame::CallSetWindow	layout/generic/nsObjectFrame.cpp:999
5	XUL	nsObjectFrame::Instantiate	layout/generic/nsObjectFrame.cpp:1832
6	XUL	nsObjectLoadingContent::Instantiate	content/base/src/nsObjectLoadingContent.cpp:1768
7	XUL	nsObjectLoadingContent::EnsureInstantiation	content/base/src/nsObjectLoadingContent.cpp:783
8	XUL	nsHTMLPluginObjElementSH::GetPluginInstanceIfSafe	dom/src/base/nsDOMClassInfo.cpp:9251
9	XUL	nsHTMLPluginObjElementSH::NewResolve	dom/src/base/nsDOMClassInfo.cpp:9792
10	XUL	XPC_WN_Helper_NewResolve	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1074
11	libmozjs.dylib	js_LookupPropertyWithFlags	js/src/jsobj.cpp:3851
12	libmozjs.dylib	js_GetPropertyHelper	js/src/jsobj.cpp:4258
13	libmozjs.dylib	js_Interpret	js/src/jsinterp.cpp:4449
14	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1394

Comment 10

[Chris Lawson (gone)]

Tangentially related question: is there any chance we might be able to get symbols for Flash, since we have so many Flash crash bugs in Bugzilla?

Comment 11

[Wayne Mery (:wsmwk)]

Chris, what version of flash?

Comment 12

[Chris Lawson (gone)]

about:plugins says 10.0r32; I'm not sure exactly which build that equates to but I'm pretty sure it's the most recent release version available.

Comment 13

[Michelle Sintov]

Unfortunately, we can't make the Flash Player symbols available.

Can you explain to me why it is important that Camino be able to spoof as IE? I assume you mean Internet Explorer for Mac, which is not supported by the Flash Player.

Comment 14

[Chris Lawson (gone)]

(In reply to comment #13)
> Unfortunately, we can't make the Flash Player symbols available.

That's what I figured, but I thought I'd ask ;)

> Can you explain to me why it is important that Camino be able to spoof as IE?

It generally isn't, but when you have poorly designed sites like the one targeted by TE bug 476551, it is unfortunately sometimes necessary. Regardless, that question is really orthogonal to the larger issue here: that Flash is crashing the browser and it shouldn't be.

Comment 15

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

We're seeing some incidents of crashes with this signature in Camino 2.0 (currently about 1% of crashes); it's possible they're all spoofing as IE, but it seems more likely to me that there could be other causes.  Comments aren't helpful: "doing google search", "Browsing facebook."

Comment 16

[Michelle Sintov]

I don't reproduce this with Firefox 3.5.5 on Mac OS 10.5.8 with Flash Player 10.0.32 (same Flash Player referenced in comment 12). Do you repro it in this version of Firefox or ? Thanks.

Comment 17

[Chris Lawson (gone)]

I just reproduced it in 3.5.5 on 10.5.8. Note that you must spoof as IE to cause the crash; if your UA string is still the default Firefox string, it won't crash. Same version of Flash as before; I haven't updated anything there yet.

http://crash-stats.mozilla.com/report/index/8c36fec5-ba21-4aba-a576-614212091124

for people following along on crash-stats.

Comment 18

[Michelle Sintov]

I've filed this in the Flash Player bugbase as internal bug #2491530. Thanks for the bug report.

Comment 19

[Chris Lawson (gone)]

(In reply to comment #18)
> I've filed this in the Flash Player bugbase as internal bug #2491530. Thanks
> for the bug report.

Is that bug report viewable anywhere at bugs.adobe.com (with a login)? I can't find it.

cl

Comment 20

[Charles]

Fixed in our recent beta release of Flash Player 10.1. Download it now:

http://labs.adobe.com/downloads/flashplayer10.html

Comment 21

[Charles]

(In reply to comment #19)
> (In reply to comment #18)
> > I've filed this in the Flash Player bugbase as internal bug #2491530. Thanks
> > for the bug report.
> 
> Is that bug report viewable anywhere at bugs.adobe.com (with a login)? I can't
> find it.
> 
> cl

No its not Chris.  Its an internal database only.

Comment 22

[BMO Automation]

Version and milestone values are being reset to defaults as part of product refactoring.