572995 - Crash [@ FlashPlayer-10.4-10.5@0x35e898][@ FlashPlayer-10.6@0x3e2fa5][@ NPSWF32.dll@0x13d723]

Status: RESOLVED FIXED

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect, P1)

Description

[Bob Clary [:bc] (inactive)]

Steps to reproduce:

1. load http://www.lovevelo.co.uk/
2. crash

Crashes Mac ppc|x86, WinXP
Flash 10.1.53.64

example crash report bp-10669ca7-be94-4f7b-a8d1-77c912100616

Stack on Mac 10.5 intel

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000008
0x221c6a50 in dyld_stub_vm_purgable_control ()
(gdb) bt
#0  0x221c6a50 in dyld_stub_vm_purgable_control ()
#1  0x1cc3e000 in ?? ()
#2  0x22134468 in dyld_stub_vm_purgable_control ()
#3  0x22060378 in dyld_stub_vm_purgable_control ()
#4  0x2213664f in dyld_stub_vm_purgable_control ()
#5  0x2205d5aa in dyld_stub_vm_purgable_control ()
#6  0x220ff46c in dyld_stub_vm_purgable_control ()
#7  0x220ffb21 in dyld_stub_vm_purgable_control ()
#8  0x22147308 in dyld_stub_vm_purgable_control ()
#9  0x221f8e66 in dyld_stub_vm_purgable_control ()
#10 0x222189de in FlashPlayer_10_1_53_64_FlashPlayer ()
#11 0x04b03726 in nsNPAPIPluginStreamListener::OnDataAvailable (this=0x1c865180, pluginInfo=0x2097b854, input=0x1c898300, length=0) at /work/mozilla/builds/1.9.3/mozilla/modules/plugin/base/src/nsNPAPIPluginInstance.cpp:671
#12 0x04b17035 in nsPluginStreamListenerPeer::OnDataAvailable (this=0x2097b840, request=0x1c834e30, aContext=0x0, aIStream=0x1c898300, sourceOffset=91472, aLength=1340) at /work/mozilla/builds/1.9.3/mozilla/modules/plugin/base/src/nsPluginHost.cpp:1191
#13 0x03bb189e in nsStreamListenerTee::OnDataAvailable (this=0x20981420, request=0x1c834e30, context=0x0, input=0x1c889d0c, offset=91472, count=1340) at /work/mozilla/builds/1.9.3/mozilla/netwerk/base/src/nsStreamListenerTee.cpp:111
#14 0x03c50c4c in nsHttpChannel::OnDataAvailable (this=0x1c834e00, request=0x1c88a530, ctxt=0x0, input=0x1c889d0c, offset=91472, count=1340) at /work/mozilla/builds/1.9.3/mozilla/netwerk/protocol/http/nsHttpChannel.cpp:5399
#15 0x03b7d275 in nsInputStreamPump::OnStateTransfer (this=0x1c88a530) at /work/mozilla/builds/1.9.3/mozilla/netwerk/base/src/nsInputStreamPump.cpp:510
#16 0x03b7d7d0 in nsInputStreamPump::OnInputStreamReady (this=0x1c88a530, stream=0x1c889d0c) at /work/mozilla/builds/1.9.3/mozilla/netwerk/base/src/nsInputStreamPump.cpp:400
#17 0x04f55a70 in nsInputStreamReadyEvent::Run (this=0x21c906c0) at /work/mozilla/builds/1.9.3/mozilla/xpcom/io/nsStreamUtils.cpp:112
#18 0x04f85d8c in nsThread::ProcessNextEvent (this=0xa17240, mayWait=0, result=0xbfffd354) at /work/mozilla/builds/1.9.3/mozilla/xpcom/threads/nsThread.cpp:547
#19 0x04f14664 in NS_ProcessPendingEvents_P (thread=0xa17240, timeout=20) at nsThreadUtils.cpp:200
#20 0x04d01e15 in nsBaseAppShell::NativeEventCallback (this=0x16d35a0) at /work/mozilla/builds/1.9.3/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:126
#21 0x04cb1cff in nsAppShell::ProcessGeckoEvents (aInfo=0x16d35a0) at /work/mozilla/builds/1.9.3/mozilla/widget/src/cocoa/nsAppShell.mm:394
#22 0x9125f3c5 in CFRunLoopRunSpecific ()
#23 0x9125faa8 in CFRunLoopRunInMode ()
#24 0x938ac2ac in RunCurrentEventLoopInMode ()
#25 0x938ac0c5 in ReceiveNextEventCommon ()
#26 0x938abf39 in BlockUntilNextEventMatchingListInMode ()
#27 0x973f86d5 in _DPSNextEvent ()
#28 0x973f7f88 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#29 0x973f0f9f in -[NSApplication run] ()

Comment 1

[Paul Betlem]

I can confirm the crash. I'll get this assigned today.

Comment 2

[Paul Betlem]

This issue was filed internally as #2647027. We've identified the issue. There is an error in the ActionScript for the web site (as they're passing invalid data to a play() function). Previously, this failed silently. The new version results in a crash. The crash has been fixed and will be available in our next update. Thanks for filing the bug, Bob.

Comment 3

[BMO Automation]

Version and milestone values are being reset to defaults as part of product refactoring.