crash when javascript controls flash embedding

RESOLVED WORKSFORME

Status

()

Core
Plug-ins
--
critical
RESOLVED WORKSFORME
17 years ago
16 years ago

People

(Reporter: rohan.hart, Assigned: serge (gone))

Tracking

Trunk
x86
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(3 attachments)

(Reporter)

Description

17 years ago
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; IRIX 6.5 IP32; en-US; rv:0.9+) Gecko/20010507
BuildID:    2001050721

Mozilla crashes after the page is disaplyed, apparently when the onLoad triggers.

Under Netscape 4.6 the center of the page is replaced by several objects
depending on the mouse's location, at least one of which is a shockwave movie.
The shockwave plug-in is not installed.

Turning off javascript stops Mozilla from crashing.


Reproducible: Always
Steps to Reproduce:
1.Go to http://www.itpapers.com/


Actual Results:  Page is displayed and then promptly crashes

Expected Results:  Page is displayed

The last messages on the console before the crash are:

Document http://www.itpapers.com/ loaded successfully
Gtk-WARNING **: invalid cast from (NULL) pointer to `GtkXtBin'

Gtk+ is 1.2.10

The stack trace is:

#0 0x44c187c in ns4xPluginInstance::SetWindow ()
#1 0x62b2c04 in nsObjectFrame::DidReflow ()
#2 0x62aaa50 in nsLineLayout::ReflowFrame ()
#3 0x62a3e1c in nsInlineFrame::ReflowInlineFrame ()
#4 0x62a3a10 in nsInlineFrame::ReflowFrames ()
#5 0x62a3658 in nsInlineFrame::Reflow ()
#6 0x62aa43c in nsLineLayout::ReflowFrame ()
#7 0x6266f40 in nsBlockFrame::ReflowInlineFrame ()
#8 0x626680c in nsBlockFrame::DoReflowInlineFrames ()
#9 0x6266b8c in nsBlockFrame::DoReflowInlineFramesAuto ()
#10 0x6266620 in nsBlockFrame::ReflowInlineFrames ()
#11 0x62650d8 in nsBlockFrame::ReflowLine ()
#12 0x62646a4 in nsBlockFrame::ReflowDirtyLines ()
#13 0x6261888 in nsBlockFrame::Reflow ()
#14 0x6259e00 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame ()
#15 0x6259a38 in nsAbsoluteContainingBlock::IncrementalReflow ()
#16 0x6261304 in nsBlockFrame::Reflow ()
#17 0x62736d0 in nsContainerFrame::ReflowChild ()
#18 0x628daa4 in CanvasFrame::Reflow ()
#19 0x628daa4 in CanvasFrame::Reflow ()
#20 0x628daa4 in CanvasFrame::Reflow ()
...

Comment 1

17 years ago
There is a flash movie embedded on this page. This crashes on my linux build 
from today all the time (0508). Works ok on windows and mac trunk. 
chaiging polatform to PC/Linux. 

 
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: IRIX → Linux
Hardware: SGI → PC

Comment 2

17 years ago
cc: peter
Summary: crash when javascript controls plug-in display → crashes while loading page with flash

Comment 3

17 years ago
stack :

Call Stack:    (Signature = ns4xPluginInstance::SetWindow() 956c6f9e) 
     
   ns4xPluginInstance::SetWindow() 
                                                     
     
   nsObjectFrame::DidReflow() 
                                                     
     
   nsLineLayout::ReflowFrame() 
                                                     
     
   nsInlineFrame::ReflowInlineFrame() 
                                                     
     
   nsInlineFrame::ReflowFrames() 
                                                     
     
   nsInlineFrame::Reflow() 
                                                     
     
   nsLineLayout::ReflowFrame() 
                                                     
     
   nsBlockFrame::ReflowInlineFrame() 
                                                     
     
   nsBlockFrame::DoReflowInlineFrames() 
                                                     
     
   nsBlockFrame::DoReflowInlineFramesAuto() 
                                                     
     
   nsBlockFrame::ReflowInlineFrames() 
                                                     
     
   nsBlockFrame::ReflowLine() 
                                                     
     
   nsBlockFrame::ReflowDirtyLines() 
                                                     
     
   nsBlockFrame::Reflow() 
                                                     
     
   nsAbsoluteContainingBlock::ReflowAbsoluteFrame() 
                                                     
     
   nsAbsoluteContainingBlock::IncrementalReflow() 
                                                     
     
   nsBlockFrame::Reflow() 
                                                     
     
   nsContainerFrame::ReflowChild() 
                                                     
     
   CanvasFrame::Reflow() 
                                                     
     
   nsBoxToBlockAdaptor::Reflow() 
                                                     
     
   nsBoxToBlockAdaptor::DoLayout() 
                                                     
     
   nsBox::Layout() 
                                                     
     
   nsScrollBoxFrame::DoLayout() 
                                                     
     
   nsBox::Layout() 
                                                     
     
   nsContainerBox::LayoutChildAt() 
                                                     
     
   nsGfxScrollFrameInner::LayoutBox() 
                                                     
     
   nsGfxScrollFrameInner::Layout() 
                                                     
     
   nsGfxScrollFrame::DoLayout() 
                                                     
     
   nsBox::Layout() 
                                                     
     
   nsBoxFrame::Reflow() 
                                                     
     
   nsGfxScrollFrame::Reflow() 
                                                     
     
   nsContainerFrame::ReflowChild() 
                                                     
     
   ViewportFrame::Reflow() 
                                                     
     
   nsHTMLReflowCommand::Dispatch() 
                                                     
     
   PresShell::ProcessReflowCommand() 
                                                     
     
   PresShell::ProcessReflowCommands() 
                                                     
     
   PresShell::FlushPendingNotifications() 
                                                     
     
   nsEventStateManager::FlushPendingEvents() 
                                                     
     
   nsEventStateManager::GenerateDragGesture() 
                                                     
     
   nsEventStateManager::PreHandleEvent() 
                                                     
     
   PresShell::HandleEventInternal() 
                                                     
     
   PresShell::HandleEvent() 
                                                     
     
   nsView::HandleEvent() 
                                                     
     
   nsView::HandleEvent() 
                                                     
     
   nsView::HandleEvent() 
                                                     
     
   nsViewManager::DispatchEvent() 
                                                     
     
   HandleEvent() 
                                                     
     
   nsWidget::DispatchEvent() 
                                                     
     
   nsWidget::DispatchWindowEvent() 
                                                     
     
   nsWidget::DispatchMouseEvent() 
                                                     
     
   nsWidget::OnMotionNotifySignal() 
                                                     
     
   nsWindow::HandleGDKEvent() 
                                                     
     
   dispatch_superwin_event() 
                                                     
     
   handle_gdk_event() 
                                                     
     
   libgdk-1.2.so.0 + 0x1700b (0x4070400b) 
                                                     
     
   libglib-1.2.so.0 + 0xfbe6 (0x4072ebe6) 
                                                     
     
   libglib-1.2.so.0 + 0x101a1 (0x4072f1a1) 
                                                     
     
   libglib-1.2.so.0 + 0x10341 (0x4072f341) 
                                                     
     
   libgtk-1.2.so.0 + 0x8c209 (0x40659209) 
                                                     
     
   nsAppShell::Run() 
                                                     
     
   nsAppShellService::Run() 
                                                     
     
   main1() 
                                                     
     
   main() 
                                                     
     
   libc.so.6 + 0x181eb (0x401ef1eb) 
                                                     


 Registers: 
 EAX:
      00000000
                     EBX:
                          40fa64f8
                                         ECX:
                                              00000000
                                                             ED

Comment 4

17 years ago
cc:ing Serge, weren't you looking at something like this?
(Reporter)

Comment 5

17 years ago
I don't get a crash when accessing a simple page with embedded flash - this only
occurs when the embedded flash is swapped in and out by the javascript.
Summary: crashes while loading page with flash → crash when javascript controls flash embedding
(Assignee)

Comment 6

17 years ago
No, I haven't seen something like this before.
Gtk-WARNING **: invalid cast from (NULL) pointer to `GtkXtBin'
comes from here
http://lxr.mozilla.org/seamonkey/source/modules/plugin/nglsrc/ns4xPluginInstance.cpp#601
because window->window == 0 we do not call mXtBin = gtk_xtbin_new(win, 0);
and than crahs at:
610 window->window = (nsPluginPort *)GTK_XTBIN(mXtBin)->xtwindow;
because mXtBin == 0
so my first proposal to fix this is a simple bulletproofing:
=====================================================
RCS file: /cvsroot/mozilla/modules/plugin/nglsrc/ns4xPluginInstance.cpp,v
retrieving revision 1.49
diff -u -r1.49 ns4xPluginInstance.cpp
--- ns4xPluginInstance.cpp 2001/04/28 02:24:29 1.49
+++ ns4xPluginInstance.cpp 2001/05/09 23:14:57
@@ -554,7 +554,8 @@
     ws = (NPSetWindowCallbackStruct *)window->ws_info;

     GdkWindow *win = gdk_window_lookup((XID)window->window);
-    if (win)
+    if (!win)
+      goto L_NO_WINDOW;
     {
 #ifdef NS_DEBUG
       printf("About to create new xtbin of %i X %i from %p...\n",
@@ -608,6 +609,8 @@
   // And now point the NPWindow structures window
   // to the actual X window
   window->window = (nsPluginPort *)GTK_XTBIN(mXtBin)->xtwindow;
+
+L_NO_WINDOW:
 #endif // MOZ_WIDGET_GTK
 --------------------
it'll fix the crash , but problem, which probably hides in javascript
document.write('<OBJECT  ... <EMBED </EMBED> </OBJECT>');
still remains.

Comment 7

17 years ago
Sorry, I thought it was similar to the default plugin one you fixed.

You have my r= to check-in at least this patch to band-aid this until more 
cycles can be devoted to fixing Linux plugin bugs. I don't like the goto, but 
looking at the code in context, it doesn't seem like a bad choice.

Thanks!

Comment 8

17 years ago
add cc:

Comment 9

17 years ago
I want to stress this is not a Linux only bug.

Mozilla 0.9.2 + Shockwave Flash 5.0 r52 crash on Solaris 8 when accessing
	http://www.macromedia.com/software/flash/

Turning off javascript indeed stops Mozilla from crashing.

The difference here is that I get X errrors:
	X Error of failed request:  BadMatch (invalid parameter attributes)
	  Major opcode of failed request:  131 (MIT-SHM)
	  Minor opcode of failed request:  3 (X_ShmPutImage)
	  Serial number of failed request:  64
	  Current serial number in output stream:  64

Note that I have a 24-bit capable display but the default display
is 8-bit - as usual on Solaris and Irix machines.

I can't provide a stack trace, sorry. The -g and -d options don't
work on Solaris.

User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:0.9.2) Gecko/20010630
BuildID:    2001063019

Comment 10

17 years ago
Created attachment 43349 [details]
Crashes Mozilla 0.9.2 + Flash 5.0r522 on Solaris 8

Comment 11

17 years ago
I don't think this has anything to do with javascript. This is just a flash
embedding problem.

I have reduced
	http://www.macromedia.com/software/flash/
to attachment
	http://bugzilla.mozilla.org/showattachment.cgi?attach_id=43349
that contains
	<EMBED TYPE="application/x-shockwave-flash"></EMBED>

This crashes Mozilla the same way:
	X Error of failed request:  BadMatch (invalid parameter attributes)
	  Major opcode of failed request:  131 (MIT-SHM)
	  Minor opcode of failed request:  3 (X_ShmPutImage)
	  Serial number of failed request:  64
	  Current serial number in output stream:  64

Comment 12

17 years ago
Definitely not a javascript issue.

I've also reduced
	http://www.itpapers.com/
and now have it crash even with javascript turned off by changing
	document.write('<OBJECT c...
to
	<OBJECT c...

Comment 13

17 years ago
Created attachment 43352 [details]
http://www.itpapers.com/ case reduced

Comment 14

17 years ago
Note that when reducing
	http://www.itpapers.com/
to
	http://bugzilla.mozilla.org/showattachment.cgi?attach_id=43352

the error messages on the console change from
	Gtk-WARNING **: invalid cast from (NULL) pointer to `GtkXtBin'
	Segmentation Fault
to
	X Error of failed request:  BadMatch (invalid parameter attributes)
	  Major opcode of failed request:  131 (MIT-SHM)
	  Minor opcode of failed request:  3 (X_ShmPutImage)
	  Serial number of failed request:  64
	  Current serial number in output stream:  64

I'm still not sure what this means...

Comment 15

17 years ago
Aaaaargh! I am very sorry, but I am afraid I was wrong. The intial error
	invalid cast from (NULL) pointer to `GtkXtBin'
from
	http://www.itpapers.com/
is different from the X error I keep getting when using Mozilla + Flash on
Solaris.

I am trying again to reduce
	http://www.itpapers.com/
to something smaller but removing even a single of comments from this page
will result in Mozilla not crashing. Actually this could be related to the
cache. Clear the cache on disk before running mozilla and it won't crash on
the attached file. Rerun mozilla on the same file and it will crash! Like this:
$ rm -rf /home/papadopo/.mozilla/papadopo/0u4z2wg5.slt/NewCache/*
$ /usr/local/mozilla/mozilla file:///home/papadopo/index.html > /dev/null
$ /usr/local/mozilla/mozilla file:///home/papadopo/index.html > /dev/null

Gtk-WARNING **: invalid cast from (NULL) pointer to `GtkXtBin'
Segmentation Fault
$ 

Comment 16

17 years ago
Created attachment 43364 [details]
http://www.itpapers.com/ case (somehow) reduced

Comment 17

17 years ago
cc:ing Serge, perhaps he knows more about this.

Comment 18

17 years ago
I don't think Flash 5 works with 8 bit display on Solaris. Dimitri, could you
try setting your default display to 24, if you have not already done so? This
may resolve the problem of "X Error of failed request:  BadMatch (invalid
parameter attributes)". See also bug: 85958
(Reporter)

Comment 19

17 years ago
The first two attachments don't cause a crash on IRIX using build 2001071722
while the third and the original problem URL do. Note that I don't have any
flash plugin installed because there isn't, as far as I'm aware, one available
which works with Mozilla on IRIX.
I see this bug too with version 0.9.4. The browser dies with


Gtk-WARNING **: invalid cast from (NULL) pointer to `GtkXtBin'
Segmentation fault

when I visit http://www.unibanco.com.br

I'm using Flash 5.0 r47.

Comment 21

16 years ago
WFM on Solaris 2.8 MOZILLA_0_9_5_BRANCH and on Linux Redhat 7.1
MOZILLA_0_9_4_BRANCH (in both cases I used jre 1.3.1). Reporter, can you
still reproduce this bug ?
(Reporter)

Comment 22

16 years ago
itpapers seems to have changed slightly - I get a crash under 0.9.4 on the third
attachment only.

Using build 2001111122 there's no crash for any of the test cases, but neither
is there a request for a shockwave plugin (which I don't have installed) - has
the suggested patch to stop the crash (but not the underlying problem) gone in
recently?

Comment 23

16 years ago
Rohan, I couldn't reproduce bug on third attachment. Actually I didn't
completely understand your question about patch: as I understand you
ask about patch that fixes the bug ?
(Reporter)

Comment 24

16 years ago
I was refering to the bulletproofing patch proposed by Serge in comment #6.

This is on IRIX - do Linux show a flash movie in the third attachment?

To summarise: the crash has gone but so has the movie. Should I raise a seperate
bug to fix that?
(Assignee)

Comment 25

16 years ago
The bulletproofing I've proposed has been checked in for bug 85701, 
I'm going to play with this one soon, to figure out what actually going on here.

Comment 26

16 years ago
Linux doesn't show movie on third attachment

Comment 27

16 years ago
The same thing appears to happen on www.oracle.com/start where there's
javascript inside the embedded flash <object> bit writing directly to the page.
This is on mozilla 0.9.6 under RedHat 7.2 with Shockwave Flash 5.0 r47

Comment 28

16 years ago
--- Mass reassigning Unix bugs to serge ---
Assignee: av → serge
(Assignee)

Comment 29

16 years ago
WFM with 20020130 linux gebug build rh 7.2, flash 5.0 r47
I'm going ro resolve this as WFM if there are no objections.
(Assignee)

Comment 30

16 years ago
resolved as WFM
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.