92012 - Flash on ultrapasswordz.com crashes browser on Linux

Status: RESOLVED WORKSFORME

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect, P3)

Description

[Dan Rosen]

In the spirit of "testing the product in real-life usage scenarios," I was
dutifully surfing pr0n sites. I was pleasantly astonished that not a single one
was able to crash Mozilla... However, when looking for passwords for more pr0n
sites to surf, I came across a crasher at http://www.ultrapasswordz.com.

I believe the crasher is the Flash on that page. It crashes Mozilla (branch,
trunk, 4.x, everything) on Linux, but not on Windows. I can't get a decent stack
trace, either -- it dies with an "abort" signal. I think an exception is being
thrown and not caught:

(gdb) where
#0  0x405b8dd1 in __kill () from /lib/libc.so.6
#1  0x402e0d5b in raise (sig=6) at signals.c:65
#2  0x405ba352 in abort () at ../sysdeps/generic/abort.c:88
#3  0x406d8f2b in __default_terminate () at ../../gcc/libgcc2.c:3034
#4  0x406d8f4a in __terminate () at ../../gcc/libgcc2.c:3034
#5  0x406d9c9a in throw_helper (eh=0x41f15658, pc=0x4268b389,
my_udata=0xbfffefdc, offset_p=0xbfffefd8) at ../../gcc/libgcc2.c:3168
#6  0x406d9f4f in __rethrow (index=0x406f4058) at ../../gcc/libgcc2.c:3168
#7  0x406dc0cf in __builtin_vec_new (sz=2013269424) from
/usr/lib/libstdc++-libc6.2-2.so.3
#8  0x4268b38a in ?? ()

I'll try to download and attach the flash app as a testcase here.

Comment 1

[Dan Rosen]

Attachment: [flash] flash header for ultrapasswordz.com

Comment 2

[Dimitri Papadopoulos]

OK, I thought this would be a duplicate of 79601 but turning off javascript
doesn't help. On the other hand I see the same crashes with X errors I used
to see in 79601:
	X Error of failed request:  BadMatch (invalid parameter attributes)
	  Major opcode of failed request:  131 (MIT-SHM)
	  Minor opcode of failed request:  3 (X_ShmPutImage)
	  Serial number of failed request:  64
	  Current serial number in output stream:  64
If not a duplicate, this is at least related to 79601.

Comment 3

[shrirang khanzode]

not so useful trace from QFA:

Stack Signature
               libc.so.6 + 0x1e4e1 (0x4043c4e1) b5d92958 
 Bug ID
 Trigger Time 
               2001-07-24 08:29:03 
 User Comments 
               ultrapasswordz.com on linux..just go there and BOOM BOOM BOOM 
 Build ID
               2001072305 
 Product ID
               Netscape6.10 
 Platform ID
               LinuxIntel 
 Stack Trace

libc.so.6 + 0x1e4e1 (0x4043c4e1) 
libc.so.6 + 0x1f868 (0x4043d868) 
libstdc++-libc6.1-1.so.2 + 0x2ec75 (0x4053fc75) 
libstdc++-libc6.1-1.so.2 + 0x2ec92 (0x4053fc92) 
libstdc++-libc6.1-1.so.2 + 0x2f57b (0x4054057b) 
libstdc++-libc6.1-1.so.2 + 0x311e5 (0x405421e5) 

Comment 4

[Dan Rosen]

I don't believe this is related to bug 79601. This *is* linux-only, and is not
affected by javascript (I had js disabled when I first saw the bug). By the way,
in the interest of not subjecting everybody involved with this bug to porn, you
can crash just as easily by opening the attachment here.

One more data point: I have reason to believe the flash here is messed up
somehow, because although it doesn't crash Windows, it never seems to display
(it just shows up as a blank box).

Comment 5

[Olivier Cahagne]

Another Talkback ID if it can help debugging this: TB34741470Y.
Using Mozilla 2001083012 on Linux with Flash 5.0r47.

Comment 6

[Olivier Cahagne]

Sorry about that last post, it might not be related to this bug, using Mozilla
2001083012 on Linux, loading the attachment #43297 [details], I get this Talkback ID:
TB34742478E.

Comment 7

[Peter Lubczynski]

Looking at the stack, I think this is a dup.

Comment 8

[Peter Lubczynski]

Linux--->serge

Comment 9

[Sergey Lunegov]

WFM on Linux Redhat 7.1 with Mozilla CVS build from 12072001. Flash plugin
is 5.0 r47.

Comment 10

[serge (gone)]

--> mozilla1.0
stack trace looks like
(gdb) bt
#0  0x40601a01 in __kill () from /lib/i686/libc.so.6
#1  0x403115bb in raise (sig=6) at signals.c:65
#2  0x40602f82 in abort () at ../sysdeps/generic/abort.c:88
#3  0x40732efb in __default_terminate () at ../../gcc/libgcc2.c:3034
#4  0x40732f1a in __terminate () at ../../gcc/libgcc2.c:3034
#5  0x40733c55 in throw_helper (eh=0x43900478, pc=0x43498389,
my_udata=0xbfffea74, offset_p=0xbfffea70) at ../../gcc/libgcc2.c:3168
#6  0x40733f4f in __rethrow (index=0x4074df1c) at ../../gcc/libgcc2.c:3168
#7  0x4073618f in __builtin_vec_new (sz=2013269424) from
/usr/lib/libstdc++-libc6.2-2.so.3
#8  0x4349838a in ?? ()

Comment 11

[scottputterman]

Moving Netscape owned 0.9.9 and 1.0 bugs that don't have an nsbeta1, nsbeta1+,
topembed, topembed+, Mozilla0.9.9+ or Mozilla1.0+ keyword.  Please send any
questions or feedback about this to [e-mail].  You can search for
"Moving bugs not scheduled for a project" to quickly delete this bugmail.

Comment 12

[Martin]

mozilla also crashes on http://www.deadtroll.com/ , looking this page in mozilla
w/o flash installed runs fine.

runnig mozilla 1.0.0_rc1 on linux

Comment 13

[Martin]

I opened a new bug, see  id=138786
 

Comment 14

[rubydoo123]

can't access the site, it must be down, will try at a later date

Comment 15

[shrirang khanzode]

I crashed on linux using the attachment Dan has posted here:
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=43297

Comment 16

[serge (gone)]

this is another flash linux problem, 4.x also crashes on attachment 43297 [details]

Comment 17

[Martin]

the crash I reported has been marked as a duplicate of bug 131065, so you may
want to look there for further information. I didn't found this bug because
there isn't anything about a crash in the summary ...

maybe this bug is a duplicate too?

Comment 18

[serge (gone)]

Martin, the stack trace for this bug and bug 138786 you reported is completely
different.

Comment 19

[Blake Learmonth]

http://www.char-a-voile.com/, in OS X clicking anything hot on this page crashes
Mozilla completely, ie. "Mozilla has unexpectedly quit..." , Build 20020511208
OS X 10.1.4. Same page works okay with 2002051206 windows build.

Comment 20

[Dan Rosen]

If I cared, I'd argue that a plugin crash shouldn't make mozilla crash. But I 
don't. So I won't.

Comment 21

[Peter Lubczynski]

See bug 156493.

Comment 22

[Dan Rosen]

Hm, in that case, this is a dupe (or at least a special case). This bug should 
either be changed to "Flash plugin crash should not crash Mozilla" and made to 
block the meta bug, or should be closed now as a dupe.

Comment 23

[rubydoo123]

reassign

Comment 24

[Olivier Cahagne]

Dan, can you try again with Flash 6 ?
http://www.macromedia.com/software/flashplayer/special/beta/

Comment 25

[rubydoo123]

reassign

Comment 26

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 27

[Flechl David]

i use 1.5b an the browser crashes on every flah-site/applet !!!
is this a flash problem or a problem of mozilla???

Comment 28

[Flechl David]

i use 1.5b an the browser crashes on every flah-site/applet !!!
is this a flash problem or a problem of mozilla???

Comment 29

[Chris Neale]

is this still a problem ?

index.html (wget) at http://www.ultrapasswordz.com/

<HTML>
<HEAD>
<META HTTP-EQUIV="refresh" CONTENT="0;
URL=http://www.gotoo.com/treasure/adult.html">
</HEAD>
<BODY>
</BODY>
</HTML>

Comment 30

[Pierluigi]

Also with Shockwave Flash 6.0 r79 there are other site crashing mozilla under linux.
One of this is www.helihobby.com, either with mozilla 1.4 than 1.5 than 1.6
All other site with flash are working. Is it really a flash bug ?

Pigi

Comment 31

[Olivier Cahagne]

Flash 6.0r81 solved a few crashes, URL is not available anymore.

If you crash on Flash sites, please file a new bug report and attach a stack trace.

Comment 32

[BMO Automation]

Version and milestone values are being reset to defaults as part of product refactoring.