#22 libflash-mozplugin crashes firefox (with backtrace)

[Paul Harvey]

Open http://www.xgamestation.com and then click "View
Cart". Firefox 1.0.7 crashes with a message from X11 on
the console saying to run with --sync and set gdb to
break on gdk_x_error().

Started X using xinit --synchronous, typed
"gnome-session" in the xterm that comes up, and ran
firefox-bin from gdb. Visited
http://www.xgamestation.com/user_not_logged_in.php ,
observed crash.

Below is the gdb session with backtrace.

(gdb) run --sync -a firefox
Starting program: /usr/lib/mozilla-firefox/firefox-bin
--sync -a firefox
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread -1221531424 (LWP 9029)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
---Type <return> to continue, or q <return> to quit---
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
---Type <return> to continue, or q <return> to quit---
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[New Thread -1222304848 (LWP 9030)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
---Type <return> to continue, or q <return> to quit---
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[New Thread -1234932816 (LWP 9031)]
[New Thread -1243321424 (LWP 9032)]
(no debugging symbols found)
[New Thread -1252389968 (LWP 9033)]
[New Thread -1260778576 (LWP 9034)]
(no debugging symbols found)
(no debugging symbols found)
[Thread -1252389968 (LWP 9033) exited]
[New Thread -1252389968 (LWP 9035)]
[New Thread -1270875216 (LWP 9036)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
NP_Initialize
New
open dsp: No such file or directory
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
New
SetWindow
SetWindow
SetWindow
NewStream
WriteReady
Write
decoding...
WriteReady
Write
WriteReady
Write
WriteReady
Write

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1221531424 (LWP 9029)]
0xb456b07d in CInputScript::GetBits () from
/usr/lib/libflash.so.0
(gdb) bt
#0 0xb456b07d in CInputScript::GetBits () from
/usr/lib/libflash.so.0
#1 0xb456ba35 in CInputScript::ParseShapeData () from
/usr/lib/libflash.so.0
#2 0xb456d8ca in CInputScript::ParseDefineFont2 ()
from /usr/lib/libflash.so.0
#3 0xb456e711 in CInputScript::ParseTags () from
/usr/lib/libflash.so.0
#4 0xb456ed02 in CInputScript::ParseData () from
/usr/lib/libflash.so.0
#5 0xb4560a0e in FlashParse () from /usr/lib/libflash.so.0
#6 0xb3bc962d in NPP_Write ()
from /usr/lib/mozilla/plugins/libflash-mozplugin.so
#7 0xb3bc9f59 in Private_Write ()
from /usr/lib/mozilla/plugins/libflash-mozplugin.so
#8 0x08253705 in nsISupportsArray::GetIID ()
#9 0x08256e5d in nsISupportsArray::GetIID ()
#10 0x080fdeb5 in nsIRunnable::GetIID ()
#11 0x0813fb69 in nsISupportsPRUint32::GetIID ()
#12 0x080ec671 in nsIStreamBufferAccess::GetIID ()
#13 0x080ec77e in nsIStreamBufferAccess::GetIID ()
#14 0xb7e8c442 in nsInputStreamReadyEvent::EventHandler ()
from /usr/lib/mozilla-firefox/libxpcom.so
#15 0xb7ea1da3 in PL_HandleEvent () from
/usr/lib/mozilla-firefox/libxpcom.so
#16 0xb7ea26ac in PL_ProcessPendingEvents ()
from /usr/lib/mozilla-firefox/libxpcom.so
#17 0xb7ea44ac in nsEventQueueImpl::~nsEventQueueImpl ()
from /usr/lib/mozilla-firefox/libxpcom.so
---Type <return> to continue, or q <return> to quit---
#18 0x0827f886 in nsIDirectoryServiceProvider::GetIID ()
#19 0xb797cb67 in g_vasprintf () from
/usr/lib/libglib-2.0.so.0
#20 0xb7953421 in g_main_context_dispatch () from
/usr/lib/libglib-2.0.so.0
#21 0xb7956687 in g_main_context_check () from
/usr/lib/libglib-2.0.so.0
#22 0xb7956bd8 in g_main_loop_run () from
/usr/lib/libglib-2.0.so.0
#23 0xb7c1a989 in gtk_main () from
/usr/lib/libgtk-x11-2.0.so.0
#24 0x0827fca4 in nsIDirectoryServiceProvider::GetIID ()
#25 0x088ca750 in nsIBinaryInputStream::GetIID ()
#26 0x08075eae in ?? ()
#27 0x00000004 in ?? ()
#28 0xbfb736d4 in ?? ()
#29 0x088d4a34 in _IO_stdin_used ()
#30 0x088d489a in crmf_encoder_out ()
#31 0xb7433ec0 in __libc_start_main () from
/lib/tls/libc.so.6
#32 0x08075df1 in ?? ()

I'm running a current Debian unstable, dist-upgraded on
20051004.

csirac@singularity:~$ apt-cache show libflash0
[snip]
Version: 0.4.13-2
[snip]
Filename:
pool/main/libf/libflash/libflash0_0.4.13-2_i386.deb
Size: 65666
MD5sum: 7702d87e60915bc739606d05b1af95ab
[snip]
csirac@singularity:~$ uname -a
Linux singularity 2.6.12-1-k7 #1 Tue Sep 27 13:22:07
JST 2005 i686 GNU/Linux
csirac@singularity:~$ X -version

X Window System Version 6.8.2 (Debian 6.8.2.dfsg.1-7
20050908031534 David Nusinow <dnusinow@debian.org>)
Release Date: 9 February 2005
X Protocol Version 11, Revision 0, Release 6.8.2
Build Operating System: Linux 2.6.12-1-686 i686 [ELF]
Current Operating System: Linux singularity 2.6.12-1-k7
#1 Tue Sep 27 13:22:07 JST 2005 i686
Build Date: 08 September 2005
Before reporting problems, check http://wiki.X.Org
to make sure that you have the latest version.
Module Loader present
OS Kernel: Linux version 2.6.12-1-k7
(horms@tabatha.lab.ultramonkey.org) (gcc version 4.0.2
20050917 (prerelease) (Debian 4.0.1-8)) #1 Tue Sep 27
13:22:07 JST 2005
csirac@singularity:~$ firefox --version
Mozilla Firefox 1.0.7, Copyright (c) 1998 - 2005
mozilla.org

[Nobody/Anonymous]

Logged In: NO

Full backtrace of latest cvs.

#0 0x00002aaab4a67b1d in ASSound::stop ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#1 0x00002aaab49d7f17 in Script::doActionGotoFrame2 ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#2 0x00002aaab49f70f7 in SwfEngine::actionDispatch ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#3 0x00002aaab49f77cb in SwfEngine::executeCode ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#4 0x00002aaab49fb8df in SwfEngine::doShowFrame ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#5 0x00002aaab49fea78 in SwfEngine::next ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#6 0x00002aaab49a716e in PluginInterface::flashRender ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#7 0x00002aaab49a7ce3 in NPP_Destroy ()
from /usr/lib64/nsbrowser/plugins/libnpflash.so
#8 0x00002aaab0a2f443 in XtAppProcessEvent () from
/usr/lib/libXt.so.6
#9 0x00002aaab08e8594 in ?? () from
/usr/lib64/mozilla-firefox/libgtkxtbin.so
#10 0x00002aaaac3f6c4b in g_main_context_wakeup ()
from /usr/lib/libglib-2.0.so.0
#11 0x00002aaaac3f4ab8 in g_main_context_dispatch ()
from /usr/lib/libglib-2.0.so.0
#12 0x00002aaaac3f81fe in g_main_context_check ()
---Type <return> to continue, or q <return> to quit---
from /usr/lib/libglib-2.0.so.0
#13 0x00002aaaac3f8405 in g_main_loop_run () from
/usr/lib/libglib-2.0.so.0
#14 0x00002aaaab712ade in gtk_main () from
/usr/lib/libgtk-x11-2.0.so.0
#15 0x00002aaab069dc70 in ?? ()
from /usr/lib64/mozilla-firefox/components/libwidget_gtk2.so
#16 0x00002aaab0ea68be in NSGetModule ()
from /usr/lib64/mozilla-firefox/components/libtoolkitcomps.so
#17 0x000000000040a63a in
nsTHashtable<nsBaseHashtableET<nsDepCharHashKey,
nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#18 0x00002aaaacbf366c in __libc_start_main () from
/lib/libc.so.6
#19 0x00000000004057ba in ?? ()
#20 0x00007fffffa5a5c8 in ?? ()
#21 0x00002aaaaabc3960 in environ () from
/lib64/ld-linux-x86-64.so.2
#22 0x0000000000000001 in ?? ()
#23 0x00007fffffa5c5e9 in ?? ()
#24 0x0000000000000000 in ?? ()