Copy link to clipboard
Copied
A very simple piece of code that causes the flash 10.2 plugin container to crash on all platforms, but does not crash on 10.1 player.
<?xml version="1.0" encoding="utf-8"?>
<s:Application xmlns:fx="http://ns.adobe.com/mxml/2009" xmlns:s="library://ns.adobe.com/flex/spark" xmlns:mx="library://ns.adobe.com/flex/mx" minWidth="300" minHeight="200">
<fx:Script>
<![CDATA[
import mx.controls.Alert;
private function crash(type:int, ...additionalArgs):void {
var msg:String;
switch (type) {
case 1: msg = "Crashes!"; break;
case 2: msg = additionalArgs[0]; break;
}
Alert.show("Crash : " + msg);
}
private function notCrash(type:int, ...additionalArgs):void {
// Does nothing at all, but stops the crash....
if (additionalArgs) {}
var msg:String;
switch (type) {
case 1:msg = "Not crash"; break;
case 2: msg = additionalArgs[0]; break;
}
Alert.show("NotCrash : " + msg);
}
]]>
</fx:Script>
<s:Button label="Does not crash flash" click="notCrash(2,'value')" x="10" y="10"/><s:Button label="Crash flash" click="crash(2,'value')" x="150" y="10"/>
</s:Application>
Copy link to clipboard
Copied
What's the error?
Copy link to clipboard
Copied
You will get the follow crash log :
Process: plugin-container [45289]
Path: /Applications/Internet/Minefield.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container
Identifier: org.mozilla.plugincontainer
Version: ??? (1.0)
Code Type: X86 (Native)
Parent Process: firefox-bin [40466]
Date/Time: 2011-02-22 23:38:09.378 +0200
OS Version: Mac OS X 10.6.6 (10J567)
Report Version: 6
Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000011
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Thread 0 Crashed: Dispatch queue: com.apple.main-thread
0 ...dia.FlashPlayer-10.6.plugin 0x16dca3ee main + 1461822
1 ??? 0x1c123edb 0 + 470957787
2 ??? 0x1c123fcf 0 + 470958031
3 ...dia.FlashPlayer-10.6.plugin 0x16dcc8c6 main + 1471254
4 ...dia.FlashPlayer-10.6.plugin 0x16dce7d7 main + 1479207
5 ...dia.FlashPlayer-10.6.plugin 0x16865658 0x16790000 + 874072
6 ...dia.FlashPlayer-10.6.plugin 0x1685e9e1 0x16790000 + 846305
7 ...dia.FlashPlayer-10.6.plugin 0x1686bdc9 0x16790000 + 900553
8 ...dia.FlashPlayer-10.6.plugin 0x16ae0e45 0x16790000 + 3477061
9 ...dia.FlashPlayer-10.6.plugin 0x16beaf08 unregister_ShockwaveFlash + 21368
10 ...dia.FlashPlayer-10.6.plugin 0x16c72bde main + 54830
11 ...dia.FlashPlayer-10.6.plugin 0x16be2c9a FlashPlayer_10_2_152_26_FlashPlayer + 15578
12 XUL 0x00df6bc4 mozilla::plugins::PluginInstanceChild::AnswerNPP_HandleEvent(mozilla::plugins::NPRemoteEvent const&, short*) + 180
Copy link to clipboard
Copied
Doesn't crash mine
Copy link to clipboard
Copied
If you installed "10,2,152,26" on OSX, Linux or Windows 7 and click on the "Crash" button it will crash the plugin container or even your browser. It has something to do with vargs and switch statements.
Copy link to clipboard
Copied
Hi kennethkawamoto2,
You are probably using 10.1 or 10.2 debug player. It only crashes on 10.2 standard player
Regards Michael
Copy link to clipboard
Copied
Yes it did crashed my Chrome, which is the only browser with non-debug 10.2 on my machines (others are with 10.2 debugger). Anyway, may be you want to log it as a bug here? https://bugs.adobe.com/flashplayer/
Copy link to clipboard
Copied
Hi kennethkawamoto2,
I have already posted a bug on https://bugs.adobe.com/flashplayer/ however i have never received any kind of confirmation and the bug i logged is now
private and i can no longer view the status of it. Fortunately for us to where able to implement a workaround, i just wonder how many other people are affect by this bug and how much time they are wasting trying "fix" it.
Regards Michael
Copy link to clipboard
Copied
Crash long on Safari :
Process: WebKitPluginHost [43418]
Path: /System/Library/Frameworks/WebKit.framework/WebKitPluginHost.app/Contents/MacOS/WebKitPluginHost
Identifier: com.apple.WebKit.PluginHost
Version: 6533 (6533.13)
Build Info: WebKitPluginHost-75331300~12
Code Type: X86 (Native)
Parent Process: WebKitPluginAgent [43105]
PlugIn Path: /Library/Internet Plug-Ins/Flash Player.plugin/Contents/PlugIns/FlashPlayer-10.6.plugin/Contents/MacOS/FlashPlayer-10.6
PlugIn Identifier: com.macromedia.FlashPlayer-10.6.plugin
PlugIn Version: 10.2.152.26 (10.2.152.26)
Date/Time: 2011-02-22 21:56:12.733 +0200
OS Version: Mac OS X 10.6.6 (10J567)
Report Version: 6
Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000010
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Thread 0 Crashed: Dispatch queue: com.apple.main-thread
0 ...dia.FlashPlayer-10.6.plugin 0x140043ee main + 1461822
1 ??? 0x1d9db79f 0 + 496875423
2 ??? 0x1d9db8b3 0 + 496875699
3 ??? 0x1d9db937 0 + 496875831
4 ...dia.FlashPlayer-10.6.plugin 0x140068c6 main + 1471254
5 ...dia.FlashPlayer-10.6.plugin 0x140087d7 main + 1479207
6 ...dia.FlashPlayer-10.6.plugin 0x13a9f658 0x139ca000 + 874072
7 ...dia.FlashPlayer-10.6.plugin 0x13a989e1 0x139ca000 + 846305
8 ...dia.FlashPlayer-10.6.plugin 0x13aa48de 0x139ca000 + 895198
9 ...dia.FlashPlayer-10.6.plugin 0x13ba6572 0x139ca000 + 1951090
10 ??? 0x194083b5 0 + 423658421
11 ??? 0x1c7fee20 0 + 478146080
12 ??? 0x1dbe2844 0 + 499001412
13 ??? 0x1db3d61c 0 + 498325020
14 ??? 0x1db3dcfc 0 + 498326780
15 ??? 0x1db37b5c 0 + 498301788
16 ...dia.FlashPlayer-10.6.plugin 0x13a9f658 0x139ca000 + 874072
17 ...dia.FlashPlayer-10.6.plugin 0x13aa06b6 0x139ca000 + 878262
18 ...dia.FlashPlayer-10.6.plugin 0x13bb42be 0x139ca000 + 2007742
19 ...dia.FlashPlayer-10.6.plugin 0x13d407c8 0x139ca000 + 3631048
20 ...dia.FlashPlayer-10.6.plugin 0x13d40eab 0x139ca000 + 3632811
21 ...dia.FlashPlayer-10.6.plugin 0x13ea39c7 main + 17431
22 com.apple.CoreFoundation 0x950184cb __CFRunLoopDoSources0 + 1563
23 com.apple.CoreFoundation 0x95015f8f __CFRunLoopRun + 1071
24 com.apple.CoreFoundation 0x95015464 CFRunLoopRunSpecific + 452
25 com.apple.CoreFoundation 0x95015291 CFRunLoopRunInMode + 97
26 com.apple.HIToolbox 0x901a8004 RunCurrentEventLoopInMode + 392
27 com.apple.HIToolbox 0x901a7dbb ReceiveNextEventCommon + 354
28 com.apple.HIToolbox 0x901a7c40 BlockUntilNextEventMatchingListInMode + 81
29 com.apple.AppKit 0x9130978d _DPSNextEvent + 847
30 com.apple.AppKit 0x91308fce -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 156
31 com.apple.AppKit 0x912cb247 -[NSApplication run] + 821
32 com.apple.WebKit.PluginHost 0x1842240f 0x18421000 + 5135
33 com.apple.WebKit.PluginHost 0x1842204d 0x18421000 + 4173
Copy link to clipboard
Copied
Btw, a workaround solution is to wrap the switch statement in a try/catch even though the catch is never reached it does solve the crash:
private function crash(type:int, ...additionalArgs):void {
var msg:String;
try {
switch (type) {
case 1: msg = "Crashes!"; break;
case 2: msg = additionalArgs[0]; break;
}
} catch (e:Error) {
Alert.show("Never gets called but stops the crash :" + e);
}
Alert.show("Crash : " + msg);
}
But whats even weirder is that it will not crash if you reference the (...) rest parameter before trying to access a element :
private function crash(type:int, ...additionalArgs):void {
var msg:String;
// Just by trying if evaluate the variable stops it crashing.
if (additionalArgs) {}
switch (type) {
case 1: msg = "Crashes!"; break;
case 2: msg = additionalArgs[0]; break;
}
Alert.show("Crash : " + msg);
}
Copy link to clipboard
Copied
It does not crash my debug player 10.2.152.26 on Firefox 3.6.13/Safari 5.0.3 on OS X 10.6.6 (Intel)
Ah, but it does crash Chrome 9.0.597
FYI, EXC_BAD_ACCESS/KERN_PROTECTION_FAILURE
means "This is caused by the thread trying to write to read-only memory. This is always caused by a data access." (Apple)
If you do this it won't crash:
msg = (additionalArgs as Array)[0];
Copy link to clipboard
Copied
Yes, the crash only happens on the standard flash player 10.2 and not on the debug flash player 10.2 (which is what the end user uses...).
Copy link to clipboard
Copied
Btw,
msg = (additionalArgs as Array)[0];
Will not fix the issue only a try/catch.
This is an Adobe Flash 10.2 bug which they refuse to fix or mention anything about it on there site!
Copy link to clipboard
Copied
OK so if you want to test this your self :
http://files.chesscube.com.s3.amazonaws.com/images/Crasher.swf
Here is the result you should get for the different flash plugin version :
Crash! - http://get.adobe.com/flashplayer/ (10.2.152.33) - Released on March 1, 2011
Crash! - http://www.filehippo.com/download_flashplayer_ie/9251/ (10.2.152.26) - Released on February 9, 2011
No Crash - http://www.filehippo.com/download_flashplayer_ie/tech/9137/ (10.2.152.14 Beta 2)
No Crash - http://labs.adobe.com/downloads/flashplayer10.html (10.2 Beta)
No Crash - http://www.filehippo.com/download_flashplayer_ie/tech/8673/ (10.1.102.64) - Released on November 6, 2010
No Crash - on any build before November 6 2010.
WARNING - It will crash your flash plugin container and may even crash your entire browser (eg camino..).
Regards Michael
Copy link to clipboard
Copied
We just released Flash Player 10.3 beta 2 which includes a fix for this bug. If you get a chance to try it out, we'd be interested in your feedback or if you run into any problems.
Thanks,
Chris