Bug 207828

X.org 7.1
firefox-1.5.0.7-3.fc6
COMPOSITE enabled but with XLIB_SKIP_ARGB_VISUALS=1 to workaround Bug #155582

http://americanexpress.com causes firefox to crash somewhere within
ActionList::PushAction() of Flash Player 7 after most of the page is loaded and
rendered.  This is a test case an issue that must be fixed before Adobe Flash
Player 9.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208849680 (LWP 3638)]
0x01548578 in ActionList::PushAction () from /usr/lib/flash-plugin/libflashplayer.so
(gdb) bt
#0  0x01548578 in ActionList::PushAction () from
/usr/lib/flash-plugin/libflashplayer.so
#1  0x014fc654 in BehaviorList::DoEvent () from
/usr/lib/flash-plugin/libflashplayer.so
#2  0x01575a3d in ScriptPlayer::PushDataComplete () from
/usr/lib/flash-plugin/libflashplayer.so
#3  0x01571b44 in ScriptPlayer::PushImageData () from
/usr/lib/flash-plugin/libflashplayer.so
#4  0x01598a0a in CorePlayer::UrlStreamWriteNotify () from
/usr/lib/flash-plugin/libflashplayer.so
#5  0x015989db in CorePlayer::UrlStreamWrite () from
/usr/lib/flash-plugin/libflashplayer.so
#6  0x015aa903 in URLStream::StreamWrite () from
/usr/lib/flash-plugin/libflashplayer.so
#7  0x0161e299 in NPP_Write () from /usr/lib/flash-plugin/libflashplayer.so
#8  0x0161bddc in Private_Write () from /usr/lib/flash-plugin/libflashplayer.so
#9  0x04ef299b in ns4xPluginStreamListener::OnDataAvailable (this=0xa76dc40,
pluginInfo=0xa23d1c8, input=0xa7804e8, 
    length=0) at ns4xPluginInstance.cpp:545
#10 0x04efcc18 in nsPluginStreamListenerPeer::OnDataAvailable (this=0xa24ac08,
request=0xa1d3af4, aContext=0x0, 
    aIStream=0xa7a0ee0, sourceOffset=4573, aLength=2049) at
nsPluginHostImpl.cpp:2226
#11 0x00a0d5eb in nsStreamListenerTee::OnDataAvailable (this=0xa7a0db0,
request=0xa1d3af4, context=0x0, input=0xa249e50, 
    offset=4573, count=2049) at nsStreamListenerTee.cpp:97
#12 0x00a6b577 in nsHttpChannel::OnDataAvailable (this=0xa1d3ac8,
request=0xa249f90, ctxt=0x0, input=0xa249e50, 
    offset=4573, count=2049) at nsHttpChannel.cpp:4166
#13 0x009f2e0c in nsInputStreamPump::OnStateTransfer (this=0xa249f90) at
nsInputStreamPump.cpp:437
#14 0x009f2f50 in nsInputStreamPump::OnInputStreamReady (this=0xa249f90,
stream=0xa249e50) at nsInputStreamPump.cpp:340
#15 0x00b98611 in nsInputStreamReadyEvent::EventHandler (plevent=0xa7a1054) at
nsStreamUtils.cpp:119
#16 0x00babbfd in PL_HandleEvent (self=0xa7a1054) at plevent.c:688
#17 0x00babe86 in PL_ProcessPendingEvents (self=0x9784168) at plevent.c:623
#18 0x00bad6b3 in nsEventQueueImpl::ProcessPendingEvents (this=0x9784120) at
nsEventQueue.cpp:417
#19 0x00673c16 in event_processor_callback (source=0x99dbd38, condition=G_IO_IN,
data=0xa7a0100) at nsAppShell.cpp:67
#20 0x0421094d in g_io_channel_unix_get_fd () from /lib/libglib-2.0.so.0
#21 0x041e7342 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#22 0x041ea31f in g_main_context_check () from /lib/libglib-2.0.so.0
#23 0x041ea6c9 in g_main_loop_run () from /lib/libglib-2.0.so.0
#24 0x00fbe1c4 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#25 0x099db678 in ?? ()
#26 0x099db678 in ?? ()
#27 0x00000001 in ?? ()
#28 0x00000001 in ?? ()
#29 0x00000000 in ?? ()