Hang caused by Linux Flash plugin

[Brian Rogers]

I've been experiencing occasional system lockups for over two weeks, and 
I've usually cvsup'd after them, hoping the problem was solved.  It 
hasn't gone away, but today I figured out a good way of reproducing the 
problem.  There's a flash applet that will lock up my machine if I 
fiddle with it for a few minutes.  It seems that I also need some niced 
load on the system at the same time (the hang had always interrupted a 
build of something).

It was always a hang that I couldn't get a crash dump or anything out 
of.  Now that I had a way of reproducing it, I tried a few things:
I removed the nVidia driver and switched to nv.  Still hung.
I enabled the debug options in the kernel and recompiled it.  Still 
hung, still no crash data.
Finally, I left my system at the text console and tried to produce the 
hang through a VNC session from another computer.  It hanged again, and 
without displaying any messages on the screen like I had hoped for.  No 
response to control-alt-delete, num lock light wouldn't toggle, etc.

I'm running -CURRENT from April 9, Mozilla 1.7b, and the Linux plugin 
wrapper.
The flash applet I can crash the system so easily with is at 
http://www.marumushi.com/apps/newsmap/

What else can I try doing?

dmesg output after booting:
Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD 5.2-CURRENT #1: Sat Apr 10 20:03:27 PDT 2004
    brian at brian:/usr/obj/usr/src/sys/MYKERN
WARNING: WITNESS option enabled, expect reduced performance.
Preloaded elf kernel "/boot/kernel/kernel" at 0xc07ee000.
Preloaded elf module "/boot/kernel/snd_emu10k1.ko" at 0xc07ee244.
Preloaded elf module "/boot/kernel/snd_pcm.ko" at 0xc07ee2f4.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD Athlon(tm) XP 1800+ (1533.40-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x662  Stepping = 2
  
Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
  AMD Features=0xc0480000<MP,AMIE,DSP,3DNow!>
real memory  = 1073676288 (1023 MB)
avail memory = 1045340160 (996 MB)
ACPI APIC Table: <AMIINT VIA_K7  >
ioapic0 <Version 0.3> irqs 0-23 on motherboard
Pentium Pro MTRR support enabled
random: <entropy source, Software, Yarrow>
acpi0: <AMIINT VIA_K7> on motherboard
acpi0: [GIANT-LOCKED]
pcibios: BIOS version 2.10
Found $PIR table, 11 entries at 0xc00f7f20
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
acpi_cpu0: <CPU> on acpi0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pci0:0:0: setting power state D0
pci0:6:0: setting power state D0
pci0:10:0: setting power state D0
pci0:10:1: setting power state D0
pci0:16:0: setting power state D0
pci0:16:1: setting power state D0
pci0:16:3: setting power state D0
pci0:17:0: setting power state D0
pci0:17:1: setting power state D0
agp0: <VIA Generic host to PCI bridge> mem 0xe0000000-0xefffffff at 
device 0.0 on pci0
agp0: Bus reserved 0x10000000 bytes for rid 0x10 type 3 at 0xe0000000
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1:0:0: setting power state D0
pcib1: slot 0 INTA is routed to irq 16
pci1: <display, VGA> at device 0.0 (no driver attached)
dc0: <LC82C115 PNIC II 10/100BaseTX> port 0xe800-0xe8ff mem 
0xdfffff00-0xdfffffff irq 17 at device 6.0 on pci0
dc0: Bus reserved 0x100 bytes for rid 0x10 type 4 at 0xe800
miibus0: <MII bus> on dc0
dcphy0: <Intel 21143 NWAY media interface> on miibus0
dcphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
dc0: Ethernet address: 00:a0:cc:33:8e:1b
dc0: [GIANT-LOCKED]
pcm0: <Creative EMU10K1> port 0xe400-0xe41f irq 17 at device 10.0 on pci0
pcm0: Bus reserved 0x20 bytes for rid 0x10 type 4 at 0xe400
pcm0: <Cirrus Logic CS4297A AC97 Codec>
pcm0: [GIANT-LOCKED]
uhci0: <VIA 83C572 USB controller> port 0xdc00-0xdc1f irq 21 at device 
16.0 on pci0
uhci0: Bus reserved 0x20 bytes for rid 0x20 type 4 at 0xdc00
uhci0: [GIANT-LOCKED]
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub0: port error, restarting port 1
uhub0: port error, giving up port 1
ums0: Logitech USB-PS/2 Optical Mouse, rev 2.00/11.10, addr 2, iclass 3/1
ums0: 3 buttons and Z dir.
uhub0: port error, restarting port 2
uhub0: port error, giving up port 2
ulpt0: EPSON USB Printer, rev 1.10/1.00, addr 3, iclass 7/1
ulpt0: using bi-directional mode
uhci1: <VIA 83C572 USB controller> port 0xe000-0xe01f irq 21 at device 
16.1 on pci0
uhci1: Bus reserved 0x20 bytes for rid 0x20 type 4 at 0xe000
uhci1: [GIANT-LOCKED]
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub1: port error, restarting port 1
uhub1: port error, giving up port 1
ugen0: Texas Instruments Incorporated TI-GRAPH LINK USB, rev 1.10/1.03, 
addr 2
uhub1: port error, restarting port 2
uhub1: port error, giving up port 2
pci0: <serial bus, USB> at device 16.3 (no driver attached)
pci0: Failed to set ACPI power state D3 on (null): AE_BAD_PARAMETER
pci0:16:3: setting power state D3
isab0: <PCI-ISA bridge> at device 17.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 8235 UDMA133 controller> port 0xfc00-0xfc0f at device 17.1 
on pci0
atapci0: Bus reserved 0x10 bytes for rid 0x20 type 4 at 0xfc00
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
acpi_button1: <Sleep Button> on acpi0
fdc0: I/O to control range incorrect
sio0 port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A
sio1 port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
ppc0 port 0x778-0x77b,0x378-0x37f irq 7 drq 3 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/9 bytes threshold
ppbus0: <Parallel port bus> on ppc0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
fdc0: I/O to control range incorrect
cpu0 on motherboard
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
orm0: <Option ROM> at iomem 0xc0000-0xce7ff on isa0
pmtimer0 on isa0
fdc0: cannot reserve I/O port range (6 ports)
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 1533395582 Hz quality 800
Timecounters tick every 10.000 msec
acpi_cpu: throttling enabled, 16 steps (100% to 6.2%), currently 100.0%
ad0: 114473MB <WDC WD1200JB-00CRA0> [232581/16/63] at ata0-master UDMA100
ad1: 114473MB <WDC WD1200JB-00CRA1> [232581/16/63] at ata0-slave UDMA100
ad2: 78533MB <IC35L080AVVA07-0> [159560/16/63] at ata1-master UDMA100
acd0: CDRW <TDK DVDRW420N> at ata1-slave UDMA33
cd0 at ata1 bus 0 target 1 lun 0
cd0: <TDK DVDRW420N 1.39> Removable CD-ROM SCSI-0 device
cd0: 33.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from ufs:/dev/ad0s1a
lock order reversal
 1st 0xc6065e38 filedesc structure (filedesc structure) @ 
/usr/src/sys/kern/sys_generic.c:902
 2nd 0xc06f1c00 Giant (Giant) @ /usr/src/sys/fs/specfs/spec_vnops.c:387
Stack backtrace:
backtrace(c069e235,c06f1c00,c069a061,c069a061,c069544c) at backtrace+0x17
witness_checkorder(c06f1c00,9,c069544c,183,c0697b66) at 
witness_checkorder+0x6f6
_mtx_lock_flags(c06f1c00,0,c069544c,183,c069e835) at _mtx_lock_flags+0x9a
spec_poll(f0c63afc,f0c63b1c,c0579e3c,f0c63afc,c06e60c0) at spec_poll+0x147
spec_vnoperate(f0c63afc,c06e60c0,c6080c30,40,c1e6ae00) at 
spec_vnoperate+0x18
vn_poll(c6060b6c,40,c1e6ae00,c602c000,c1e6ae00) at vn_poll+0x3c
selscan(c602c000,f0c63b9c,f0c63b8c,4,4) at selscan+0x11b
kern_select(c602c000,4,bfbfe4d0,0,0) at kern_select+0x363
select(c602c000,f0c63d14,14,434,5) at select+0x66
syscall(2f,2f,2f,ffffffff,0) at syscall+0x242
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (93), eip = 0x282f1a4f, esp = 0xbfbfe47c, ebp = 0xbfbfe588 ---