217296 - Crash when set display=none to div with Flash inside [@ nsXPCWrappedJSClass::CallMethod]

Status: RESOLVED DUPLICATE of bug 246892

(Core Graveyard :: Plug-ins, defect)

Description

[/\/\arcio Galli]

Crashes Netscape 7.1. There is a flash animation inside a DIV. This DIV is block
by its own nature. At the end of the flash animation, the flash animation sends
an event to the JS, calling a function which works fine. This function is trying
to: 

Disable the DIV via setting its style.display CSS property: 

  document.getElementById("mask").style.display="none";

PPS: Mask is the DIV with the flash. 

I am filing against trunk however I just confirmed with N7.1. So need help to
check with Mozilla.

Comment 1

[/\/\arcio Galli]

The URL is http://www.mgalli.com/flash/door/mozilla.org.html

Comment 2

[Olivier Cahagne]

wfm 2003081904 on Win2k + flash 7.0.249.
anyone who crashes: please submit data from Netscape Feedback Agent then mention
the generated Talkback ID here "mozilla/bin/components/talkback.exe".
If you crash, mention Flash version and whether or not you have a
flashplayer.xpt in your components/ directory (which enables Flash-to-JavaScript
communication, apparently used by this URL).

Comment 3

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5b) Gecko/20030824
Shockwave Flash 6.0 r79

Comment 4

[/\/\arcio Galli]

Additional information about the crash: 

When using the demo, please click the image. It will trigger the animation. 

- Scriptability is working in this case fine, is the JS CSS trying to
display=none that crashes. 
- Talback ID is: 23063634.
- Version is: Shockwave Flash 6.0 r79
- Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030622
Netscape/7.1 (ax)

Comment 5

[Fabricio Campos Zuardi]

I've reproduced the crash here, I've clicked to start the animation and after
the end of the animation the browser crashed.

Mozilla 1.4
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624
Shockwave Flash 7.0 d249

my Talkback ID is: TB23066086H

Comment 6

[Hermann Schwab]

crashes on a celeron 333, Win98, Flash 6.0r79 with 
Netscape 7.1 TB23065221W
Mozilla 1.4 TB23065289K
Mozilla 1.3.1 TB 23065336H
no crash on trunk BuildID 2003060824, see my comment #3

Crashes on a Athlon XP1600, Win98SE, Flash 6.0r79 with
Mozilla trunk, BuildID 2003082204, TB230658524

no crash with BuildID 2003082505

All tests done by clicking on that animation.
The keyhole opens to a various degrees, then DocWatson comes up, tells about a
crash in XPC3250.DLL

Comment 7

[Hermann Schwab]

Didn´t change my working installation of BuildID 2003082505 installed from sea.exe
Unzipped zip-Build BuildID 2003082204 to retest, as my sea.exe 2003082204 had
crashed on this Win98SE.
Started Mozilla from where it was unzipped, didn´t make it to default browser,
didn´t crash.
Maybe that is because it was using the plugins from the 203082505 default
installation, but that had been installed on top of 2003082204, without
reinstallation of plugins.

installed and tested last three working Firebird nightlies, no crash.

Comment 8

[Olivier Cahagne]

Marcio, can you produce a reduced testcase that show this issue (without the
whole mozilla.org page) ?

Comment 9

[Adam Hauner]

There are stack traces (TB23065998, TB23065852) referring to this bug:

nsXPCWrappedJSClass::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp line 1412]
nsXPCWrappedJS::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp line 429]
PrepareAndDispatch
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp
line 119]
SharedStub
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp
line 147]
NPSWF32.DLL + 0x4ed2a (0x1004ed2a)
NPSWF32.DLL + 0x4bb65 (0x1004bb65)
NPSWF32.DLL + 0x41bd7 (0x10041bd7)
NPSWF32.DLL + 0x3c7ff (0x1003c7ff)
NPSWF32.DLL + 0x3ce53 (0x1003ce53)
NPSWF32.DLL + 0x4d364 (0x1004d364)
NPSWF32.DLL + 0x4b22f (0x1004b22f)
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x24407 (0xbff94407)
0x00658b66 

Source File :
c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp line no: 1412

Comment 10

[Peter Lubczynski]

sounds like this isn't crashing on the trunk, right?

Can someone help narrow down what checkin fixed this on the trunk so we can
migrate it to the stable 1.4 branch?

Comment 11

[Adam Hauner]

Crashes noted in comment #9 are from build 2003082204/W98
http://ftp.mozilla.org/pub/data/crash-data/detailed-crash-analysis-all.html

Peter: there was your bug 169951 between 1.4a and 1.4b with same signature, but
it's long time.

Comment 12

[Olivier Cahagne]

it crashes on trunk, I was wrong in comment 2, I hadn't click on the Flash app.
It doesn't seem to crash on Linux (2003082005 + Flash 6.0r79) but this could be
because of lack of Flash scriptability (bug 212798).
Similar stack in bug 169951.

Comment 13

[Peter Lubczynski]

ok, just looked at the testcase and I see what's going on: it's nasty.

Basically, in an FSCommand, there is a script that is causing the destruction of
frames who have the plugin as a child. When you do a style.display='none' on the
plugin that is executing the FSComamnd, it casues the plugin to be unloaded.

Also see: bug 90268, bug 136927, bug 158670, and bug 195116.

The author of the page can probably get the desired effect without the crash by
trying to toggle CSS visibility and/or width+height.

A simplified testcase would also help here.

Comment 14

[Adam Hauner]

Attachment: testcase

simplified testcase (without Mozilla.org's table layout)

Comment 15

[Adam Hauner]

I was crashing with nightbuild from 24th, but after deleting Mozilla binaries
and refresh from zipfile, both testcases are WFM (tryed with nightbuilds from
24th and 26th). Could anyone retry with fresh installation of any Mozilla?

Comment 16

[Olivier Cahagne]

Adam, do you have flashplayer.xpt in your components/ directory ? This is
required  for this testcase to crash afaik.

Comment 17

[Adam Hauner]

Olivier: Oops, I lost it when deleting.
If I choose "NN4.78, Opera 7" while installing Flash 7beta, flashplayer.xpt
isn't present and Mozilla is not crashing (and demo looks fine). If I choose
Mozilla plugin directory, flashplayer.xpt is presented and Mozilla starts
crashing. (discover I America just now? =))

Comment 18

[Hermann Schwab]

TB23098851G Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5b) Gecko/20030826

I didn´t crash, when flashplayer.xpt wasn´t installed.
At first install of Flash, I got a menu with
Netscape4/Mozilla1.4a(Firebird)/Mozilla1.5b(Trunk) and I didn´t select anything,
or maybe all, and flash was working in all browsers, but flashplayer.xpt wasn´t
installed.
After reading comment #16 I reinstalled (without deinstalling) Flash, this time
only Mozilla 1.5b selected.
Result: flashplayer.xpt installed, and producing more talkbacks :-(

Comment 19

[Santosh Gupta]

Bug is reproducable on Win 2K/Netscape 7.1 and Mozilla 1.6 with Player 7. 

Comment 20

[Anders Pedersen]

Confirmed crash launching testcase.

talkbackid: TB9477G

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040331
Microsoft Windows 2000 Professional 5.00.2195 SP4
Shockwave Flash 7.0 r19

Comment 21

[Olivier Cahagne]

confirming crash FF 20040401 Linux + Flash 6.0r81 (scriptable): TB9969X.

Comment 22

[Adam Hauner]

Attachment: TB9477 stacktrace

Comment 23

[Jeremy Tan]

Confirmed crash on: 

Win2K, Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113,
Shockwave Flash 7.0 r19

AND

Linux Redhat 9, Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040113,
Shockwave Flash 7.0 r25

Comment 24

[Jeremy Tan]

Attachment: Reproduce bug using Macromedia's fscommand example

run html packaged in zip file to reproduce the bug.  what this flash movie does
is send a variable to javascript w/ fscommand and then a javascript function
hides the div -- causing the crash.  I have included the flash fla (src) and a
swf file published to Flash 7, use mozilla with flash 7 plugin for this to
work.

Comment 25

[Peter Lubczynski]

yeah, this is becaue "plugins are tied to frames" (search for an old bug on
this) and when you set display: none, that destroys the frame, and plugin, right
away. Since your going through an FSCommand and your in the code of the plugin,
destroying it at that time is bad.

One thing you can try as a workaround is putting a setTimeout() someplace in the
JS/FSCommand sequence to allow the browser to pop it's stack to service the
message loop.

Comment 26

[Jay Patel [:jay]]

*** Bug 243357 has been marked as a duplicate of this bug. ***

Comment 27

[Jay Patel [:jay]]

Ignore the duped bug above, that was my mistake.  

Any updates on this crash?  There aren't as many incidents in Talkback data as
before, but still enough to take a closer look if we can.

If anyone is able to reproduce this with a recent release/nightly, it would also
be nice to get a fresh Talkback ID (since old incidents are no longer available
after the db upgrade).

Comment 28

[Alexander Grimalovsky]

I can confirm this crash on Windows 2000 SP4, Mozilla v1.7, Flash 7.0 r19 
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7)
Gecko/20040616 MultiZilla/1.6.4.0b
Also it crashes on WinXP (version of Mozilla and Flash player are same).

I have also prepared simplified testcase for this bug.

Comment 29

[Alexander Grimalovsky]

Attachment: Simple Flash movie

Flash movie for testcase

Comment 30

[Alexander Grimalovsky]

Attachment: Testcase page

Testcase page

Comment 31

[Alexander Grimalovsky]

Attachment: Source .fla file

Source .fla file for Flash movie, used in testcase, just in a case anybody is
interested in it

Comment 32

[timeless]

*** This bug has been marked as a duplicate of 246892 ***