563847 - Firefox 3.6.4 Crash Report [@ ntdll.dll@0x222a2 ] [@ RtlEnterCriticalSection ] (from PluginInstanceChild::FlashThrottleMessage) 3.6.4 sigs with [@ @0x0 | CallWindowProcAorW ] and some crashes [@ RtlRaiseStatus ] and [@ zzz_AsmCodeRange_End ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[chris hofmann]

looks like a new crash with a few reports on latest 3.6.4 builds and trunk.  just a few reports.

http://crash-stats.mozilla.com/report/index/a2ca427e-3bf1-4d0f-9e12-247552100503

Frame  	Module  	Signature [Expand]  	Source
0 	ntdll.dll 	ntdll.dll@0x222a2 	
1 	nspr4.dll 	PR_Lock 	nsprpub/pr/src/threads/combined/prulock.c:233
2 	xul.dll 	mozilla::MutexAutoLock::MutexAutoLock 	obj-firefox/dist/include/mozilla/Mutex.h:182
3 	xul.dll 	mozilla::plugins::PluginInstanceChild::FlashThrottleMessage 	dom/plugins/PluginInstanceChild.cpp:1616
4 	xul.dll 	mozilla::plugins::PluginInstanceChild::WinlessHiddenFlashWndProc 	dom/plugins/PluginInstanceChild.cpp:1498
5 	user32.dll 	InternalCallWinProc 	
6 	user32.dll 	UserCallWinProcCheckWow 	
7 	user32.dll 	DispatchMessageWorker 	
8 	user32.dll 	DispatchMessageW 	
9 	xul.dll 	base::MessagePumpForUI::ProcessMessageHelper 	ipc/chromium/src/base/message_pump_win.cc:361
10 	xul.dll 	base::MessagePumpForUI::ProcessNextWindowsMessage 	ipc/chromium/src/base/message_pump_win.cc:336
11 	xul.dll 	base::MessagePumpForUI::DoRunLoop 	ipc/chromium/src/base/message_pump_win.cc:205
12 	xul.dll 	base::MessagePumpWin::RunWithDispatcher 	ipc/chromium/src/base/message_pump_win.cc:52
13 	xul.dll 	base::MessagePumpWin::Run 	ipc/chromium/src/base/message_pump_win.h:78
14 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:216
15 	xul.dll 	MessageLoop::RunHandler 	
16 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
17 	xul.dll 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:165
18 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:26
19 	kernel32.dll 	kernel32.dll@0x13666 	
20 	ntdll.dll 	ntdll.dll@0x39e31 	
21 	ntdll.dll 	ntdll.dll@0x39e04

more at http://crash-stats.mozilla.com/report/list?signature=ntdll.dll@0x222a2

should watch this closely and nominate as blocker if it flares up with more usage.

Comment 1

[Benjamin Smedberg]

Jim, can the flash throttling outlast the PluginInstanceChild?

Comment 3

[Jim Mathies [:jimm]]

Attachment: patch v.1

Comment 4

[Jim Mathies [:jimm]]

Attachment: patch v.1

Comment 5

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 443609 [details] [diff] [review]
patch v.1

>+  // We may have already unhooked
>+  if (!mWinlessThrottleOldWndProc)
>+    return;

Nit: looks like that should have indent 4.

r=me!

Comment 6

[Benjamin Smedberg]

I hit this when trying to record bug 563741. I suspect that it will end up being common enough to require a 3.6.4 respin, but we should check crash-stats.

The most common scenario for this plugin crash well be when a user closes a tab/browser with a windowless flash video still playing (hulu/metacafe).

Comment 7

[Benjamin Smedberg]

This is the #1 topcrasher for 3.6.4 build3, and I think it should probably block rollout to the beta audience by default.

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

This is a regression from bug 558629, according to bsmedberg. Marking appropriately.

Comment 9

[LegNeato]

Comment on attachment 443609 [details] [diff] [review]
patch v.1

a=LegNeato for 1.9.2.4

Comment 10

[Jim Mathies [:jimm]]

http://hg.mozilla.org/mozilla-central/rev/1a9db8dbc7d3

Comment 11

[Jim Mathies [:jimm]]

Attachment: patch w/nit addressed

Comment 14

[Jim Mathies [:jimm]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/61402d7576ca
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/aface486f2e4

Comment 15

[Al Billings [:abillings - ex-MoCo]]

Is there a reliable STR here?

Comment 16

[Benjamin Smedberg]

No, but it was likely to happen when running windowless flash videos and closing the tab while the video was playing, e.g. open movies several hulu tabs and then close them.

Comment 17

[chris hofmann]

also check for the absence of a volume increase in RtlRaiseStatus crashes resulting from with stacks that look like

   8 3.6.4    
 ntdll.dll RtlRaiseStatus    
 ntdll.dll SHATransformP3    
 ntdll.dll RtlEnterCriticalSection    
 nspr4.dll PR_Lock    
 xul.dll mozilla::MutexAutoLock::MutexAutoLock(mozilla::Mutex &)    
 xul.dll mozilla::plugins::ChildAsyncCall::RemoveFromAsyncList()    

and

   5 3.6.4    
 ntdll.dll RtlRaiseStatus    
 ntdll.dll TransformMD5    
 ntdll.dll RtlEnterCriticalSection    
 nspr4.dll PR_Lock    
 xul.dll mozilla::MutexAutoLock::MutexAutoLock(mozilla::Mutex &)    
 xul.dll mozilla::plugins::ChildAsyncCall::RemoveFromAsyncList()    

there are other RtlRaiseStatus crash bugs with different stacks documented in bug 295514 so that signature isn't expected to go away entirely, but we should return to pre-3.6.4 volume levels.

Comment 18

[chris hofmann]

there is some extra verification of this fix looking at crash data in https://bugzilla.mozilla.org/show_bug.cgi?id=571118#c45

Comment 19

[chris hofmann]

re: duplicate hang comments

there is some analysis and rational for these reports in bug 568849 -  duplicated and missing hang reports in hand id pairs in 3.6.4 crash reports

Comment 20

[chris hofmann]

oops, that last comment was for another bug.