1146350 - Crash in [@ hang | ConsoleCopyStringToBuffer ]

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, defect)

Description

[Marius]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Build ID: 20150320202338

Steps to reproduce:

Reproducible with Fx 36.0.4, main profile. Not reproducible with a clean profile (Windows 8.1 64-bit)

1. Open History sidebar.
2. Right click on any entry and selected 'Forget about this site'.


Actual results:

The context menu remains visible, Firefox hangs & crash.


Expected results:

Selected entries are deleted from History.

Comment 1

[Wayne Mery (:wsmwk)]

If you have crash IDs for the hang please post it here in the bug report.
https://support.mozilla.org/en-US/kb/mozillacrashreporter

Comment 2

[Chris Peterson [:cpeterson]]

Socorro collected 1112 instances of this Flash crash in August 2015 so far:

bp-8b75ee4b-b480-4ce6-a686-967a22150806
bp-19e91e46-34b9-4410-8e37-6ae762150805
bp-65feafa5-f8e1-4ecd-90a1-de8402150805
bp-817a9e14-dff4-4a31-8aef-585152150805
...

Frame 	Module 	Signature 	Source
0 	ntdll.dll 	NtWaitForMultipleObjects 	
1 	kernelbase.dll 	ConsoleCopyStringToBuffer 	
2 	user32.dll 	MsgWaitForMultipleObjectsEx 	
3 	user32.dll 	MsgWaitForMultipleObjects 	
4 	npswf32_18_0_0_209.dll 	F_1152915508___________________________________ 	F117835525______________________________________________________________________________:134
5 	npswf32_18_0_0_209.dll 	F2166389_____________________________________________________________________ 	F_851861807__________________________________________________________:568
6 	npswf32_18_0_0_209.dll 	F_917831355____________________________________________ 	F_851861807__________________________________________________________:493
7 	npswf32_18_0_0_209.dll 	F1315696776________________________________ 	F_851861807__________________________________________________________:444
8 	npswf32_18_0_0_209.dll 	F_1428703866________________________________ 	F_766591945____________________________________________________________________:203
9 	npswf32_18_0_0_209.dll 	F845925699_____________________________________ 	F1677514683__________________________________________________________________________________:104
10 	npswf32_18_0_0_209.dll 	F_933438433_______________________________________ 	F742694549____________________________________________________________________:192
11 	xul.dll 	mozilla::plugins::PluginScriptableObjectChild::AnswerHasMethod(mozilla::plugins::PluginIdentifier const&, bool*) 	dom/plugins/ipc/PluginScriptableObjectChild.cpp
12 	xul.dll 	mozilla::plugins::PPluginScriptableObjectChild::OnCallReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PPluginScriptableObjectChild.cpp
13 	xul.dll 	mozilla::plugins::PPluginModuleChild::OnCallReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PPluginModuleChild.cpp
14 	xul.dll 	mozilla::ipc::MessageChannel::DispatchInterruptMessage(IPC::Message const&, unsigned int) 	ipc/glue/MessageChannel.cpp
15 	xul.dll 	mozilla::ipc::MessageChannel::Call(IPC::Message*, IPC::Message*) 	ipc/glue/MessageChannel.cpp
16 	xul.dll 	mozilla::plugins::PPluginScriptableObjectChild::CallNPN_Evaluate(nsCString const&, mozilla::plugins::Variant*, bool*) 	obj-firefox/ipc/ipdl/PPluginScriptableObjectChild.cpp
17 	xul.dll 	mozilla::plugins::PluginScriptableObjectChild::Evaluate(_NPString*, _NPVariant*) 	dom/plugins/ipc/PluginScriptableObjectChild.cpp

Comment 3

[Jeromie Clark]

It seems like a generic signature that isn't pointing to a discrete issue.  If you have a better way to separate things out, that might be interesting, but the theme is that this looks like another class of IPC-related hangs that would probably be remediated by a native NPAPI sandbox for 32-bit Firefox.

Here's the analysis from our developer: 

Looking at the reports, this appears to be a very wide bucket with a lot of issues. Some of the call stacks are hung with the Flash Player code making NPN_Invoke or other NPN Object calls to the browser that appear to be legitimately stuck (i.e. they call has not returned for some reason when Firefox times out and decides we are hung.)

In other reports, it appears that the Flash Player instance was in the middle of some GC activity when Firefox decided to kill us.

Not sure if there is a way for us to reduce the number of hangs for this signature, since it seems to be a bit generic and catching several different hangs. In the case of the NPN calls that are hanging, it appears that we are waiting for plugin-container to return from its IPC call to the browser process, so it doesn't appear that we are the cause of the hang. In the GC activity hangs, it doesn't appear that we are in the middle of an operation that would get stuck on a wait or critical section acquire, so I am not sure what I can do to avoid Firefox timing us out in that case.

Comment 4

[Calixte Denizet (:calixte)]

Crash volume for signature 'hang | ConsoleCopyStringToBuffer':
  - nightly (50): 96
  - aurora (49): 252
  - beta (48): 1129
  - release (47): 11877
  - esr (45): 180

Affected platform: Windows

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'hang | ConsoleCopyStringToBuffer':
 - nightly (version 51): 22 crashes from 2016-08-01.
 - aurora  (version 50): 33 crashes from 2016-08-01.
 - beta    (version 49): 919 crashes from 2016-08-02.
 - release (version 48): 896 crashes from 2016-07-25.
 - esr     (version 45): 225 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       8       7       5
 - aurora       13      13       5
 - beta         68     499     323
 - release     183     311     308
 - esr          17      12      12

Affected platform: Windows

Crash rank on the last 7 days:
             Browser   Content Plugin
 - nightly                     #25
 - aurora                      #28
 - beta                        #21
 - release                     #11
 - esr                         #41

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'hang | ConsoleCopyStringToBuffer':
 - nightly (version 52): 8 crashes from 2016-09-19.
 - aurora  (version 51): 6 crashes from 2016-09-19.
 - beta    (version 50): 35 crashes from 2016-09-20.
 - release (version 49): 333 crashes from 2016-09-05.
 - esr     (version 45): 235 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       6       2
 - aurora        6       0
 - beta         27       8
 - release     256      77
 - esr           8      10

Affected platform: Windows

Crash rank on the last 7 days:
             Browser   Content Plugin
 - nightly                     #25
 - aurora                      #46
 - beta                        #32
 - release                     #16
 - esr                         #58

Comment 7

[Benjamin Smedberg]

Resolving old bugs which are likely not relevant any more, since NPAPI plugins are deprecated.