1197077 - Firefox hangs because of Flash when visiting certain websites sometimes in version 41

Status: RESOLVED DUPLICATE of bug 1207766

(Core :: Security: Process Sandboxing, defect)

Description

[fireattack [:fireattack]]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150817163452

Steps to reproduce:

Recently (after entering 41 beta), Firefox often hangs we visiting some websites I visit everyday.

The website I mostly encounter this problem is http://bbs.saraba1st.com/2b/forum-6-1.html (which is a Chinese forum, and you need to login to see most of its content.. so I guess it's not very help to test for you guys)

It happens on two different computers with quite different hardware.

It doesn't happen every time so it makes it very hard for me to troubleshooting with addons, preferences, etc. But at least it never happens before 41.

But I crashed Firefox with crashfirefox.exe and created a report:

https://crash-stats.mozilla.com/report/index/f9d60852-139d-4e0b-ba43-2bb1b2150821

Comment 1

[fireattack [:fireattack]]

Another hang when visiting http://bbs.saraba1st.com/2b/forum-51-1.html when using my laptop.
I crashed it too: https://crash-stats.mozilla.com/report/index/929b98ee-09ec-45e0-bc54-581812150821

Comment 2

[Gabriela [:gaby2300]]

I cannot repro using Windows 7 64 bit, both sites loaded without hanging nor crashing.
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150820142145

Comment 3

[fireattack [:fireattack]]

I said SOMETIMES it hangs.

Did you even read my description?

Comment 4

[fireattack [:fireattack]]

I tested with safe-mode today. 

Firefox still hangs randomly.

Comment 5

[fireattack [:fireattack]]

http://forums.mozillazine.org/viewtopic.php?f=23&t=2957117

related topic.

Comment 6

[Mike Kaply [:mkaply]]

I'm seeing this as well. Brand new profile. Hung on mail.com and web.de

Comment 7

[Mike Kaply [:mkaply]]

I forced a crash on the hang:

https://crash-stats.mozilla.com/report/index/f83ccece-92ed-484c-a195-5df9a2150923

Comment 8

[Mike Kaply [:mkaply]]

I have no idea if what I'm doing is helpful, but I was able to break in in the debugger and I am hing here:

          // Use a combination of DwmFlush + DwmGetCompositionTimingInfoPtr
          // Using WaitForVBlank, the whole system dies :/
          WinUtils::dwmFlushProcPtr();
          HRESULT hr = WinUtils::dwmGetCompositionTimingInfoPtr(0, &vblankTime);
          vsync = TimeStamp::Now();
          if (SUCCEEDED(hr)) {
            vsync = GetAdjustedVsyncTimeStamp(frequency, vblankTime.qpcVBlank);
          }

in gfxWindowsPlatform.cpp

I'm hing on the dwmGetCompositionTimingInfoPtr

Comment 9

[fireattack [:fireattack]]

This bug is related to Flash. After disabling (or click to enable) Flash, the problem is fixed.

And as far as I can tell now, it's somehow fixed in 42.

However, according to various reports in different community, this freezing/hanging problem still happens frequently in version 41 (which is the release version now).

We really need a experienced dev help to investigate it I'd say (it's really beyond my ability, that's why this report is vague as **). It affects much more people now.

Comment 10

[YF (Yang)]

Attachment: screenshot - Threads

Comment 11

[YF (Yang)]

Attachment: screenshot - Stack for thread

Copy All:
mozglue.dll!_aligned_free+0xbd
xul.dll!?BrokerDuplicateHandle@SandboxTarget@mozilla@@QAE_NPAXKPAPAXKK@Z+0x33e
xul.dll!?StartSandbox@SandboxTarget@mozilla@@QAEXXZ+0x52e91
xul.dll!?StartSandbox@SandboxTarget@mozilla@@QAEXXZ+0x52eb7
xul.dll!?preventExtensions@OpaqueCrossCompartmentWrapper@js@@UBE_NPAUJSContext@@V?$Handle@PAVJSObject@@@JS@@AAVObjectOpResult@5@@Z+0x62c30b
NPSWF32_19_0_0_201.dll!NP_SetBrokerClient+0x68
NPSWF32_19_0_0_201.dll!NP_Shutdown+0x86c5
NPSWF32_19_0_0_201.dll!NP_Shutdown+0x8767
NPSWF32_19_0_0_201.dll+0x124608
NPSWF32_19_0_0_201.dll+0x127838
NPSWF32_19_0_0_201.dll+0x1740e8
NPSWF32_19_0_0_201.dll+0x1743ca
NPSWF32_19_0_0_201.dll+0x173deb
NPSWF32_19_0_0_201.dll+0x174316
NPSWF32_19_0_0_201.dll+0x150d41
NPSWF32_19_0_0_201.dll!NP_Shutdown+0x1725
NPSWF32_19_0_0_201.dll+0x36d9c
NPSWF32_19_0_0_201.dll+0x15abf2
NPSWF32_19_0_0_201.dll!BrokerMainW+0x1a31a
NPSWF32_19_0_0_201.dll!BrokerMainW+0x1f06d
NPSWF32_19_0_0_201.dll+0x65b10
NPSWF32_19_0_0_201.dll+0x15b6e7
NPSWF32_19_0_0_201.dll+0x1e80
NPSWF32_19_0_0_201.dll!FlashPlayer_19_0_0_201_FlashPlayer+0x6521
NPSWF32_19_0_0_201.dll+0xdee66
NPSWF32_19_0_0_201.dll+0xdf193
NPSWF32_19_0_0_201.dll+0x147786
NPSWF32_19_0_0_201.dll+0xedb7d
NPSWF32_19_0_0_201.dll+0x15bf0e
NPSWF32_19_0_0_201.dll+0x15bf40
NPSWF32_19_0_0_201.dll+0x159830
NPSWF32_19_0_0_201.dll+0x15c2b3
NPSWF32_19_0_0_201.dll!NP_Shutdown+0x52b7
xul.dll!?NukeCrossCompartmentWrappers@js@@YA_NPAUJSContext@@ABUCompartmentFilter@1@1W4NukeReferencesToWindow@1@@Z+0x1765c
xul.dll!?NukeCrossCompartmentWrappers@js@@YA_NPAUJSContext@@ABUCompartmentFilter@1@1W4NukeReferencesToWindow@1@@Z+0x176aa
xul.dll!?preventExtensions@OpaqueCrossCompartmentWrapper@js@@UBE_NPAUJSContext@@V?$Handle@PAVJSObject@@@JS@@AAVObjectOpResult@5@@Z+0x6293fc

Comment 12

[YF (Yang)]

http://mxr.mozilla.org/mozilla-beta/search?string=TargetNtUnmapViewOfSection%4012

Comment 13

[YF (Yang)]

May be relevant, notify them.

Comment 14

[YF (Yang)]

I also saw it in Fx41.0 32bit with Flash 19.0.0.201 on Win8.1.

Comment 15

[besrml]

From previous release of Fx 41(beta or aurora) was getting the browser hanging, after a refresh and disabled  oop for flash in mms.cfg and the plugin setting was resolved.

With the release of Fx 41(release channel) the problem got back, I have restricted to the process plugincontainer, kill it and the browser got responsive again.

The hang of plugincontainer is intermitent and don't get any report(doesn't crash).

In related websites say is related to dom.ipc.plugins.asyncInit setted to true, but in my case is false already. Was the flash plugin whitelisted to async comunication?

Perharps i need another option to complete disable the async options for the addons.

The workaround was revert back to Fx 40.0.3

Comment 16

[xunxun]

After turning off Flash protected mode, and setting dom.ipc.plugins.asyncInit.enabled to false, I found that the issue can be reproduced on 41.0b2+, but didn't on 41.0b1

I try to narrow the commit between b1 and b2, and found that it's caused by Bug 1182411

Comment 17

[xunxun]

(In reply to xunxun from comment #16)
> After turning off Flash protected mode, and setting
> dom.ipc.plugins.asyncInit.enabled to false, I found that the issue can be
> reproduced on 41.0b2+, but didn't on 41.0b1
> 
> I try to narrow the commit between b1 and b2, and found that it's caused by
> Bug 1182411

I upload the test build to https://sourceforge.net/projects/pcxfirefox/files/Test/Firefox/Fx41PluginHangTest/
20150928.7z is pcxFirefox 41.0 nopgo edition without Bug 1182411 changes, and in my VM PC, the edition didn't reproduce the hang.

Can someone use this edition fix the hang? If so, the bug will block Bug 1182411

Comment 18

[fireattack [:fireattack]]

(In reply to besrml from comment #15)
> From previous release of Fx 41(beta or aurora) was getting the browser
> hanging, after a refresh and disabled  oop for flash in mms.cfg and the
> plugin setting was resolved.
> 
> With the release of Fx 41(release channel) the problem got back, I have
> restricted to the process plugincontainer, kill it and the browser got
> responsive again.
> 
> The hang of plugincontainer is intermitent and don't get any report(doesn't
> crash).
> 
> In related websites say is related to dom.ipc.plugins.asyncInit setted to
> true, but in my case is false already. Was the flash plugin whitelisted to
> async comunication?
> 
> Perharps i need another option to complete disable the async options for the
> addons.
> 
> The workaround was revert back to Fx 40.0.3

Please also check bug 1207766. And about dom.ipc.plugins.asyncInit, it looks (reported by Alice0775 White) like that if you set it to TRUE, the problem will be gone (not FALSE). Did you try setting it to TURE?

Comment 19

[besrml]

(In reply to Benjamin Peng from comment #18)
> Please also check bug 1207766. And about dom.ipc.plugins.asyncInit, it looks
> (reported by Alice0775 White) like that if you set it to TRUE, the problem
> will be gone (not FALSE). Did you try setting it to TURE?

Using dom.ipc.plugins.asyncInit.enabled with value of true the problem gone.

Comment 20

[Bob Owen (:bobowen)]

This is the same problem as bug 1207766 and I'll pick it up there.

Thanks to everyone for their help in tracking this down.