203177 - Browser crashes when invoking JavaScript window.close() via Flash fscommand() in popup window

Status: VERIFIED DUPLICATE of bug 169951

(Core Graveyard :: Plug-ins, defect)

Description

[simon ransome]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4a) Gecko/20030401
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4a) Gecko/20030401

If a popup window is launched containing an embedded Flash animation, and that
window is closed via a JavaScript function contained in the HTMl of the page
itself (not the Flash) but which is invoked via Flash's fscommand() function,
the popup and its parent browser crash. fscommand() passes a call upwards to a
function in the parental HTML which matches the ID/name of the embedded Flash
object, e.g. <script>function testcrasher_DoFSCommand(command, args){}</script>
(where "testcrasher" is the ID of the Flash object). If this JS function
contains a window.close(), it will crash the browser *unless* the window.close()
function is invoked after a delay of 2000 milliseconds (or thereabouts) with a
setTimeout( 'window.close()', 2000 ) function instead. Calling window.close()
directly (i.e. via a regular HTML form button in the window itself) behaves
normally. I have reported this bug to Macromedia as well, as I realise that
there's a possibility that the fault lies with them. This is also vaguely
similar to Bug 181751 and maybe indirectly related. This feature is repeatable
on at least Moz 1.4a and Moz 1.3 on Linux (Mandrake 9.0), Moz 1.0 (Debian
Distro) and Moz 1.1 on Windows 2k.

The url http://www.3glab.com/flash/test/crashmoz.html launches a popup with an
embedded Flash component that I created as a test which has nothing in it apart
from a single button object and the fscommand() function to invoke the
JavaScript. The JavaScript contained in the popup itself is exactly as per
Macromedia's recommendation (even cutting out all the extra browser-checking
stuff and leaving just the close function has the same effect).

The JavaScript used is contained in the page
http://www.3glab.com/flash/test/testcrasher.html

Reproducible: Always

Steps to Reproduce:
1.visit http://www.3glab.com/flash/test/crashmoz.html (allow popups)
2.click "click to crash" button
3.observe crash

Actual Results:  
Browser crashed

Expected Results:  
Popup window should close without bringing down the parent browser and all
related sessions, even if the page contains some heinous JS error or dodgy Flash
(unless, of course, it is a problem with the plugin itself and therefore not
Moz's fault per se).

See talkback IDs:
TB19455731E
TB19391990Z

No DLL is reported (at least under Windows - I've typed too much in here to risk
testing this browser :-). Browsers tested are running various themes: default
and Orbit 3+1 1.3 0.0.7

Comment 1

[Olivier Cahagne]

confirming using build 2003042304 on Win2k + Flash 6.0r79.

Comment 2

[Matthias Versen [:Matti]]

nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x02d11f20,
nsXPCWrappedJS * 0x02000001, unsigned short 3, const nsXPTMethodInfo *
0x02c36330, nsXPTCMiniVariant * 0x0012f8f8) line 1421 + 17 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x02d01240, unsigned short 3,
const nsXPTMethodInfo * 0x02c36330, nsXPTCMiniVariant * 0x0012f8f8) line 429
PrepareAndDispatch(nsXPTCStubBase * 0x00000000, unsigned int 3, unsigned int *
0x0012f9b0, unsigned int * 0x0012f9a0) line 117 + 18 bytes
SharedStub() line 147
NPSWF32! 038ae789()
NPSWF32! 038ab681()
NPSWF32! 038a173e()
NPSWF32! 0389c376()
NPSWF32! 03894e7a()
NPSWF32! 0389565c()
NPSWF32! 038acab3()
NPSWF32! 038aad13()
USER32! 77e2a244()
USER32! 77e06b21()
USER32! 77e06b44()
PluginWndProc(HWND__ * 0x008903f0, unsigned int 514, unsigned int 0, long
12124418) line 266
USER32! 77e2a244()
USER32! 77e045e5()
USER32! 77e0a792()
nsAppShellService::Run(nsAppShellService * const 0x00dff5e0) line 479
main1(int 0, char * * 0x00243de8, nsISupports * 0x00000000) line 1271 + 9 bytes
main(int 3, char * * 0x00243de8) line 1650 + 22 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001334ee,
HINSTANCE__ * 0x00400000) line 1674 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e9847c()

Comment 3

[Olivier Cahagne]

to confirm what's mentioned in initial comment, Mozilla won't crash if you
remove flashplayer.xpt from the components/ directory.

Comment 4

[HARUNAGA Hirotoshi]

dup of Bug 169951.

Comment 5

[Olivier Cahagne]

well spotted.

*** This bug has been marked as a duplicate of 169951 ***