364901 - Firefox crashes when browsing five-plus pages though YouTube [@ 0x6c707538 - _releaseobject][@ NPSWF32.dll + 0x80f00]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Dakota Courtois]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1

When I am viewing a couple of tabs at once, and sometimes when I view a YouTube video, the brower crashes with the standard Windows XP "We're sorry" dialog box stating that it crashed. Sometimes it exits and I relaunch it and it exclaims "Firefox is already running, but not responding." I think it is a problem with the Flash plug-in. It happened after Firefox updated to 2.0.0.1.

Reproducible: Sometimes

Steps to Reproduce:
1. Update (if not already) to Firefox 2.0.0.1
2. Go to YouTube (or some other Flash site)
3. It may crash
4. If not: Open 2 or 3 tabs, 2 of them being YouTube videos.
5. It should crash.

Actual Results:  
It locked up and gave me "Shockwave Flash" errors for illegal instructions.

Expected Results:  
It should have worked.

Firefox is using the default theme. My machine is a 1.2GHz AMD Athlon with 128MB of RAM.

Comment 1

[timeless]

reporter: precisely what would the message have had to have said for you to have complained to Adobe instead of mozilla.org?

please do us the favor of actually giving a specific url where you *do* crash instead of vague steps that we can't reliably complete. it doesn't matter if 100 different places might crash, what matters is that you give us a single specific one that does instead of having us try thousands or millions that might not even crash on your computer.

you can actually fill in the URL field with that nice crashing url.

Comment 2

[Damian Yerrick]

It happens to me too, but only after I visit three or four YouTube videos on Gran Paradiso 3.0a1 with Flash 9.0 r28 on a PC running Windows 2000.

Dupe of Bug 355361?

Comment 3

[Wayne Mery (:wsmwk)]

Damian - you don't get a talkback or module name?

Dakota, Damian, we need URLs. You can get it from history.

Comment 4

[Wayne Mery (:wsmwk)]

Dakota, Damian, please reopen bug if you have a URL. Thanks.  For now, there is not enough information -> invalid

Comment 5

[Damian Yerrick]

I have finally had time to narrow this down. Watching about half a dozen videos on YouTube.com makes my copy of GPA2 crash, and it also happened with GPA1.

STEP 1
First open the following in tabs:
http://www.youtube.com/

STEP 2
In the window that conains youtube, visit the following pages:
http://www.youtube.com/watch?v=xQxrjYzUv68
http://www.youtube.com/watch?v=odWpuf2CawU
http://www.youtube.com/watch?v=EVR91_iNMTk
http://www.youtube.com/watch?v=9dMapz6qPx8

STEP 3
Click one of the stills in the "related" box.  After steps 1 and 2, it will take fewer than three clicks in "related" to crash the program.


But we can leave this as INVALID, as the error seems to go away when I disable Flashblock 1.5.3a in Tools > Add-ons.  I'll go report this on Flashblock's bug tracker if I can find it.

Comment 6

[Philip Chee]

This isn't actually invalid because a pure XBL/XUL extension shouldn't cause plugins to crash. This might actually be a duplicate of Bug 361921 where the cause is known. If you can get a talkback ID from a crash we can actually confirm whether it is that bug or not.

Comment 7

[Damian Yerrick]

I've reported this in http://bugzilla.mozdev.org/show_bug.cgi?id=16443

When I reproduce this bug, the Talkback window does not pop up, despite that it
appears enabled in Tools > Add-ons > Extensions.  How do I get a talkback ID?
Should I install GPA2 on another computer and try to get a talkback ID that way?

Comment 8

[Damian Yerrick]

Someone over there asked me to install Minefield.  I did, and then I went to
YouTube, watched some Minesweeper videos, and got these:

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a3pre) Gecko/20070306 Minefield/3.0a3pre

TB29983963Z
TB29984136G
TB29984221G
TB29984292H

Comment 9

[Wayne Mery (:wsmwk)]

leaving this one to Philip

Comment 10

[Philip Chee]

CC Igor because cvsblame points to him and blake kaplan because the crash is in spidermonkey.

TB29983963Z

Stack Signature	 0x6c707538 9d8fd566
Product ID	FirefoxTrunk
Build ID	2007030604
Trigger Time	2007-03-06 11:58:13.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	
URL visited	http://www.youtube.com
User Comments	watching youtube videos with flashblock turned on
Since Last Crash	727 sec
Total Uptime	727 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x6c707538
_releaseobject  [mozilla/modules/plugin/base/src/ns4xplugin.cpp, line 1557]
JS_GC  [mozilla/js/src/jsapi.c, line 1889]

TB29984221G

Stack Signature	 0x6c707538 9d8fd566
Product ID	FirefoxTrunk
Build ID	2007030604
Trigger Time	2007-03-06 12:06:25.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=364901
User Comments	watching videos of minefields
Since Last Crash	137 sec
Total Uptime	1017 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x6c707538
_releaseobject  [mozilla/modules/plugin/base/src/ns4xplugin.cpp, line 1557]
JS_GC  [mozilla/js/src/jsapi.c, line 1889]

TB29984292H

Stack Signature	 0x6c707538 9d8fd566
Product ID	FirefoxTrunk
Build ID	2007030604
Trigger Time	2007-03-06 12:09:16.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=364901
User Comments	watching more minefield videos
Since Last Crash	137 sec
Total Uptime	1154 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x6c707538
_releaseobject  [mozilla/modules/plugin/base/src/ns4xplugin.cpp, line 1557]
JS_GC  [mozilla/js/src/jsapi.c, line 1889]

TB29984136G

Stack Signature	 NPSWF32.dll + 0x80f00 (0x30080f00) b1b1be2c
Product ID	FirefoxTrunk
Build ID	2007030604
Trigger Time	2007-03-06 12:02:50.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	NPSWF32.dll + (00080f00)
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=364901
User Comments	testing bug 364901
Since Last Crash	153 sec
Total Uptime	880 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
NPSWF32.dll + 0x80f00 (0x30080f00)

Three of the four crashes occur here:

1883 igor.bukanov 3.277     js_GC(cx, GC_NORMAL);
1884                    
1885                    #if JS_HAS_GENERATORS
1886                        /*
1887                         * Run close hooks for objects that became unreachable after the last GC.
1888                         */

1889                        js_RunCloseHooks(cx);

1890                    #endif

It looks like when the flash object is released, the GC kicks in and falls over at js_RunCloseHooks.

Comment 11

[Brendan Eich [:brendan]]

_releaseobject is almost certainly being called via NPObjWrapper_Finalize:

http://lxr.mozilla.org/mozilla/ident?i=NPObjWrapper_Finalize

which would be called from js_GC (called from JS_GC) on the trunk at line 3079 of jsgc.c, not jsapi.c line 1889 (JS_GC's body). What could be going wrong?

Either the stack is not lying, only eliding tail-calling frames. Or something is not binary compatible with the trunk. I see no incompatible changes in jsapi.h, so I suspect the former. Say the call stack is JS_GC / js_GC / NPObjWrapper_Finalize and js_RunCloseHooks is a red herring. What would cause _releaseobject to crash? Can someone dig out the machine state (registers) and reason about control flow near the crash pc?

/be

Comment 12

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Talkback stacks on Windows pretty much always elide frames that don't save EBP -- that's more than just tail-calling frames.

Comment 13

[Brendan Eich [:brendan]]

Would be good to get the bug confirmed, even better with testcase reduction.

/be

Comment 14

[alex_mayorga]

If I get this right I would say this WORKSFORME on Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9b5pre) Gecko/2008032505 Minefield/3.0b5pre ID:2008032505

I opened an additional window and went to YouTube, opened 6 different videos on tabs and play them all at the same time (the sound mixture was mind boggling) and the videos played without a hitch.

This with Flash Player Version 9,0,115,0

Comment 15

[Philip Chee]

Confirm no crash with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008061305 Minefield/Firefox/3.0pre