380472 - Crash when closing tab after viewing Flash - with FlashBlock enabled

Status: RESOLVED WORKSFORME

(Camino Graveyard :: Annoyance Blocking, defect)

Description

[philippe (part-time)]

Attachment: Apple crash log

Build used: 2007051118 (2.0a1pre)

STR
1. enable Flashblock
2. Visit URL
3. click the header of the pages to allow the flash movie to play.
4. close tab - crash
----
If Flashblock is not enabled, this does not happen.
This not happen on every site that has embeded flash.
Joost use some JS to embed the Flash stuff in the page (either the UFO method of SWFObject).
I have experienced the same crash on other sites that use those methods to embed Flash stuff.
----

From the crash log:
0   libnspr4.dylib            	0x20020aec _PR_DarwinPPC_AtomicDecrement + 0
1   org.mozilla.camino        	0x0069c130 _releaseobject + 32
2   org.mozilla.camino        	0x006a1fc0 nsJSObjWrapper::GetNewOrUsed(_NPP*, JSContext*, JSObject*) + 3200
3   libmozjs.dylib            	0x23045f84 js_FinalizeObject + 108
4   libmozjs.dylib            	0x2302ee38 js_GC + 1176
5   libmozjs.dylib            	0x23003bc4 JS_GC + 76
6   org.mozilla.camino        	0x0013df8c nsXPConnect::BeginCycleCollection() + 320
7   libxpcom_core.dylib       	0x2c050d68 nsCycleCollector::Collect(unsigned) + 184



(or is the component 'Annoyance blocking' ?)

Comment 1

[Samuel Sidler (old account; do not CC)]

(In reply to comment #0)
> (or is the component 'Annoyance blocking' ?)

Yeah, I think it'd be better to put it there. :)

Comment 2

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Someone (BDog?) brought up this crash a few weeks ago, and I can't remember if I found the bug for it or not--I'm pretty sure one is (mis)filed somewhere in Core.

Comment 3

[Philip Chee]

This may actually be core, or at least a cycle collector bug that is triggered by Flashblock when it removes an object from the DOM. On trunk I see a lot of crashes (WinXP/SP2) that all involve trying to free memory after passing through the cycle collector. One way to test this is to see if this crash does not occur before the cycle collector code landed on the trunk. Can anyone find a regression range for this crash? I don't have OSX so I can't help there.

Comment 4

[philippe (part-time)]

(In reply to comment #3)

Crashing with the 2007022201 Camino trunk build. That is the first build after bug 295755 landed.

Afaik, most of the cycle collector stuff landed early January 2007 (you mean bug 333078, I think).
I'll try testing with the Flashblock extension on Minefield next.

Comment 5

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I think maybe I was thinking of bug 354380, which is not the same stack.

Comment 6

[philippe (part-time)]

With FlashBlock 1.5.3 extension installed, I tried a number of Minefield builds from the past 6 weeks, and none of them crashed. 
(I also tried Flashblock 1.5.4a, but that one wouldn't let me view flash stuff...).

Are there still differences between Minefield and Camino on how the Flash Plugin is handled ?

---
I also found bug 354595 that mentions 'nsJSObjWrapper::GetNewOrUsed' in the crash stack, but the rest looks quite different, and the attached test case doesn't crash Camino here.

Comment 7

[Philip Chee]

(In reply to comment #6)
> Are there still differences between Minefield and Camino on how the Flash
> Plugin is handled ?

or perhaps the difference is in how tab close is handled.

Comment 8

[philippe (part-time)]

I've done a bunch of test with this (10.4.10 ppc). Builds made with GCC 3.3 /OS 10.3SDK crash(ed) fairly consistently, either with the above stack, or the one in bug 371250. Happens both with the Flash plugin 9.0 r60 beta and 9.0 r45.
Builds made with GCC 4.01 / OS X 10.4uSDK perform correctly: no crashes.

I suppose bug 385221 somehow fixed this.

Anyone else still experiencing this crash ?

Comment 9

[Stuart Morgan]

Closing WFM based on comment 8.