425157 - Crash when closing popup window containing Quicktime plugin

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[Michael Schonfeld]

Build identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5pre) Gecko/2008032504 Minefield/3.0b5pre

When closing the "tutorial video" popup window in the Antares website, Firefox immediately crashes. This happens every time.

Steps to reproduce:
1. Go to http://www.antarestech.com/products/auto-tune5.shtml
2. Find the "Welcome to Auto-Tune" link under the Tutorial Videos section.
3. Click on any of the 2 videos, and wait a moment until a small portion of the QuickTime movie loads.
4. Close the popup window

Expected result:
Firefox should close the popup window and NOT crash.

Actual result:
Firefox closes the window, hangs for a short while (you can see "javascript:void(0);" in the status bar text area) and then crashes.

Comment 1

[Mats Palmgren (inactive)]

Regression range: 2008-03-13-04 -- 2008-03-14-04
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-03-13+03%3A00&maxdate=2008-03-14+05%3A00&cvsroot=%2Fcvsroot
Most likely bug 416953.

Build 2008032504 does not have the fix for bug 420886 (will be in 2008032604)
but my local test builds that do have it also crash.

Comment 2

[Mats Palmgren (inactive)]

Attachment: wallpaper

I tried various schemes to delay the different parts of DoStopPlugin()
(CallSetWindow/SetWindow/Stop/Destroy) but all variations I tried caused
some regression for other plugins...
This patch seems to work as a wallpaper if we can't find a better solution...

Comment 3

[Damon Sicore (:damons)]

Yes, blocking1.9+.  This is a regression from another blocking crash patch.  

Comment 4

[Brian Crowder]

Mats:  Does this want review yet?

Comment 5

[Mats Palmgren (inactive)]

Maybe Johnny have a better idea on how to fix it?

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 311815 [details] [diff] [review]
wallpaper

         if (aDelayedStop) {
+          if (strcmp(::GetMIMEType(inst), "video/quicktime") == 0) {
+            // XXX wallpaper bug 425157
+            inst->Stop();
+          }
           nsCOMPtr<nsIRunnable> evt = new nsStopPluginRunnable(aInstanceOwner);
           NS_DispatchToCurrentThread(evt);

Any real reason to dispatch the runnable here if we're already stopping the plugin? Seems like we might as well just stop this plugin early no matter what and don't even bother with the runnable etc. Or am I missing something here?

Comment 7

[Johnny Stenback (:jst)]

Mats, can you look at my previous comment?

Comment 9

[Johnny Stenback (:jst)]

Mats, ping.

Comment 10

[Carsten Book [:Tomcat]]

Note: as per Bug 427888 this crash affects also the TV-on-Demand Section of one the biggest German National TV Station. Every time i close Firefox with the TV-on-Demand Window i crash.

Comment 11

[Mats Palmgren (inactive)]

(In reply to comment #6)
> Any real reason to dispatch the runnable here if we're already stopping the
> plugin? Seems like we might as well just stop this plugin early no matter what
> and don't even bother with the runnable etc. Or am I missing something here?

I'm testing that, new patch in a bit if it works...

Comment 12

[Mats Palmgren (inactive)]

Attachment: v2

That seems to work just as well.   Tested on both MacOSX and Windows XP.
(None of the crashes occurs on XP in the first place, just verifying it
still works.)

Comment 13

[Brian Crowder]

This seems very similar to bug 426524, is it possible a similar issue occurs with Flip4Mac on non QuickTime movies?

Comment 14

[Mats Palmgren (inactive)]

Yeah, it seems so.  I'll post a wallpaper on that bug in a bit, with a
MozillaTry build for people to test (I only tested the URL in that bug briefly).

Comment 15

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 315367 [details] [diff] [review]
v2

a1.9=beltzner

Comment 16

[Mats Palmgren (inactive)]

mozilla/layout/generic/nsObjectFrame.cpp 	1.650 

-> FIXED

Comment 18

[Carsten Book [:Tomcat]]

verified fixed using  Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008050621 Firefox/3.0pre  - no crash on steps to reproduce.

--> Verified fixed