433880 - Crash when switching to full-screen during play (eg youtube) [@ 0x0 - NPSWF32.dll@0x10a61]

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P1)

Description

[Jim Jeffery not reading bug-mail 1/2/11]

Go to the URL and choose any video, when the video starts click the 'full-screen' mode button.  Crash! 

This does not happen in 3.0 RC1 builds, only in the moz-central 3.1a1pre builds.
Same in safe-mode and a new profile. 

Using the new Beta of FlashPlayer 10.0.218 crashes are captured: 
http://crash-stats.mozilla.com/report/index/39de30e3-2277-11dd-9470-001a4bd46e84
http://crash-stats.mozilla.com/report/index/e4303bb3-2277-11dd-8cb9-001a4bd46e84

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a1pre) Gecko/2008051502 Minefield/3.1a1pre Firefox/3.0 ID:2008051502

Comment 1

[Barrie North]

It's not just limited to YouTube, I've had it crashing using flash-based video players on other sites as well

http://crash-stats.mozilla.com/report/index/7d77139c-22cb-11dd-b077-001321b13766
http://crash-stats.mozilla.com/report/index/728181f0-2275-11dd-8e6f-001321b13766

Flash Player 9.0 r124 also produces the crash

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a1pre) Gecko/2008051502 Minefield/3.1a1pre ID:2008051502

Comment 2

[timeless]

Signature	@0x0
UUID	39de30e3-2277-11dd-9470-001a4bd46e84
Time	2008-05-15 05:04:42-07:00
Uptime	3841
Product	Firefox
Version	3.1a1pre
Build ID	2008051502
OS	Windows NT
OS Version	6.0.6001 Service Pack 1
CPU	x86
CPU Info	AuthenticAMD family 6 model 4 stepping 4
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
Comments	clicking a youtube vid to full screen - crashes
Crashing Thread
Frame 	Module 	Signature 	Source
0 		@0x0 	
1 	NPSWF32.dll 	NPSWF32.dll@0x10a61 	
2 	NPSWF32.dll 	NPSWF32.dll@0xd2040 	
3 	NPSWF32.dll 	NPSWF32.dll@0xc9541 	
4 	NPSWF32.dll 	NPSWF32.dll@0xc0530 	
5 	NPSWF32.dll 	NPSWF32.dll@0x8fc5a 	
6 	NPSWF32.dll 	NPSWF32.dll@0x92b02 	
7 		@0x80c3d57 	

Filename 	Version 	Debug Identifier 	Debug Filename
NPSWF32.dll 	10.0.1.218 	DB152AFE5A9E49C28C15A2E7AF217EB31 	NPSWF32.pdb

Comment 4

[gabe]

maybe its linked to bug 435334

Comment 7

[Biju]

regression range is before 2008.02.20

It crashes on
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:2.0a1pre) 
Gecko/2008022002 Minefield/4.0a1pre

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:2.0a1pre) 
Gecko/2008050602 Minefield/4.0a1pre

Comment 9

[Michelle Sintov]

From the Flash Player team: it appears this bug is Windows NT only, but the bug is set to Windows XP. Please let me know if this is not a Windows NT-only bug.

Comment 10

[Mike Ness]

Vista Ultimate SP1 is affected too.

Comment 11

[Michael Mak]

Windows XP and Vista are affected by this bug. Not sure about Windows 2000.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a1pre) Gecko/2008061012 Minefield/3.1a1pre ID:2008061012

Comment 12

[Teppo Nurminen]

Windows 2000 is affected also.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.1a1pre) Gecko/2008061107 Minefield/3.1a1pre ID:2008061107

Comment 13

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Mats, do you think you could have a looksee here?

Comment 14

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

It's a regression from disabling OJI.  It looks like Flash is "reusing" the
ns4xPlugin::CALLBACKS.getJavaEnv and .getJavaPeer slots for some internal
purpose?  I can see that when the plugin goes full-screen it calls each
function once.  With OJI enabled the slots are valid functions that would
return NULL when called.  When disabled the slots are NULL.

I don't see the harm in having the dummy functions that return NULL
by default, even if OJI is disabled.

Comment 15

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 325060 [details] [diff] [review]
Patch rev. 1

This sounds like jsts territory. Sounds good to me though. Possibly add a comment saying why we're doing this so that we can remove it in the future.

Comment 16

[Jim Jeffery not reading bug-mail 1/2/11]

(In reply to comment #14)
> Created an attachment (id=325060) [details]
> Patch rev. 1
> 
> It's a regression from disabling OJI.  It looks like Flash is "reusing" the
> ns4xPlugin::CALLBACKS.getJavaEnv and .getJavaPeer slots for some internal
> purpose?  I can see that when the plugin goes full-screen it calls each
> function once.  With OJI enabled the slots are valid functions that would
> return NULL when called.  When disabled the slots are NULL.
> 
> I don't see the harm in having the dummy functions that return NULL
> by default, even if OJI is disabled.
> 

Interesting, similar fix maybe for https://bugzilla.mozilla.org/show_bug.cgi?id=435334

Comment 18

[Johnny Stenback (:jst)]

Comment on attachment 325060 [details] [diff] [review]
Patch rev. 1

Yeah, that'll do it. I already have this fix in a tree here that gets rid of all the OJI garbage, but that's not ready to land yet, so this'll do until it does.

Comment 19

[Johnny Stenback (:jst)]

Fix committed to mozilla-central (to unblock myself).

Comment 20

[Michael Mak]

Has the fixed checked in? Youtube still crashes using the latest hourly. 

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a1pre) Gecko/2008061817 Minefield/3.1a1pre ID:2008061817

Comment 21

[Jim Jeffery not reading bug-mail 1/2/11]

WFM using
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a1pre) Gecko/2008061818 Minefield/3.1a1pre Firefox/3.0 ID:2008061818 

Vista HP SP1 

Comment 22

[Michael Mak]

WFM too now, the new build works :)

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a1pre) Gecko/2008061818 Minefield/3.1a1pre ID:2008061818

Comment 23

[Marcia Knous [:marcia]]

Adding verified1.9.1 since this is fine using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b3pre) Gecko/20090106 Shiretoko/3.1b3pre

Comment 24

[Grey Nicholson (they/them)]

I think I'm still seeing this on Linux: going to fullscreen in Flash crashes reproducibly. I'm using:

Ubuntu 8.10, Gnome 2.24.1, Linux 2.6.27-11-generic
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3pre) Gecko/20090116 Shiretoko/3.1b3pre
Flash 10,0,15,3

Example crashes:
http://crash-stats.mozilla.com/report/index/a3d1c632-8422-4dbd-9aff-3d5442090116
http://crash-stats.mozilla.com/report/index/49ba5be1-a3de-4607-aae0-a36d82090116

This also crash using latest-trunk, but not using Ubuntu's Firefox 3.0 package.

Comment 25

[hiscan99]

what happened while trying javascript,chek it.