487938 - Crash on javascript animation hiding/displaying ontop of Flash objects [@ NPSWF32.dll]

Status: VERIFIED FIXED

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[Phil Hartmann]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8

It appears that some timing issues exists in Flash / Firefox combinations, this crashes on Linux/Windows, have tested on multiple PCs.

Reproducible: Always

Steps to Reproduce:
1. See page.
2.
3.
Actual Results:  
https://bugzilla.mozilla.org/show_bug.cgi?id=486809report/index/19c59526-0db2-43f1-a89a-860b32090411

Expected Results:  
Animated

Comment 1

[Phil Hartmann]

Note, this seemingly effects all versions of firefox, from 2.0 up to the latest trunk.

Comment 2

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090411 Shiretoko/3.5b4pre ID:20090411045655

I see this too

http://crash-stats.mozilla.com/report/index/802ff0d6-31cb-4f3b-9ebf-cc0592090411?p=1

0  	NPSWF32.dll  	NPSWF32.dll@0x13131a  	
1 	NPSWF32.dll 	NPSWF32.dll@0x1323f2 	
2 	xul.dll 	CallNPMethodInternal 	modules/plugin/base/src/nsJSNPRuntime.cpp:1385
3 	xul.dll 	CallNPMethod 	modules/plugin/base/src/nsJSNPRuntime.cpp:1432
4 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1341
5 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:5035
6 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1590
7 	js3250.dll 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5109
8 	xul.dll 	nsJSContext::EvaluateStringWithValue 	dom/src/base/nsJSEnvironment.cpp:1438
9 	xul.dll 	_evaluate 	modules/plugin/base/src/nsNPAPIPlugin.cpp:1687
10 	NPSWF32.dll 	NPSWF32.dll@0x134ad5 	
11 	NPSWF32.dll 	NPSWF32.dll@0x3585e 	
12 		@0xd9b1e9d 	
13 		@0x79294aa 	
14 	NPSWF32.dll 	NPSWF32.dll@0x20a8db 	
15 	NPSWF32.dll 	NPSWF32.dll@0x20a8db 	
16 	NPSWF32.dll 	NPSWF32.dll@0x1e1715 	
17 	NPSWF32.dll 	NPSWF32.dll@0x17afc4 	
18 	NPSWF32.dll 	NPSWF32.dll@0x17a629 	
19 	NPSWF32.dll 	NPSWF32.dll@0x17a939 	
20 	NPSWF32.dll 	NPSWF32.dll@0x17a9ca 	
21 	NPSWF32.dll 	NPSWF32.dll@0xd3779 	
22 	NPSWF32.dll 	NPSWF32.dll@0x137f5e 	
23 		@0x7a53bb 	

Looks like a crash in Flash. Confirming this crasher.

Comment 3

[Phil Hartmann]

Attachment: Set of files to reproduce

Comment 4

[Ron Jammer]

This is extremely annoying and causing me quite a bit of grief.  My work around is to quick hide the flash stuff while animating and then redisplay it once it's done.  However this causes artifacts and isn't being 100% affective.  Anyone gonna take this on or what?

Comment 5

[Phil Hartmann]

This appears to be manifesting itself in a new fashion. The problem seems to now crop up in both Flash's DLL's but also Firefox's JS dll, see following crash reports.

http://crash-stats.mozilla.com/report/index/adf77163-6810-4209-a8c0-acb4f2090614
http://crash-stats.mozilla.com/report/index/0614ac00-0184-425b-b85c-3fdfd2090614

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

I don't think we'll be blocking the release of Firefox 3.5 on this as per comment 1, though I sympathize with how grieving it is. Hopefully we'll be able to get to it soon.

Rob: should this be in the JS component?

Comment 7

[Charles]

Anyone reproduce this on Mac and have some sample code. I am not sure its a player issue but I would like to help get to the bottom of this if it is.

Comment 8

[Phil Hartmann]

(In reply to comment #7)
> Anyone reproduce this on Mac and have some sample code. I am not sure its a
> player issue but I would like to help get to the bottom of this if it is.

I've not seen/heard anyone being able to reproduce this on a Mac. I know personally I've tried and failed to reproduce it in Opera/Chrome/Safari/IE 6,7,8.

Comment 9

[Aaron Train [:aaronmt]]

An update: re new flash update (07/09)

Alongside the flash update to 10,0,32,18 and the aforementioned URL, I get an immediate crash on 1.9.1.2 on XP. 

Attempted a trial run on trunk but could not yield a crash. 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090804 Minefield/3.6a1pre (.NET CLR 3.5.30729) 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)

Comment 10

[Aaron Train [:aaronmt]]

http://crash-stats.mozilla.com/report/index/13100a4c-8345-4bd2-ab01-d6d272090804

Comment 11

[timeless]

Signature	NPSWF32.dll@0x13131a
UUID	13100a4c-8345-4bd2-ab01-d6d272090804
Time 	2009-08-04 13:54:57.74464
Uptime	686
Product	Firefox
Version	3.5.2
Build ID	20090729225027
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 14 stepping 8
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
User Comments	
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	NPSWF32.dll 	NPSWF32.dll@0x13131a 	
1 	NPSWF32.dll 	NPSWF32.dll@0x1323f2 	
2 	xul.dll 	CallNPMethodInternal 	modules/plugin/base/src/nsJSNPRuntime.cpp:1385
3 	xul.dll 	CallNPMethod 	modules/plugin/base/src/nsJSNPRuntime.cpp:1432
4 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1386
5 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:5179
6 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1622
7 	js3250.dll 	JS_EvaluateUCScriptForPrincipals 	js/src/jsapi.cpp:5145
8 	xul.dll 	nsJSContext::EvaluateStringWithValue 	dom/src/base/nsJSEnvironment.cpp:1458
9 	xul.dll 	_evaluate 	modules/plugin/base/src/nsNPAPIPlugin.cpp:1690
10 	NPSWF32.dll 	NPSWF32.dll@0x134ad5 	
11 	NPSWF32.dll 	NPSWF32.dll@0x3585e 	
12 		@0x7601e9d 	
13 		@0x4bc94aa 	
14 	NPSWF32.dll 	NPSWF32.dll@0x20a8db 	
15 	NPSWF32.dll 	NPSWF32.dll@0x20a8db 	
16 	NPSWF32.dll 	NPSWF32.dll@0x1e1715 	
17 	NPSWF32.dll 	NPSWF32.dll@0x17afc4 	
18 	NPSWF32.dll 	NPSWF32.dll@0x17a629 	
19 	NPSWF32.dll 	NPSWF32.dll@0x17a939 	
20 	NPSWF32.dll 	NPSWF32.dll@0x17a9ca 	
21 	NPSWF32.dll 	NPSWF32.dll@0xd3779 	
22 	NPSWF32.dll 	NPSWF32.dll@0x137f5e 	
23 		@0x98fa3f 	

Filename 	Version 	Debug Identifier 	Debug Filename
NPSWF32.dll 	10.0.22.87 	3BB359BF2B484134883563A2C8D4860C1 	NPSWF32.pdb

This isn't the latest version of flash.... can you provide an incident for 10.0.32....?

Comment 12

[Phil Hartmann]

Firefox 3.5.2, Flash 10.0.32.18 (@NPSWF32.dll@0x144dae)
http://crash-stats.mozilla.com/report/index/6f8799fe-24af-4977-8a71-d7f282090805

Firefox  3.6a1pre, Flash 10.0.32.18 (@ntdll.dll@0x3a7a1)
http://crash-stats.mozilla.com/report/index/351bc7ef-795a-4d33-92c4-2473a2090805

Second attempt and crashing the trunk was harder, but still able to crash, this time not in NTDLL but flash again. 

Firefox  3.6a1pre, Flash 10.0.32.18 (@NPSWF32.dll@0x144dae)
http://crash-stats.mozilla.com/report/index/57ae9d7b-8f7a-474f-bb56-a5d382090805

Third attempt at trunk, much easier, clicked crash, opened dialog, closed and first time again

Firefox  3.6a1pre, Flash 10.0.32.18 (@NPSWF32.dll@0x144dae)
http://crash-stats.mozilla.com/report/index/f2da8d06-6df8-43d5-8d2f-b786c2090805

Comment 13

[Charles]

I can reproduce this in 3.0.x but it does not look like the crash you are seeing 
http://crash-stats.mozilla.com/report/index/0de66d9a-f4f2-4f26-a308-817942090928

When go and test on 3.5.3 it seems to point a little more towards the player.
http://crash-stats.mozilla.com/report/index/25fb3fb1-5756-4a18-b718-82bf12090928?p=1

Comment 14

[Charles]

(In reply to comment #4)
> This is extremely annoying and causing me quite a bit of grief.  My work around
> is to quick hide the flash stuff while animating and then redisplay it once
> it's done.  However this causes artifacts and isn't being 100% affective. 
> Anyone gonna take this on or what?

Ron/others,

What is a real world example of this bug?  I am looking to make a case for this some what edge case test case we are using to reproduce the bug.  Its not a easy bug to explain and it would help me greatly to have a real world example.  Thanks

Comment 15

[Phil Hartmann]

I discovered this bug while working on http://yunno.com when on a competition and competing there is a form that gets slid in, inside of the form is a Flash control for uploading a file. Because of the JS animation on top of a flash control, firefox will crash now and again, now currently yunno.com has several workarounds trying to prevent the crash, but it is not a 100% workaround.

There is another internal site where there was a drag & drop control with a file upload button on it, we had to disable Firefox as a browser because it was difficult at best to get this to be stable.

I've also seen the bug with a .blockUI on a page with sIFR controls.


I've seen other sites on the web crash with this bug, I know the 'reproduction' example is convoluted, but it seems to be a timing issue that with a small amount of code just disappears. I know you'd never hide/show something thousands of times back to back... But in the real world, it only takes a single show (now and again) and firefox will crash instantly.

Comment 16

[Charles]

Thank you. I have added that new information to our internal but.

Comment 17

[timeless]

s/but/bug/ ;-)

Comment 18

[Charles]

Fixed in our recent beta release of Flash Player 10.1. Download it now:

http://labs.adobe.com/downloads/flashplayer10.html

Comment 19

[Charles]

Okay to close this as fixed or worksforme?

Comment 20

[timeless]

I'd like to actually switch to a model where we have a Plugins product and actually give each plugin its own component and a list of target milestones for plugins and then actually allow you guys to resolve bugs as fixed.

That'd be a lot cleaner and would be a better fit with our model.

Today 'worksforme' is slightly more appropriate because the fix isn't in Gecko's Plugin code.

Note that if we did this, I'd move previously existing bugs into it, and we could change bugs from worksforme to fixed (and if possible select reasonable target milestones).

For now, it'd be great if you could specify a precise plugin version instead of 'the latest beta'.

Comment 21

[chris hofmann]

yeah, we are tracking just over 50 plugins that crash or cause problems with firefox these days. so setting up a separate component or set of components to do better tracking of this information would be a good idea and a benefit for all firefox users.

Comment 22

[timeless]

filed bug 557770. it's been on my todo list for about 8 years i think. it should be done by Sunday :).

Comment 23

[Phil Hartmann]

Uhmm,

Well I can confirm it isn't crashing, but now Firefox is hanging with 0% CPU usage, and hasn't come back (reproduced it 3 times in a row, and let it sit for an hour to see if it'd ever time out.. nope)

Firefox 3.6.3
Flash: WIN 10,1,51,95

Comment 24

[Mike Shaver (:shaver emeritus)]

Please file another bug for that (and please try with a non-beta Flash to see if that helps) -- thank you!

Comment 25

[timeless]

Charles: you guys now have a component of your own, please feel free to mark bugs here as 'fixed' when you fix bugs.

For now, if you could indicate a version number where you've fixed the bug in the status whiteboard (as I have here), that'd be helpful.

I'll at some point file a bug and add target milestones based on the plugin versions here.

Note that you can now easily watch for bugs in this component (or any other plugins component), by adding the QA contact listed in:
https://bugzilla.mozilla.org/describecomponents.cgi?product=Plugins 
to your mail watching preferences:
https://bugzilla.mozilla.org/userprefs.cgi?tab=email#new_watched_by_you

for record keeping, I'm marking 'FIXED' per comment 18 and 'VERIFIED' per comment 23.

Comment 26

[Charles]

Thanks I think this will make this a little easier