547247 - [OOPP] Crash [@ RtlEnterCriticalSection ] when ending mozilla-runtime on a page that does not contain a plugin

Status: VERIFIED FIXED

(Core :: IPC, defect)

Description

[IU]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a2pre) Gecko/20100219 BetterPrivacy-1.47 Minefield/3.7a2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a2pre) Gecko/20100219 BetterPrivacy-1.47 Minefield/3.7a2pre ID:20100219043233

If mozilla-runtime.exe is killed in succession, when on the last.fm/listen page, the browser crashes with the signature [@ RtlEnterCriticalSection ]:

http://crash-stats.mozilla.com/report/index/a1379f65-4808-4c65-8483-4b3452100219

0  	ntdll.dll  	RtlEnterCriticalSection  	
1 	nspr4.dll 	PR_Lock 	nsprpub/pr/src/threads/combined/prulock.c:233
2 	xul.dll 	mozilla::MutexAutoLock::MutexAutoLock 	obj-firefox/dist/include/mozilla/Mutex.h:180
3 	xul.dll 	mozilla::ipc::RPCChannel::OnChannelError 	ipc/glue/RPCChannel.cpp:622
4 	xul.dll 	IPC::Channel::ChannelImpl::OnIOCompleted 	ipc/chromium/src/chrome/common/ipc_channel_win.cc:410
5 	xul.dll 	base::MessagePumpForIO::WaitForIOCompletion 	
6 	xul.dll 	base::MessagePumpForIO::WaitForWork 	ipc/chromium/src/base/message_pump_win.cc:484
7 	xul.dll 	base::MessagePumpForIO::DoRunLoop 	ipc/chromium/src/base/message_pump_win.cc:469
8 	xul.dll 	base::MessagePumpWin::RunWithDispatcher 	ipc/chromium/src/base/message_pump_win.cc:52
9 	xul.dll 	base::MessagePumpWin::Run 	ipc/chromium/src/base/message_pump_win.h:78
10 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:216
11 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
12 	kernel32.dll 	LoadResource 	
13 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
14 	xul.dll 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:165
15 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:26
16 	kernel32.dll 	BaseThreadStart


Reproducible: Always

Steps to Reproduce:
1. Go to: http://www.last.fm/videos
2. Wait for the page to completely load, and do not click anything on the page
3. Click the "Radio" link on the red bar at the top of that page (such that it loads in the very same tab).
4. Kill mozilla-runtime.exe
5. Click the "Video" link on the red bar at the top of that page (such that it loads in the very same tab).  Wait for the page to finish loading. 
6. Again, Click the "Radio" link on the red bar at the top of that page (such that it loads in the very same tab).  
7. Kill mozilla-runtime.exe
8. Browser crashes with indicated signature.

Comment 1

[IU]

Attachment: WinDBG log

Comment 2

[Benjamin Smedberg]

I can't reproduce using today's nightly... not going to block unless it becomes a topcrasher.

Comment 3

[IU]

What OS are you trying to reproduce on?  I reproduce this on Windows XP.

Comment 4

[Maini Marco]

I have tried three times to reproduce it on Windows 7 with Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a2pre) Gecko/20100219 Minefield/3.7a2pre (.NET CLR 3.5.30729).
Only the first time I have reproduced the crash, with this stacktrace:
http://crash-stats.mozilla.com/report/index/bp-03d5e5e7-f7a8-46d1-a9bd-c7cb32100219

Comment 5

[Maini Marco]

Clicking on "Radio" in the bar, it's shown a page without Flash plugin. But if you click before on "Videos" that contain a Flash video and then on "Radio", mozilla-runtime process continues to running. I think it should be terminated in some way. Could be involved with this issue?

Comment 6

[IU]

It happens only when killing mozilla-runtime.exe with the tab loaded with a page that does not contain a plugin.

Here is a more easily reproducible STR:

1. Create and start with a new profile
2. Visit http://www.youtube.com
3. Check Windows Task Manager to ensure there is absolutely no instance of mozilla-runtime.exe
4. Click one of the videos listed on that youtube front page
5. Once the video starts playing, click the Firefox back button
6. Wait for the page to load.
7. Kill mozilla-runtime.exe

Comment 7

[IU]

If you still can't reproduce, change Step 5 as follows:

5. Once the video starts playing, click the Firefox Home button

The key is to make sure the page does not cause loading a plugin.  There is a chance that the youtube.com main page may contain a flash ad.

Comment 8

[Benjamin Smedberg]

Code inspection says there is a problem here, yeah. For me, the last.fm/radio page has a plugin on it.

Comment 9

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch

Comment 10

[Benjamin Smedberg]

Comment on attachment 427823 [details] [diff] [review]
Patch

r=me if you put the mChannelState check/set inside the lock

Comment 11

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, fixed

Fixed patch. Oops.

Comment 12

[Ben Turner (not reading bugmail, use the needinfo flag!)]

http://hg.mozilla.org/mozilla-central/rev/094b09304969

and the bustage fix:

http://hg.mozilla.org/mozilla-central/rev/23e78dba9f94

Comment 13

[IU]

Verified Fixed.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a2pre) Gecko/20100219 Minefield/3.7a2pre
http://hg.mozilla.org/mozilla-central/rev/23e78dba9f94

Thanks for the super quick fix. :-)