Closed Bug 560549 Opened 14 years ago Closed 12 years ago

[meta] Plugin hang in [@ hang | NtUserPeekMessage ]

Categories

(Core Graveyard :: Plug-ins, defect)

x86
Windows XP
defect
Not set
critical

Tracking

(blocking1.9.2 -, status1.9.2 wanted)

RESOLVED INCOMPLETE
Tracking Status
blocking1.9.2 --- -
status1.9.2 --- wanted

People

(Reporter: chofmann, Unassigned)

References

Details

(Keywords: hang, meta, topcrash)

Crash Data

The #4 (non-flash) topcrash (#21 overall) could be a volume increase regression.

 NtUserMessageCall 20100418-crashdata.csv
found in: 3.6.4 3.7a5pre 3.6.3plugin1 3.6.3 3.0.19
           release total-crashes
                      NtUserMessageCall crashes
                               pct.

all             344082  24      6.97508e-05
3.6.4           9248    18      0.00194637
3.7a5pre        1339    2       0.00149365
3.6.3plugin1    1212    2       0.00165017
3.6.3           236202  1       4.23366e-06
3.0.19          10062   1       9.93838e-

http://crash-stats.mozilla.com/report/index/1e028398-d6cf-4de4-8c40-b8ed52100420

Frame  	Module  	Signature [Expand]  	Source
0 	user32.dll 	NtUserMessageCall 	
1 	user32.dll 	NtUserMessageCall 	
2 	user32.dll 	RealDefWindowProcA 	
3 	uxtheme.dll 	_ThemeDefWindowProc 	
4 	uxtheme.dll 	ThemeDefWindowProcA 	
5 	user32.dll 	DefWindowProcA 	
6 	user32.dll 	InternalCallWinProc 	
7 	user32.dll 	UserCallWinProcCheckWow 	
8 	user32.dll 	RegisterIMEClass 	
9 	user32.dll 	RealDefWindowProcA 	
10 	user32.dll 	DefWindowProcA 	
11 	user32.dll 	InternalCallWinProc 	
12 	user32.dll 	UserCallWinProcCheckWow 	
13 	user32.dll 	DispatchMessageWorker 	
14 	user32.dll 	DispatchMessageW 	
15 	xul.dll 	base::MessagePumpForUI::ProcessMessageHelper 	ipc/chromium/src/base/message_pump_win.cc:361
16 	xul.dll 	base::MessagePumpForUI::ProcessNextWindowsMessage 	ipc/chromium/src/base/message_pump_win.cc:336
17 	xul.dll 	base::MessagePumpForUI::DoRunLoop 	ipc/chromium/src/base/message_pump_win.cc:205
18 	xul.dll 	base::MessagePumpWin::RunWithDispatcher 	ipc/chromium/src/base/message_pump_win.cc:52
19 	xul.dll 	base::MessagePumpWin::Run 	ipc/chromium/src/base/message_pump_win.h:78
20 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:216
21 	xul.dll 	MessageLoop::RunHandler 	
22 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
23 	xul.dll 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:165
24 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:26
25 	kernel32.dll 	BaseThreadInitThunk 	
26 	ntdll.dll 	__RtlUserThreadStart 	
27 	ntdll.dll 	_RtlUserThreadStart

more reports at
http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=NtUserMessageCall&version=Firefox%3A3.6.4

only 1/3 are inside 3 minutes of startup so far.

only one testing URL so far
  23 NtUserMessageCall \N
   1 http://www.rtl.de/cms/unterhaltung/superstar.html
blocking1.9.2: --- → ?
Summary: Crash [@ NtUserMessageCall ] → Possible IPC Crash in [@ NtUserMessageCall ]
Most of these are hang reports. If you do see a URL, it's from a non-hang report and it's a totally different cause.
Component: IPC → Plug-ins
QA Contact: ipc → plugins
Wanted, not blocking for now. Once we can link this definitively to something, please renominate.
blocking1.9.2: ? → -
all the NtUserMessageCall crashes with url's for April to-date.  volume is low.  mostly porn sites.

NtUserMessageCall http://www.dasandyman.com/bangpass/hj4888/17.jpg \N http://crash-stats.mozilla.com/report/index/5e00e557-205d-4fa1-a363-d9c222100404

NtUserMessageCall http://us.mc319.mail.yahoo.com/mc/welcome?.... \N 
http://crash-stats.mozilla.com/report/index/c6ad47fa-df04-45c5-99c4-9658c2100404

NtUserMessageCall http://www.fff.fr/competitions/php/coupe/coupe_resultat.php?cp_no=186902&ph_no=1&gp_no=1&sa_no=2009 \N 
http://crash-stats.mozilla.com/report/index/eb4e3549-a069-479c-87ae-868522100405

NtUserMessageCall http://www.youtube.com/watch?v=ip-aLBI3rb4 \N http://crash-stats.mozilla.com/report/index/70dd3173-59e1-44eb-b5db-982862100405

NtUserMessageCall http://hammarbyultras.do-goo.com/login.forum?logout=true&sid=.. \N 
http://crash-stats.mozilla.com/report/index/cf09a68f-cdba-4058-9326-e600b2100405

NtUserMessageCall http://www.bet365.com/home/?lng=5 \N 
http://crash-stats.mozilla.com/report/index/2aa71560-c617-4e6e-b0ce-9b7ac2100413

NtUserMessageCall http://www.bet365.com/home/?lng=5 \N 
http://crash-stats.mozilla.com/report/index/6bda9994-3946-453c-8058-f853f2100413

NtUserMessageCall [removed] \N 
http://crash-stats.mozilla.com/report/index/2fc76e72-cdd8-47bd-b124-5f68e2100413

NtUserMessageCall 
http://www.amazon.com/Reebok-Mens-Answer-DMX-Mid/dp/B000BI3ZYY \N 
http://crash-stats.mozilla.com/report/index/7b1672a6-9f3f-4708-960f-4e6362100413

NtUserMessageCall about:blank \N http://crash-stats.mozilla.com/report/index/0f0f28cb-0b78-4491-863c-61f982100415

NtUserMessageCall http://www.girlsgogames.fr/jeu/Pet_Grooming_Studio.html \N http://crash-stats.mozilla.com/report/index/828a6a66-d2d5-46c6-8ed1-2552e2100416

NtUserMessageCall [url removed] \N 
http://crash-stats.mozilla.com/report/index/b256c64e-2179-4c13-9be4-d5dbc2100418

NtUserMessageCall http://www.rtl.de/cms/unterhaltung/superstar.html \N http://crash-stats.mozilla.com/report/index/28ce7ba4-09fc-4797-b0af-26ec32100418
The signatures with crash reason "Exception Brakepoint" seem to be the same thing

non   count  sig
flash
crash
rank

6     86    NtUserPeekMessage  
24    25    NtUserSetFocus   
26    25    NtUserMessageCall  

I guess we should spin the low volume "real crash in comment 3 off into another bug.
Summary: Possible IPC Crash in [@ NtUserMessageCall ] → Possible IPC Crash in [@ NtUserMessageCall ] [@ NtUserPeekMessage ] [@ NtUserSetFocus ] [@ NtUserMessageCall ]
NtUserMessageCall is now under bug 618683. This one can serve as a general grab bag bug for hang | NtUserPeekMessage hangs.
Summary: Possible IPC Crash in [@ NtUserMessageCall ] [@ NtUserPeekMessage ] [@ NtUserSetFocus ] [@ NtUserMessageCall ] → Plugin hang in [@ hang | NtUserPeekMessage ]
I can reproduce this (or a similar crash) rather easily:
1) Go to http://www.mtv3.fi/viihde/
2) Press play on the video there (should be DRM protected Silverlight video)
3) Press "Don't enable" when Silverlight prompts to enable DRM
=> Watch Silverlight hang and after a while you see that instead of the video with the option to send the crash report.

These have happened to me:
bp-b571062c-c293-4646-9201-9b01a2111209
bp-e07dc923-10bb-4791-997f-b430c2111209
bp-bfe91346-4435-4cc7-a548-97a9a2111203
bp-26c8d210-08cf-4ac3-8736-fe5682111203

Probably happens with any Silverlight video if you have not enabled automatic DRM (or whatever prompt enables) in Silverlight.
Severity: normal → critical
Keywords: crash, hang, topcrash
So this crash paired with the browser side signature - hang | mozilla::plugins::PPluginInstanceParent::CallNPP_SetWindow(mozilla::plugins::NPRemoteWindow const&) in bug 665394 is the top hang pair on FF9. It's also the top pair combination we get on FF 8.0.
It's #11 top crasher in 9.0.1.

There are STR in bug 716824 comment 0.

Now the stack looks like (slightly different from comment 0):
Frame 	Module 	Signature [Expand] 	Source
0 	user32.dll 	NtUserPeekMessage 	
1 	user32.dll 	NtUserPeekMessage 	
2 	user32.dll 	_PeekMessage 	
3 	user32.dll 	NtUserPeekMessage 	
4 	xul.dll 	base::MessagePumpForUI::ProcessNextWindowsMessage 	ipc/chromium/src/base/message_pump_win.cc:340
5 	xul.dll 	base::MessagePumpForUI::DoRunLoop 	ipc/chromium/src/base/message_pump_win.cc:210
6 	xul.dll 	base::MessagePumpWin::RunWithDispatcher 	ipc/chromium/src/base/message_pump_win.cc:53
7 	xul.dll 	base::MessagePumpWin::Run 	ipc/chromium/src/base/message_pump_win.h:78
8 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:208
9 	xul.dll 	MessageLoop::RunHandler 	
10 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
11 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:516
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=hang+|+NtUserPeekMessage
Crash Signature: [@ hang | NtUserPeekMessage]
Keywords: reproducible
Depends on: 720655
I filed bug 724389 for the plugin hang.
Keywords: reproducible
Depends on: 724389
Keywords: crashmeta
Summary: Plugin hang in [@ hang | NtUserPeekMessage ] → [meta] Plugin hang in [@ hang | NtUserPeekMessage ]
I got this hang twice now after doing basically the same thing:
1) Opened ca. 10-15 YouTube videos (to watch later)
   this will bring plugin-container's memory usage to
   working set: 300MB virtual size: 700MB
2) left the computer; I have the option "On resume, display Welcome Screen" 
   activated, so when I come back to my PC I'm asked to enter my password.
3) I login again and notice Firefox hangs; After a few seconds Firefox reacts
   again and I get the plugin crashed message.

bp-b58a5121-2c5c-4290-9b3c-bb9272120211
bp-2c428dc9-bd25-44ba-8234-b8ec72120211
(In reply to Andreas Jung from comment #13)
> I got this hang twice now after doing basically the same thing:
> 1) Opened ca. 10-15 YouTube videos (to watch later)
>    this will bring plugin-container's memory usage to
>    working set: 300MB virtual size: 700MB
> 2) left the computer; I have the option "On resume, display Welcome Screen" 
>    activated, so when I come back to my PC I'm asked to enter my password.
> 3) I login again and notice Firefox hangs; After a few seconds Firefox reacts
>    again and I get the plugin crashed message.
> 
> bp-b58a5121-2c5c-4290-9b3c-bb9272120211
> bp-2c428dc9-bd25-44ba-8234-b8ec72120211

Andreas, since this is a general bug related to hangs in NtUserPeekMessage, would you mind filing a new bug on the welcome screen problem with your steps to reproduce? Please cc me on it as well (:jimm).
Depends on: 726425
(In reply to Jim Mathies [:jimm] from comment #14)
> Andreas, since this is a general bug related to hangs in NtUserPeekMessage,
> would you mind filing a new bug on the welcome screen problem with your
> steps to reproduce? Please cc me on it as well (:jimm).

filed bug 726425
NtUserPeekMessage is now in the skip list.
I close it as incomplete.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → INCOMPLETE
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.