624809 - reproducible flash crash with no report available

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Asa Dotzler [:asa]]

Flash, a scribd player, at http://techcrunch.com/2011/01/11/google-chrome-release-cycle-slideshow/ crashes for me consistently but there is no crash report available.

I'm testing with the first beta9 candidate build on windows 7 with Flash Version: 10.1.102.64

Comment 1

[Benjamin Smedberg]

What's the STR? I can't reproduce with 10.1.102.64 on Win7 64-bit (32-bit Firefox and Flash).

Comment 2

[Asa Dotzler [:asa]]

I visit the URL and the flash embed crashes. Every time.

Comment 3

[Benjamin Smedberg]

 	xul.dll!NS_DebugBreak_P(aSeverity=0x00000003, aStr=0x6e9090e0, aExpr=0x00000000, aFile=0x6e908d58, aLine=0x00000ae7)  Line 367	C++
>	xul.dll!mozilla::plugins::PluginInstanceChild::ShowPluginFrame()  Line 2791	C++
 	xul.dll!mozilla::plugins::PluginInstanceChild::InvalidateRectDelayed()  Line 2866	C++
 	xul.dll!MessageLoop::RunTask(task=0x00000000)  Line 344	C++
 	xul.dll!MessageLoop::DeferOrRunPendingTask(pending_task={...})  Line 354	C++
 	xul.dll!MessageLoop::DoWork()  Line 451	C++
 	xul.dll!base::MessagePumpForUI::DoRunLoop()  Line 213	C++
 	xul.dll!base::MessagePumpWin::RunWithDispatcher(delegate=0x00000000, dispatcher=0x0042f580)  Line 54	C++
 	xul.dll!base::MessagePumpWin::Run(delegate=0x0042fa28)  Line 78	C++
 	xul.dll!MessageLoop::RunInternal()  Line 220	C++
 	xul.dll!MessageLoop::RunHandler() 	C++
 	xul.dll!MessageLoop::Run()  Line 177	C++

mCurrentSurface is NULL

Comment 4

[George Carstoiu]

Build identifier: Mozilla/5.0 (Windows NT 6.1; rv:2.0b9) Gecko/20100101 Firefox/4.0b9

Issue present with the above build.

Comment 5

[Marcia Knous [:marcia]]

I just installed the latest Flash RC version from Adobe - http://labs.adobe.com/downloads/flashplayer10.html and hit this quite easily on youtube.com using the Beta 9 candidate on Mac. Almost every time I play a youtube video, pop it out using the player controls and close it I get this crash.

Comment 6

[Benjamin Smedberg]

Marcia, this crash is Windows painting code, and is almost certainly unrelated to any mac crashes.

Comment 7

[Benjamin Smedberg]

Via recording, this is another case of entering AsyncSetWindow while painting, roughly the same as bug 622985. This is happening because in PluginInstanceChild::PaintRectToPlatformSurface the call to UpdateWindowAttributes occurs while mPendingPluginCall is still `false`. I believe that we can fix this simply by setting mPendingPluginCall before doing anything else in PaintRectToPlatformSurface. Or even doing it directly in ShowPluginFrame.

 	xul.dll!nsRefPtr<gfxASurface>::assign_with_AddRef(rawPtr=0x00000000)  Line 941	C++
 	xul.dll!mozilla::plugins::PluginInstanceChild::DoAsyncSetWindow(aSurfaceType=SurfaceTypeWin32, aWindow={...}, aIsAsync=false)  Line 2237	C++
>	xul.dll!mozilla::plugins::PluginInstanceChild::RecvAsyncSetWindow(aSurfaceType=SurfaceTypeWin32, aWindow={...})  Line 2215	C++
 	xul.dll!mozilla::plugins::PPluginInstanceChild::OnMessageReceived(__msg={...})  Line 1280	C++
 	xul.dll!mozilla::plugins::PPluginModuleChild::OnMessageReceived(__msg={...})  Line 458	C++
 	xul.dll!mozilla::ipc::AsyncChannel::OnDispatchMessage(msg={...})  Line 262	C++
 	xul.dll!mozilla::ipc::RPCChannel::Call(msg=0x00802430, reply=0x0019ee10)  Line 246	C++
 	xul.dll!mozilla::plugins::PPluginScriptableObjectChild::CallNPN_Evaluate(aScript={...}, aResult=0x0019ee64, aSuccess=0x0019ee4f)  Line 124	C++
 	xul.dll!mozilla::plugins::PluginScriptableObjectChild::Evaluate(aScript=0x0019eec4, aResult=0x0019eeb4)  Line 1093	C++
 	xul.dll!mozilla::plugins::child::_evaluate(aNPP=0x0081b72c, aObject=0x00816510, aScript=0x0019eec4, aResult=0x0019eeb4)  Line 1281	C++
 	< "NPSWF32.dll" not found on host >!6a66f2c6() 	

 	< "NPSWF32.dll" not found on host >!6a66cb0f() 	
 	USER32.dll!_DispatchClientMessage@20() 	
 	xul.dll!mozilla::plugins::PluginInstanceChild::UpdateWindowAttributes(aForceSetWindow=false)  Line 2530	C++
 	xul.dll!mozilla::plugins::PluginInstanceChild::PaintRectToPlatformSurface(aRect={...}, aSurface=0x0019f7f8)  Line 2617	C++
 	xul.dll!mozilla::plugins::PluginInstanceChild::PaintRectToSurface(aRect={...}, aSurface=0x0081f470, aColor={...})  Line 2675	C++
 	xul.dll!mozilla::plugins::PluginInstanceChild::ShowPluginFrame()  Line 2767	C++
 	xul.dll!mozilla::plugins::PluginInstanceChild::InvalidateRectDelayed()  Line 2866	C++

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Sounds good.

Comment 9

[Benjamin Smedberg]

Attachment: Move the pending-call flag up the stack, rev. 1

Comment 10

[Benjamin Smedberg]

http://hg.mozilla.org/mozilla-central/rev/69c72fec790d

Comment 11

[juan becerra [:juanb]]

Verified with Mozilla/5.0 (Windows NT 6.1; rv:2.0b10) Gecko/20100101 Firefox/4.0b10 (build1). Using beta 9 and loading the page the embedded Flash would crash consistently, but on beta 10 the page including this Flash slideshow load without a problem.