634534 - Firefox 4 crash Silverlight video [@ mozalloc_abort(char const* const) | mozcrt19.dll@0x1327f | mozilla::plugins::PluginModuleParent::StreamCast(_NPP*, _NPStream*) ][@ mozalloc_abort(char const* const) | NS_DebugBreak_P ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Carlos Roberto]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b12pre) Gecko/20110215 Firefox/4.0b12pre
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b12pre) Gecko/20110215 Firefox/4.0b12pre

This bug is strange and need some patience to reproduce, tried with other browsers such as Opera and Chrome, but I could not reproduce.

It is also reproducible in safe-mode using Silverlight Version: 4.0.51204.0 and 4.0.60129.0

Reproducible: Always

Steps to Reproduce:
1. Open http://www.silverlight.net/learn/videos/all/access-web-camera-microphone/ and click on play.
2. While video is buffering move time bar forward, example 2:30 and click on pause and play very fast.
3. While video is buffering move time bar backward, example 00:15 and click on pause and play very fast.
4. Repeat step 2 and 3 continuously fast until Firefox crash.

bp-5ab3d656-b956-4bed-80fe-744d92110215

Comment 1

[juan becerra [:juanb]]

I can confirm the issue on Mac 10.6.6 and Silverlight 4.0.60129.0. The whole browser crashed.

Comment 2

[juan becerra [:juanb]]

bp-46357f6e-cd56-4fec-bc1d-4ceb62110216

Comment 3

[Benjamin Smedberg]

(gdb) p *sp
$2 = {
  <mozilla::plugins::PBrowserStreamParent> = {
    <mozilla::ipc::RPCChannel::RPCListener> = {
      <mozilla::ipc::SyncChannel::SyncListener> = {
        <mozilla::ipc::AsyncChannel::AsyncListener> = {
          <> = {<No data fields>}, 
          members of mozilla::ipc::AsyncChannel::AsyncListener: 
          _vptr$AsyncListener = 0x1b9a494d
        }, <No data fields>}, <No data fields>}, 
    <mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>> = {
      _vptr$IProtocolManager = 0x1f7976e3
    }, 
    members of mozilla::plugins::PBrowserStreamParent: 
    mChannel = 0x5000003, 
    mId = 69859783, 
    mManager = 0x0, 
    mState = 1141932032
  }, 
  <mozilla::plugins::AStream> = {
    _vptr$AStream = 0x43eb8000
  }, 
  members of mozilla::plugins::BrowserStreamParent: 
  mNPP = 0x0, 
  mStream = 0x1, 
  mState = mozilla::plugins::BrowserStreamParent::DYING
}

DYING is quite suspicious, but this really looks like a garbage pointer of some sort: mNPP is *never* null in this code.

Comment 4

[Patrick Walton (:pcwalton)]

Seems to have regressed sometime in the last 6 months.

Comment 5

[Benjamin Smedberg]

Attachment: printf log of the crash

printfs show the plugin host definitely calling NPP_WriteReady on a stream where NPP_Destroy was called a long time ago. This log clearly shows us calling NPP_DestroyStream for stream 0x50a4fa0 and then calling NPP_WriteReady on it later. I'm still investigating whether intervening calls from the plugin are causing the plugin host to do bad stuff, although nothing obvious is jumping out from the IPC log.

Comment 6

[Patrick Walton (:pcwalton)]

Having trouble reproducing this; never mind comment #4.

Comment 7

[Benjamin Smedberg]

A new log shows that the nsNPAPIPluginStreamListener is receiving:

OnStartBinding(this=0x1f894560, stream=0x1f894584)
BrowserStreamParent(this=0x208ee860, mNPP=0x1eedeb70, stream=0x1f894584)
OnDataAvailable(this=0x1f894560, stream=0x1f894584)
OnStopBinding(this=0x1f894560, stream=0x1f894584)
CleanUpStream(this=0x1f894560, reason=1, stream=0x1f894584, mStreamCleanedUp=0)
~BrowserStreamParent(this=0x208ee860, stream=0x1f894584)
OnDataAvailable(this=0x1f894560, stream=0x1f894584)

So it's receiving OnDataAvailable after OnStopBinding...

Comment 8

[Benjamin Smedberg]

Attachment: Debug printf patch

Comment 9

[Benjamin Smedberg]

Attachment: Cache all pending requests, rev. 1

The only thing I'm really worried about here is perhaps introducing some sort of cycle between nsPluginStreamListenerPeer and the channel objects. But AFAICT that would have already existed.

Comment 10

[Benjamin Smedberg]

Attachment: Mochitest

Turns out this is not hard to reproduce with the testplugin, once we figured out what was happening.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 513253 [details] [diff] [review]
Cache all pending requests, rev. 1

>+    // Copy the array to avoid modification during the loop.

Cancel() should be fully async, but I guess it's better to not rely on that for extension-implemented stuff.

If you really wanted to, you could use nsTObserverArray here to handle (some) modifications.  The other thing we could do if we care about making this fast is use nsTArray<nsCOMPtr<nsIRequest> > and swap.  But it likely doesn't matter; I doubt we have many requests here.

The asserts in nsPluginStreamListenerPeer::OnStartRequest/OnDataAvailable/OnStopRequest don't look right.  In particular, in the cases when we go through nsPluginByteRangeStreamListener it will instantiate a multipart decode, which will deliver a start+stop for each part to the nsPluginStreamListenerPeer, passing synthetic requests it makes up for each part.  We could change the asserts to skip these synthetic requests (which we can detect by QIing to nsIMultiPartChannel) or assert about their underlying channel instead.  We could also do various other stuff here, but that seems like the simplest way to get sane assertions.  We should try to create some tests for this multi-range stuff...

The asserts (and behavior in general) are also wrong in the face of redirects, I think.  We need to observe those on all the channels we start ourselves and update our pointers accordingly.  Yes, that's really annoying.  :(

The cycle thing should not be a problem; channels should be guaranteeing OnStopRequest, and we drop the refs there.  Furthermore, all our internal channels drop their refs to their listeners after firing OnStopRequest.

Comment 12

[Boris Zbarsky [:bzbarsky]]

One other thought.  If we're guaranteed that after canceling new channels won't be opened, we could just set a flag and throw from OnStartRequest instead of observing redirects so we can cancel properly.... I'm not sure whether we have that guarantee here.

Comment 13

[Benjamin Smedberg]

Attachment: Fix assertions, rev. 1

Like this? I managed to get a multipart range test going on a local server and this fixes the assertions and still appears to work correctly.

Comment 14

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 513568 [details] [diff] [review]
Fix assertions, rev. 1

This will never remove the multipart request itself from mRequests, since you never get an OnStopRequest for it, right?

And this still has the "not canceling the right thing" issue for redirects...

Comment 15

[Benjamin Smedberg]

nsPluginByteRangeStreamListener::OnStopRequest removes the request, I think that part is correct.

Yeah, I may still need to deal with redirects. I keep thinking that the channel stays the same over redirects.

When a redirect happens, is OnStartRequest called before AsyncOnChannelRedirect?

Comment 16

[Boris Zbarsky [:bzbarsky]]

> nsPluginByteRangeStreamListener::OnStopRequest removes the request, I think
> that part is correct.

Oh, right.  OK, good.

> When a redirect happens, is OnStartRequest called before AsyncOnChannelRedirect?

No.

Comment 18

[Benjamin Smedberg]

Attachment: Rollup patch, rev. 1

This fixes the assertions, handles redirects correctly, and handles redirects on multipart streams correctly as well.

Comment 19

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 514290 [details] [diff] [review]
Rollup patch, rev. 1

r=me.  Thank you!

Comment 20

[Benjamin Smedberg]

http://hg.mozilla.org/mozilla-central/rev/72cfb06dc8bc (code)
http://hg.mozilla.org/mozilla-central/rev/865a1e5b97a1 (tests)

I had to change the code thusly to get GCC to compile correctly:

instead of

return base.forget();

I had to explicitly construct:

return already_AddRefed<nsIRequest>(base.forget());

Comment 21

[Benjamin Smedberg]

Backed out due to test failures. test_visibility.html was timing out pretty regularly, which I thought was a known-random but it's not. And there were a couple other "interesting" things:

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1298491869.1298492588.1496.gz

97030 INFO TEST-START | /tests/modules/plugin/test/test_pluginstream_src.html
NPP_Destroy
NPP_NewStream
NPP_WriteReady
NPP_DestroyStream
NPP_Destroy
NPP_NewStream
NPP_WriteReady
NPP_DestroyStream
97031 INFO TEST-PASS | /tests/modules/plugin/test/test_pluginstream_src.html | bad XMLHttpRequest status - 200 should equal 200
NEXT ERROR 97032 ERROR TEST-UNEXPECTED-FAIL | /tests/modules/plugin/test/test_pluginstream_src.html | content doesn't match - got "Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... Hello... ", expected "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.\n\nDuis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat.\n\nUt wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi.\n\nNam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat.\n\nDuis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut laboreet dolore magna aliquyam erat.\n\nConsetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. "
97033 INFO TEST-PASS | /tests/modules/plugin/test/test_pluginstream_src.html | plugin reported error - "pass" should equal "pass"
97034 INFO TEST-END | /tests/modules/plugin/test/test_pluginstream_src.html | finished in 172ms

The Hello... repeated is neverending.sjs, which is only used in test_streamatclose.html. But test_pluginstream_src happens *before* test_streamatclose.html. I'm completely puzzled.

It also happens that other mochitest runs start warning about focus errors after loading test_streamatclose:

97069 INFO TEST-START | /tests/modules/plugin/test/test_streamatclose.html
97070 INFO Error: Unable to restore focus, expect failures and timeouts.
NPP_Destroy
97071 INFO TEST-PASS | /tests/modules/plugin/test/test_streamatclose.html | neverending.sjs started successfully
NPP_NewStream
NPP_WriteReady
NPP_DestroyStream
NPP_URLNotify called
97072 INFO TEST-PASS | /tests/modules/plugin/test/test_streamatclose.html | Stream should have failed - 2 should equal 2

During that test. So I suspect that a channel is not being cancelled properly, and then something really bad is happening.

Comment 22

[Benjamin Smedberg]

It appears that the failures only happen in opt builds... I'm going to try some of those, and maybe valgrind.

Comment 23

[Ruan]

Hi guys, i'm not sure how it did crash or why, i'm really new at bugzilla so i hope to not say anything wrong.
Why i do know is:
I'm using Firefox 4.0b11 x86 pt_br version
Silverlight 4.0.51204.0
I have about 75 tabs opened in which are split in 3 windows.
i did try to reproduce the bug and clicked like 20 times on forward and backward, pause/play, repeatedly, and this is what happens:
1) Silverlight seems to crash then after a few seconds, 2s or 3s, pops up a message to me saying that silverlight tried to get full screen, the plugin itself do crash.
2 and 3 happen simultaneously. 
2) I choose to not show the message on this session anymore, and to allow fullscreen.
3) A message pops up saying to me that i do have to close firefox, but i didn't closed.
4) On the website with plugin crashed i refresh the page.
5) No errors ever again on that video at least(10 minutos trying).

Comment 24

[Ruan]

Forgot to mention that i'm using windows 7 sp1 installed.

Comment 25

[Josh Aas]

This appears to have landed with further fixes, at least to one test, and stuck.

http://hg.mozilla.org/mozilla-central/rev/25e1f247b7c2
http://hg.mozilla.org/mozilla-central/rev/4806e2c8554e

Comment 26

[Benjamin Smedberg]

Yeah, the new test had an onload handler which was firing twice, which it didn't expect. I fixed it to ignore the first onload and everything appears to be fine.