Closed Bug 700572 Opened 10 years ago Closed 3 months ago

ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA' | ABORT: Surface type is not remotable

Categories

(Core :: Plug-ins, defect, P3)

x86
Windows 7
defect

Tracking

()

RESOLVED WONTFIX
Tracking Status
firefox10 --- wontfix
firefox11 --- affected
firefox12 --- affected
firefox13 --- affected
firefox18 --- affected
firefox19 --- affected
firefox20 --- affected
firefox21 --- affected

People

(Reporter: bc, Unassigned)

References

()

Details

(4 keywords)

Crash Data

Attachments

(2 files)

1. http://www.super.websnadno.cz/ucivo-a-zajimavosti.html with Flash 11.0.1.152 and Nightly.
2. 
###!!! ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA', file c:/work/mozilla/builds/nightly/mozilla/dom/plugins/ipc/PluginInstanceChild.cpp, line 2998

I don't see this on other branches.

Operating system: Windows NT
                  6.1.7601 Service Pack 1
CPU: x86
     GenuineIntel family 6 model 44 stepping 2
     1 CPU

Crash reason:  EXCEPTION_BREAKPOINT
Crash address: 0x75a43e2e
Assertion: Unknown assertion type 0x00000000

Thread 0 (crashed)
 0  KERNELBASE.dll + 0x33e2e
    eip = 0x75a43e2e   esp = 0x001be718   ebp = 0x001be71c   ebx = 0x00000000
    esi = 0x00581930   edi = 0x00000000   eax = 0x00000000   ecx = 0x00000001
    edx = 0x00000000   efl = 0x00200206
    Found by: given as instruction pointer in context
 1  xul.dll!NS_DebugBreak_P [nsDebugImpl.cpp : 340 + 0x4]
    eip = 0x67db8b93   esp = 0x001be724   ebp = 0x001beb3c
    Found by: previous frame's frame pointer
 2  xul.dll!mozilla::plugins::PluginInstanceChild::PaintRectWithAlphaExtraction(nsIntRect const &,gfxASurface *) [PluginInstanceChild.cpp : 2998 + 0x29]
    eip = 0x67be7a19   esp = 0x001beb44   ebp = 0x001beca0
    Found by: call frame info
 3  xul.dll!mozilla::plugins::PluginInstanceChild::ShowPluginFrame() [PluginInstanceChild.cpp : 3239 + 0x20]
    eip = 0x67be8484   esp = 0x001beca8   ebp = 0x001bee04
    Found by: call frame info
 4  xul.dll!mozilla::plugins::PluginInstanceChild::InvalidateRectDelayed() [PluginInstanceChild.cpp : 3383 + 0x7]
    eip = 0x67be8c01   esp = 0x001bee0c   ebp = 0x001bee10
    Found by: call frame info
 5  xul.dll!DispatchToMethod<mozilla::plugins::PluginInstanceChild,void ( mozilla::plugins::PluginInstanceChild::*)(void)>(mozilla::plugins::PluginInstanceChild *,void ( mozilla::plugins::PluginInstanceChild::*)(void),Tuple0 const &) [tuple.h : 383 + 0x8]
    eip = 0x67beb03c   esp = 0x001bee18   ebp = 0x001bee18
    Found by: call frame info
 6  xul.dll!RunnableMethod<mozilla::plugins::PluginInstanceChild,void ( mozilla::plugins::PluginInstanceChild::*)(void),Tuple0>::Run() [task.h : 307 + 0x1d]
    eip = 0x67bea93e   esp = 0x001bee20   ebp = 0x001bee34
    Found by: call frame info
 7  xul.dll!MessageLoop::RunTask(Task *) [message_loop.cc : 318 + 0xc]
    eip = 0x67df6084   esp = 0x001bee3c   ebp = 0x001bee5c
    Found by: call frame info

Also crashes nightly Nightly/10 build
bp-cac38b7b-4b86-4e90-9645-938ed2111107
bp-4e948511-73a7-4c4b-b58a-9b58f2111107
mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame()

nightly Aurora/9, Beta/8 build
bp-df6f7fea-e370-471a-a25f-05eb12111107
bp-fdb76ed6-5b2a-40b7-8bea-1896c2111107
bp-756b5187-1e3d-44e2-85f3-4f45b2111107
[@ _moz_cairo_surface_set_user_data ] 

See also bug 642329
Don't seem to be able to reproduce on X11, FWIW.
Note this is a Windows only issue and is a Flash plugin-container process crash, though on Mac I see a premature out of memory error dumped to the log. Tested with latest Flash 11.1.102.55 

On Nightly/11, Aurora/10 on Windows XP and Windows 7 I get the ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA'

On Beta/9 on Windows XP and Windows 7 I get bug 642329/adbe 2874487 crash @ _moz_cairo_surface_set_user_data mozilla::gfx::SharedDIBSurface::InitSurface(unsigned int, unsigned int, bool) mozilla::gfx::SharedDIBSurface::Create(HDC__*, unsigned int, unsigned int, bool) mozilla::plugins::PluginInstanceChild::CreateOptSurface() mozilla::plugins::PluginInstanceChild::EnsureCurrentBuffer()
Attached file testcase
tar jxvf abort-tests-no-images.tar.bz2

open tests/index.php.htm in a debug build of Firefox on Windows. At least Aurora/10, Nightly/11.

ABORT

I've tried to reduce this test further but Lithium says that removing any single line will cause the ABORTs to disappear. This version does not include the image files which would have ballooned the file size appreciably.

The results can vary.

$ for b in beta aurora nightly; do $b.sh ./tests/index.php.htm |& grep ABORT | sed "s|^|$b: |"; done
aurora: ###!!! ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA', file c:/work/mozilla/builds/aurora/mozilla/dom/plugins/ipc/PluginInstanceChild.cpp, line 2998
nightly: ###!!! ABORT: Expected SharedDIBSurface!: file c:/work/mozilla/builds/nightly/mozilla/dom/plugins/ipc/PluginInstanceChild.cpp, line 2781

bclary@bc-winxp01 /work/mozilla/jesse/lithium.old (sisyphus-dev)
$ for b in beta aurora nightly; do $b.sh ./tests/index.php.htm |& grep ABORT | sed "s|^|$b: |"; done
aurora: ###!!! ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA', file c:/work/mozilla/builds/aurora/mozilla/dom/plugins/ipc/PluginInstanceChild.cpp, line 2998
nightly: ###!!! ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA', file c:/work/mozilla/builds/nightly/mozilla/dom/plugins/ipc/PluginInstanceChild.cpp, line 2998

~ 75% of the time:
ABORT: Refusing to pointlessly recover alpha: 'aSurface->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA'

~ 25% of the time ABORT: Expected SharedDIBSurface!

See also bug 642329
Keywords: testcase
Still there: winxp/win7 beta/11, aurora/12, nightly/13 flash 11.1.102.62
It's #36 top crasher in 13.0.1.
Keywords: topcrash
Additional Analysis from our developer, using Bob Clary's testcase.  I can put someone from Mozilla directly in touch with him if you want to discuss this in more detail, just shoot me an email.

This feels more and more like a browser bug the more I discover:

- The crash occurs before the SWF even loads.  Sometimes we get the NPP_NewStream to start the stream, but often it crashes before we even get this.  ALso, if you swap the swf in the html with a different one, it still crashes.  The only calls we get from the browser before it crashes are: NPP_New, NPP_HandleEvent(WM_WINDOWPOSCHANGED) and NPP_SetWindow (two pairs), then *maybe* one call to NPP_NewStream (or maybe not).  And no NPN_ APIs are called at all after setting the mode to windowless.

- Basically the only thing we get a chance to do is to set the browser into windowless mode (with "NPN_SetValue(instance, NPPVpluginWindowBool, NULL);").  If you avoid calling this, no crash occurs.  Only wmodes that use windowless mode (transparent, opaque) crash.

- If you remove a bunch of the html (those giant tables after the <embed tag say, or *just* the stylesheet), the SWF loads and runs fine.

Really, this feels like a bug in the browser when using windowless mode with huge page coordinates.
Keywords: topcrash
Keywords: reproducible
OS: Windows XP → Windows 7
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ _moz_cairo_surface_set_user_data ] → [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak] [@ _moz_cairo_surface_set_user_data ]
Depends on: 858926
Priority: -- → P2
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak] [@ _moz_cairo_surface_set_user_data ] → [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak ] [@ _moz_cairo_surface_set_user_data ]
Priority: P2 → P3
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak ] [@ _moz_cairo_surface_set_user_data ] → [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak ] [@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::plugins::PluginIns…
Crash Signature: mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ _moz_cairo_surface_set_user_data ] → mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak | columnName ] [@ _moz_cairo_surface_set_user_data ]
Crash Signature: mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak | columnName ] [@ _moz_cairo_surface_set_user_data ] → mozilla::plugins::PluginInstanceChild::ShowPluginFrame() ] [@ mozalloc_abort(char const* const) | NS_DebugBreak | columnName ] [@ _moz_cairo_surface_set_user_data ] [@ mozalloc_abort | NS_DebugBreak_P | mozilla::plugins::PluginInstanceChild::ShowPlugi…
still reproducible with todays m-c tip debug build on windows, i get  plugin has crashed 

latest flash is installed. Benjamin, do you know who could take a look at this bug ?
Flags: needinfo?(benjamin)
I don't think we'll be able to prioritize this bug any time soon.
Flags: needinfo?(benjamin)
Resolving as wont fix, plugin support deprecated in Firefox 85.
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.