1336633 - NVDA makes browser unresponsive when playing Flash video

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, defect, P3)

Description

[Stefan [:StefanG_QA]]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0
Flash Version: 24.0.0.194 
Download and install https://www.nvaccess.org/

STR
1. Make sure NVDA is running
2. Start nightly and navigate to http://www.cnn.com/2016/10/10/us/weather-matthew/index.html
3. Wait for page to load
4. Observe

AR: Broswer become unresponsive and start using too much CPU.
ER: Browser should play the video without issue

STR2
1. Start Nightly and navigate to http://www.cnn.com/2016/10/10/us/weather-matthew/index.html
2. Wait for video to start
3. Start NVDA
4. Observe

AR: Flash plugin crash immediately after NVDA is started
ER: Video should continue playing

Flipping dom.ipc.plugins.asyncdrawing.enabled does not make any difference.

With e10s set to false the issue is not observed.

This applies for Nightly 32/64 bits

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

Sounds like a potential a11y deadlock.

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

I'll take this one for investigation.

Comment 3

[Jim Mathies [:jimm]]

Stefan, would you mind testing to see if this still happens in current nightly?

Comment 4

[Stefan [:StefanG_QA]]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0 (20170216030210)
Flash: 24.0.0.221

I've tested the issue again. Definitely the behavior is better now. With STR2 the issue is no more observed on both 64 and 32 bits Nightly. 

With STR1 the issue now is intermittent. From 5 webpage loads the video start 2 times and browser hangs 3 times showing unresponsive script, then one crash occur with the below crash report. 

https://crash-stats.mozilla.com/report/index/8dfea43f-f910-4765-82ea-ad9d72170216

High CPU usage is no more observed in both cases.

Comment 5

[(No longer employed by Mozilla) Aaron Klotz]

The crash stack in comment 4 shows something that is repeatedly calling QueryInterface on a proxy. I have downloaded the dump and loaded it in windbg, where it resolved to:

00 ntdll!NtWaitForMultipleObjects+0x14
01 KERNELBASE!WaitForMultipleObjectsEx+0xef
02 user32!MsgWaitForMultipleObjectsEx+0x15b
03 combase!CCliModalLoop::BlockFn+0x12d
04 combase!ModalLoop+0xbc
05 combase!ClassicSTAThreadWaitForCall+0xbc
06 combase!ThreadSendReceive+0x384
07 combase!CSyncClientCall::SwitchAptAndDispatchCall+0xc2
08 combase!CSyncClientCall::SendReceive2+0x195
09 combase!SyncClientCallRetryContext::SendReceiveWithRetry+0x2f
0a combase!CSyncClientCall::SendReceiveInRetryContext+0x2f
0b combase!ClassicSTAThreadSendReceive+0x86
0c combase!CSyncClientCall::SendReceive+0x1d3
0d combase!CClientChannel::SendReceive+0x8f
0e combase!NdrExtpProxySendReceive+0xec
0f rpcrt4!NdrpClientCall2+0x31f
10 combase!ObjectStublessClient+0x1e3
11 combase!ObjectStubless+0x42
12 <Unloaded_VBufBackend_gecko_ia2.dll>+0x24184
13 0x00000217`55d24c88

and then stopped unwinding.

This sounds to me like the dreaded main-thread reentry that Jamie has mentioned to me. Jamie, does this sound familiar to you?

Comment 6

[James Teh [:Jamie]]

It's possible. If true, we think we've worked around this re-entry problem in the NVDA "next" branch. Please try the latest NVDA "next" snapshot and see if the problem persists there:
http://www.nvda-project.org/snapshots/
Note that this doesn't have anything to do with our Flash code, so if the issue is Flash specific, that's probably a separate issue. I suspect two separate issues are being conflated here. Hopefully, our fix will address one of them.

Comment 7

[(No longer employed by Mozilla) Aaron Klotz]

Clearing assignment; I don't really have time to test this ATM.

Comment 8

[David Bolter [:davidb] (NeedInfo me for attention)]

Marco can you put this in your triage queue and see if it is still a problem?

Comment 9

[Marco Zehe (:MarcoZ)]

I can not reproduce this, posibly due to the fact that CNN has by now switched to JavaScripted HTML5 video. I have no Flash plugin loaded, and the video plays. So the problem got solved.

Stefan, do you still see this anywhere where there still *is* Flash being used for video?

I am inclined to close this since in a year or so, Flash will be dead anyway, and one rarely encounters it any more...

Comment 10

[Kanchan Kumari QA]

I see high CPU usage on http://www.newgrounds.com/ with or without NVDA. I did encounter freeze and crash with following steps:

1. NVDA is on.
2. Play some game on http://www.newgrounds.com/
3. Observed Browser freez
4. Exit from NVDA
5. Kill Nightly from task manager
6. Restart Nightly

Got a crash notification after restart.

Crash: https://crash-stats.mozilla.com/report/index/95599b0e-e94f-45c0-ba2f-f2acd0170915

Comment 11

[David Bolter [:davidb] (NeedInfo me for attention)]

Speculating this is a P3 based on MarcoZ's input but if we become aware of more critical use cases (e.g. Korean banking IIRC) where this is known to regress users we will need to bump priority.

Comment 12

[James Teh [:Jamie]]

Regarding newgrounds.com, it seems some of these games use canvas instead of Flash. Can you link directly to a Flash game?

here's a sample Flash video which is supposed to be accessible:
http://files.paciellogroup.com/training/WWW2012/samples/accessiblevideo/index.html#/0:00.00/
It does certainly seem to chew a lot of CPU and things get very sluggish. However, I can't reproduce an actual freeze or crash. It'd be great if someone could confirm whether there is a difference in CPU usage with and without NVDA running, as I can't check the latter myself.

I also notice that even for windowed (not transparent or opaque) Flash, the accessible for the Flash video is always unavailable; it never exposes the Flash a11y tree. Marco, is this expected now? Did the code to do this get removed? If we can no longer expose the Flash a11y tree, that rules out anything related to Flash a11y code or weird interactions caused by AT trying to query Flash a11y.

Comment 13

[Marco Zehe (:MarcoZ)]

(In reply to James Teh [:Jamie] from comment #12)
> I also notice that even for windowed (not transparent or opaque) Flash, the
> accessible for the Flash video is always unavailable; it never exposes the
> Flash a11y tree. Marco, is this expected now? Did the code to do this get
> removed? If we can no longer expose the Flash a11y tree, that rules out
> anything related to Flash a11y code or weird interactions caused by AT
> trying to query Flash a11y.

I certainly do not think so. I will have to pass this on to AKlotz, though. It has to do with the Win32ObjectAccessible in Windows, or whatever that class is called exactly. Aaron, any ideas, or have you come across any weirdness with this particular wrap while you were working on IPC a11y?

Comment 14

[(No longer employed by Mozilla) Aaron Klotz]

The only thing that I am aware of is bug 1319640.

Maybe that broke after we tightened the sandbox to level 3?

Comment 15

[Jim Mathies [:jimm]]

currently not seeing this, in general flash and nvda appear to be playing well with eacy other.

Comment 16

[Chris Peterson [:cpeterson]]

We can close this bug because Firefox no longer supports Flash.