636955 - Crash [@ mozilla::plugins::PPluginModuleParent::DeallocSubtree() ]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that first appeared in 4.0b13pre/20110225.
It is #7 top crasher in this build.

There are two kinds of stack traces:
0 	xul.dll 	mozilla::plugins::PPluginModuleParent::DeallocSubtree 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:1275
1 	xul.dll 	mozilla::plugins::PPluginModuleParent::OnChannelClose 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:951
2 	xul.dll 	mozilla::ipc::AsyncChannel::NotifyChannelClosed 	ipc/glue/AsyncChannel.cpp:324
3 	xul.dll 	mozilla::ipc::AsyncChannel::Close 	ipc/glue/AsyncChannel.cpp:208
4 	xul.dll 	mozilla::plugins::PluginModuleParent::NP_Shutdown 	dom/plugins/PluginModuleParent.cpp:796
5 	xul.dll 	nsNPAPIPlugin::Shutdown 	modules/plugin/base/src/nsNPAPIPlugin.cpp:586
6 	xul.dll 	nsPluginTag::TryUnloadPlugin 	modules/plugin/base/src/nsPluginTags.cpp:564
7 	xul.dll 	nsPluginHost::Destroy 	modules/plugin/base/src/nsPluginHost.cpp:870
8 	xul.dll 	nsPluginHost::Observe 	modules/plugin/base/src/nsPluginHost.cpp:3578
...

0 	xul.dll 	mozilla::plugins::PPluginModuleParent::DeallocSubtree 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:1275
1 	xul.dll 	mozilla::plugins::PPluginModuleParent::OnChannelError 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:959
2 	xul.dll 	mozilla::ipc::AsyncChannel::NotifyMaybeChannelError 	ipc/glue/AsyncChannel.cpp:346
3 	xul.dll 	mozilla::ipc::AsyncChannel::OnNotifyMaybeChannelError 	ipc/glue/AsyncChannel.cpp:311
...

The regression window is large because of the blocked automatic update during
the Beta 12 release:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1da3405c74fd&tochange=d7ef42d7782c

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=mozilla%3A%3Aplugins%3A%3APPluginModuleParent%3A%3ADeallocSubtree%28%29

Comment 1

[Benjamin Smedberg]

This crash appears in 3.6.13 as well. It appears to be related to shutdown, as if we're crashing the plugin and then, while the notification we send to the plugin host is pending, we call NP_Shutdown and try to destroy it again (and perhaps racing the other direction as well).

I would have expected this to be related to clear-private-data for Flash plugins, but the regression range doesn't seem to match. Are you sure about the range?

Let's watch this in beta12 and RC.

Comment 2

[Scoobidiver (away)]

> Are you sure about the range?
No because there are no crashes after 4.0b13pre/20110225, so it is just a residual crash signature.

Comment 3

[Scoobidiver (away)]

In the 3 crash reports over the last four weeks, none have a stack trace similar the one in comment 0.
I close it as WFM.