751826 - crash in mozilla::plugins::parent::_getproperty

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It's a residual crash signature but there's a spike in crashes starting from 15.0a1/20120503. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b13bfc70bc44&tochange=807403a04a6a
It might be a regression from bug 748343.

Signature 	mozilla::plugins::parent::_getproperty(_NPP*, NPObject*, void*, _NPVariant*) More Reports Search
UUID	c0131d75-df17-4fd8-b5fc-8a23f2120504
Date Processed	2012-05-04 06:03:29
Uptime	1260
Last Crash	6.6 days before submission
Install Age	9.2 hours since version was first installed.
Install Time	2012-05-03 20:49:04
Product	Firefox
Version	15.0a1
Build ID	20120503030512
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x3c
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2772, AdapterSubsysID: 00000000, AdapterDriverVersion: 
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True	
Total Virtual Memory	2147352576
Available Virtual Memory	1832579072
System Memory Use Percentage	43
Available Page File	3438260224
Available Physical Memory	1205981184

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::plugins::parent::_getproperty 	dom/plugins/base/nsNPAPIPlugin.cpp:1704
1 	NPSWF32_11_2_202_233.dll 	NPSWF32_11_2_202_233.dll@0x1bc77e 	
2 	NPSWF32_11_2_202_233.dll 	NPSWF32_11_2_202_233.dll@0x1bd01a 	
3 	NPSWF32_11_2_202_233.dll 	NPSWF32_11_2_202_233.dll@0x1c1174 	
4 		@0xffff0022 	
5 	xul.dll 	mozilla::PluginPRLibrary::NPP_New 	dom/plugins/base/PluginPRLibrary.cpp:227
6 	xul.dll 	nsNPAPIPluginInstance::Start 	dom/plugins/base/nsNPAPIPluginInstance.cpp:422
7 	xul.dll 	nsNPAPIPluginInstance::Initialize 	dom/plugins/base/nsNPAPIPluginInstance.cpp:155
8 	xul.dll 	nsPluginHost::TrySetUpPluginInstance 	dom/plugins/base/nsPluginHost.cpp:1252
9 	xul.dll 	nsPluginHost::SetUpPluginInstance 	dom/plugins/base/nsPluginHost.cpp:1167
10 	xul.dll 	nsPluginHost::InstantiateEmbeddedPluginInstance 	dom/plugins/base/nsPluginHost.cpp:1028
11 	xul.dll 	nsObjectLoadingContent::InstantiatePluginInstance 	content/base/src/nsObjectLoadingContent.cpp:712
12 	xul.dll 	nsObjectLoadingContent::SyncStartPluginInstance 	content/base/src/nsObjectLoadingContent.cpp:2126
13 	xul.dll 	nsAsyncInstantiateEvent::Run 	content/base/src/nsObjectLoadingContent.cpp:157
14 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
15 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
16 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
17 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
18 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:189
19 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:267
20 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:295
21 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3780
22 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3857
23 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3933
24 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:107
25 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
26 	kernel32.dll 	BaseProcessStart 

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Aplugins%3A%3Aparent%3A%3A_getproperty%28_NPP*%2C+NPObject*%2C+void*%2C+_NPVariant*%29

Comment 1

[Scoobidiver (away)]

It's #4 top crasher over the last day.

Comment 2

[Scoobidiver (away)]

The spike is gone around May 5.

Comment 3

[Scoobidiver (away)]

It's #4 top browser crasher in 15.0a2 and #18 in 16.0a1.

All comments are related to Flash.

Now the stack looks like:
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::plugins::parent::_getproperty 	dom/plugins/base/nsNPAPIPlugin.cpp:1630
1 	xul.dll 	mozilla::plugins::PluginScriptableObjectParent::AnswerGetParentProperty 	dom/plugins/ipc/PluginScriptableObjectParent.cpp:913
2 	xul.dll 	mozilla::plugins::PPluginScriptableObjectParent::OnCallReceived 	obj-firefox/ipc/ipdl/PPluginScriptableObjectParent.cpp:1108
3 	xul.dll 	mozilla::plugins::PPluginModuleParent::Lookup 	obj-firefox/ipc/ipdl/PContentParent.cpp:856
4 	mozglue.dll 	je_realloc 	memory/jemalloc/jemalloc.c:6486
5 	xul.dll 	mozilla::ipc::RPCChannel::DispatchIncall 	ipc/glue/RPCChannel.cpp:485
6 	nspr4.dll 	nspr4.dll@0x297f 	
7 	xul.dll 	mozilla::ipc::RPCChannel::Call 	ipc/glue/RPCChannel.cpp:279
8 	xul.dll 	mozilla::plugins::PPluginModuleParent::CallNP_Shutdown 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:419
9 	xul.dll 	mozilla::plugins::PluginModuleParent::NP_Shutdown 	dom/plugins/ipc/PluginModuleParent.cpp:778
10 	xul.dll 	nsNPAPIPlugin::Shutdown 	dom/plugins/base/nsNPAPIPlugin.cpp:514
11 	xul.dll 	nsPluginTag::TryUnloadPlugin 	dom/plugins/base/nsPluginTags.cpp:464
12 	xul.dll 	nsPluginHost::ReloadPlugins 	dom/plugins/base/nsPluginHost.cpp:450
13 	xul.dll 	mozilla::plugins::parent::_reloadplugins 	dom/plugins/base/nsNPAPIPlugin.cpp:1154
14 	xul.dll 	mozilla::plugins::PluginModuleParent::RecvNPN_ReloadPlugins 	dom/plugins/ipc/PluginModuleParent.cpp:1162
15 	xul.dll 	mozilla::plugins::PPluginModuleParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:1135
16 	xul.dll 	mozilla::ipc::AsyncChannel::OnDispatchMessage 	ipc/glue/AsyncChannel.cpp:463
17 	xul.dll 	mozilla::ipc::RPCChannel::Call 	ipc/glue/RPCChannel.cpp:213
18 	xul.dll 	mozilla::plugins::PPluginModuleParent::CallPPluginInstanceConstructor 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:375
19 	xul.dll 	nsTHashtable<nsBaseHashtableET<nsPtrHashKey<NPObject>,mozilla::plugins::PluginSc 	obj-firefox/dist/include/nsTHashtable.h:414
20 	xul.dll 	nsNPAPIPluginInstance::Start 	dom/plugins/base/nsNPAPIPluginInstance.cpp:438
21 	xul.dll 	nsNPAPIPluginInstance::Initialize 	dom/plugins/base/nsNPAPIPluginInstance.cpp:150
22 	xul.dll 	nsGenericElement::AddRef 	content/base/src/nsGenericElement.cpp:5054
23 	xul.dll 	nsHTMLObjectElement::QueryInterface 	content/html/content/src/nsHTMLObjectElement.cpp:213
...

Comment 4

[Marcia Knous [:marcia]]

Currently #2 top browser crash in Aurora in the last week and #13 on the trunk, so top crash still applies.

Comment 5

[Benjamin Smedberg]

I believe that this bug was fixed by bug 686335 on trunk for the 0615 nightly (at least from looking at the crashes-by-buildid graph) and that matches the initial diagnosis from the stack, which involves Flash upgrades and us tearing down a plugin while it is being created. Scoobi, can you double-check me? This should then be fixed on Aurora as of yesterday's nightly and FF14b9 and the Firefox 13.0.2 candidates, if anyone is using those.

Comment 6

[Benjamin Smedberg]

Oh, and this probably just had a different signature prior to bug 748343.

Comment 7

[Scoobidiver (away)]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #5)
> Scoobi, can you double-check me?
It's indeed fixed in 16.0a1/20120615 and 15.0a2/20120624 which matches the landing dates of bug 686335. I can't check in 14.0b9 and 13.0.2 where it's still not a top crasher.

Comment 8

[Scoobidiver (away)]

There are also no crashes in 14.0b9.

Comment 9

[Ioana (away)]

Crashes with this signature are still listed in Socorro, including a crash on Firefox 15.0 07/24 beta:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Aplugins%3A%3Aparent%3A%3A_getproperty%28_NPP*%2C+NPObject*%2C+void*%2C+_NPVariant*%29

Comment 10

[Benjamin Smedberg]

That is a tiny volume, a residual signature unrelated to this spike.

Comment 11

[Ioana (away)]

Thanks, Benjamin. I will mark this issue as fixed then.