795683 - crash in mozilla::plugins::PStreamNotify::Transition with abort messages: "__delete__()d actor" or "corrupted actor state" mainly with FlashGot

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect, P3)

Description

[Scoobidiver (away)]

It's #36 top browser crasher and #3 on Mac OS X in 16.0b5.

It's correlated to FlashGot:
  mozalloc_abort(char const* const) | NS_DebugBreak_P | Pickle::WriteBytes(void const*, int)|EXCEPTION_BREAKPOINT (71 crashes)
     69% (49/71) vs.   1% (634/61612) {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} (FlashGot, https://addons.mozilla.org/addon/220)
     32% (23/71) vs.   5% (3344/61612) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)

Signature 	mozalloc_abort(char const* const) | NS_DebugBreak_P | Pickle::WriteBytes(void const*, int) More Reports Search
UUID	5d8dc7e0-826a-4187-a626-942922120930
Date Processed	2012-09-30 07:38:27
Uptime	5811
Last Crash	4.8 weeks before submission
Install Age	23.6 hours since version was first installed.
Install Time	2012-09-29 07:59:14
Product	Firefox
Version	16.0
Build ID	20120925201946
Release Channel	beta
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 47 stepping 0
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0xee1988
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9589, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.970.100.3000
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ xpcom_runtime_abort(###!!! ABORT: corrupted actor state: file e:/builds/moz2_slave/rel-m-beta-w32-bld/build/obj-firefox/ipc/ipdl/PStreamNotify.cpp, line 34)
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x9589
Total Virtual Memory	2147352576
Available Virtual Memory	1581047808
System Memory Use Percentage	63
Available Page File	1679499264
Available Physical Memory	391778304

Frame 	Module 	Signature 	Source
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:23
1 	xul.dll 	NS_DebugBreak_P 	xpcom/base/nsDebugImpl.cpp:410
2 	xul.dll 	Pickle::WriteBytes 	ipc/chromium/src/base/pickle.cc:421
3 	xul.dll 	mozilla::plugins::PStreamNotify::Transition 	obj-firefox/ipc/ipdl/PStreamNotify.cpp:28
4 	xul.dll 	mozilla::plugins::PStreamNotifyParent::SendRedirectNotify 	obj-firefox/ipc/ipdl/PStreamNotifyParent.cpp:72
5 	xul.dll 	mozilla::plugins::PluginInstanceParent::NPP_URLRedirectNotify 	dom/plugins/ipc/PluginInstanceParent.cpp:1180
6 	xul.dll 	mozilla::plugins::PluginModuleParent::NPP_URLRedirectNotify 	dom/plugins/ipc/PluginModuleParent.cpp:630
7 	xul.dll 	nsNPAPIPluginStreamListener::HandleRedirectNotification 	dom/plugins/base/nsNPAPIPluginStreamListener.cpp:861
8 	xul.dll 	NS_TableDrivenQI 	obj-firefox/xpcom/build/nsISupportsImpl.cpp:12
9 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base 	obj-firefox/dist/include/nsAutoPtr.h:874
10 	xul.dll 	NS_GetWeakReference 	obj-firefox/xpcom/build/nsWeakReference.cpp:83
11 	xul.dll 	do_GetWeakReference 	obj-firefox/dist/include/nsIWeakReferenceUtils.h:79
12 	xul.dll 	_SEH_epilog4

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char+const*+const%29+|+NS_DebugBreak_P+|+Pickle%3A%3AWriteBytes%28void+const*%2C+int%29
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort+|+NS_DebugBreak_P+|+mozilla%3A%3Aplugins%3A%3APStreamNotify%3A%3ATransition
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char+const*+const%29+|+NS_DebugBreak_P+|+SystemTimeToFileTime

Comment 1

[Scoobidiver (away)]

It first appeared across all channels on September 27.
According to AMO, FlashGot 1.4.8.2 was released on September 18 like version 1.4.8.2rc1.

Comment 2

[Marcia Knous [:marcia]]

Jorge: Maybe we can add the author of FlashGot to this bug? Something might have changed in the new version.

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Giorgio, can you look into this please?

Comment 4

[Giorgio Maone [:ma1]]

Could you check whether FlashGot 1.4.8.3rc1 from http://flashgot.net/getit#devel effectively works around this problem?

1.4.8.3rc1 recycles a notificationCallback property from a media stream channel in another temporary channel, which is probably risky and might be the cause of this bug, even though I couldn't reproduce anyway because it doesn't seem to affect Windows 7 64 where I currently am (maybe a *X Flash player specific issue?)

I replaced the risky code with a more orthodox way to track the original window in slightly modified versions of the same request (what my hack was meant for).

If someone can confirm this is a solution, I'm gonna submit 1.4.8.3 on AMO for fast track approval.

Comment 5

[Scoobidiver (away)]

(In reply to Giorgio Maone from comment #4)
> Could you check whether FlashGot 1.4.8.3rc1 from
> http://flashgot.net/getit#devel effectively works around this problem?
This bug is based on crash stats. We don't have STR except those in comments. The confirmation will come post-release.

> I couldn't reproduce anyway because it doesn't seem to affect Windows 7 64 where
> I currently am
64-bit Windows are affected, the x86 build architecture means only 32-bit Firefox is used. Nightlies have 32-bit and 64-bit builds.

Comment 6

[Robert Kaiser]

This was a very low volume crash on 15 until it rose on Saturday, Sep 29, and is now #28 on 15.0.1 over the last 3 days. That looks a lot like a website change somewhere triggered this. FYI, there's a ton of YouTube URLs on the 15.0.1 signature, but also some Facebook, vk.com and others, looks like it might be all video stuff, though.

Benjamin says on IRC that "it's a plugin logic error that we can/should fix".

Comment 7

[Alex Keybl [:akeybl]]

Assigning to Benjamin since he's got an idea about a forward fix, and requesting that QA tries the latest FlashGot (before 1.4.8.3rc1) to reproduce on OS X.

Comment 8

[Marcia Knous [:marcia]]

48 	about:blank
23 	http://www.facebook.com/
22 	http://creatives.livejasmin.com/pu/w2/index.php?psid=ed_ncxtpop&pstour=t1&psprog
11 	https://www.facebook.com/?ref=tn_tnmn
9 	http://www.facebook.com/?ref=tn_tnmn
7 	https://apps.facebook.com/farmville-two//index.php
6 	about:newtab
6 	https://www.facebook.com/
5 	http://apps.facebook.com/logout.php
4 	https://apps.facebook.com/farmville-two/xpromo.php?src=xpromo&aff=chefville&crt=
4 	http://www.youtube.com/watch?v=bNy3yA3olRM&feature=related
3 	http://apps.facebook.com/farmville-two//index.php
3 	http://www.iqiyi.com/zongyi/20120930/c7b808ecfe7c6d53.html?src=aldzy
3 	http://apps.facebook.com/farmville-two/?src=xpromo&aff=farmville&crt=launch_r1_v
3 	http://apps.facebook.com/chefville/?fb_source=bookmark_apps&ref=bookmarks&count=
3 	https://apps.facebook.com/logout.php
3 	https://www.horizon.tv/nl_nl/tv-kijken.html
2 	http://www.youtube.com/watch?v=nmtqEg6JuNQ&feature=autoplay&list=ULHA3wgojV7so&p
2 	http://www.msn.com/
2 	http://el-murid.livejournal.com/759270.html
2 	http://ads.gorillavid.in/pop-default.php
2 	https://plus.google.com/u/0/_/notifications/frame?origin=http%3A%2F%2Fwww.youtub


3 	http://edge.jeetyetmedia.com/youtube_728x90_190.htm?clientId=1C1F40E8-2EB4-1574-
1 	http://www.youtube.com/watch?v=KPD86PMc2yA
1 	http://www.youtube.com/watch?v=RUYqRmzccd4&feature=relmfu
1 	http://www.youtube.com/watch?v=mO6pmaIe8l4&feature=bf_next&list=AL94UKMTqg-9DE_o
1 	http://www.youtube.com/watch?v=nQPfyVTnVhM&feature=g-u-u
1 	https://www.facebook.com/
1 	http://www.youtube.com/watch?v=CyuQJE-Z9cQ
1 	http://www.youtube.com/watch?v=cfPgj20O0RE
1 	http://www.youtube.com/watch?v=ggWHMo6McFI&feature=related
1 	http://www.youtube.com/watch?v=c935jy6bKzY&feature=related
1 	http://www.youtube.com/watch?v=2rcpPMmGrd8&feature=related
1 	http://www.youtube.com/watch?v=yeHFCLgfenM
1 	http://vimeo.com/search/page:5/sort:relevant/format:thumbnail?q=stones%20from%20
1       http://www.joemonster.org/filmy/47638/Waldemar_Malicki_and_Filharmonia_Dowcipu_Toccata_Fuga_d_moll

Comment 9

[u279076]

I've been trying the various FlashGot functions on Youtube and Facebook without any success so far. Mac OSX 10.7.4, Flash 11.4.402.257, Firefox 17.0b1, and FlashGot 1.4.8.2. Are there any specific leads QA can follow?

Comment 10

[Alex Keybl [:akeybl]]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #9)
> I've been trying the various FlashGot functions on Youtube and Facebook
> without any success so far. Mac OSX 10.7.4, Flash 11.4.402.257, Firefox
> 17.0b1, and FlashGot 1.4.8.2. Are there any specific leads QA can follow?

Benjamin may know best, since he's thought about a fix.

Comment 11

[Giorgio Maone [:ma1]]

BTW, 1.4.8.2 is nor compatible with 17, please use current stable, 1.4.8.4.

Comment 12

[u279076]

(In reply to Giorgio Maone from comment #11)
> BTW, 1.4.8.2 is nor compatible with 17, please use current stable, 1.4.8.4.

I was specifically asked to test with a version before 1.4.8.3rc1 to track down the regression.

Comment 13

[Benjamin Smedberg]

I do not know what a fix would look like (yet). This looks like the kind of bug we *should* fix, however. If we have STR (steps involving flashgot is fine, even flashgot RC versions) that should let me or somebody else look at the problem and figure out why the notifications aren't being delivered in the proper order.

Comment 14

[Scoobidiver (away)]

There are 2 crashes in 16.0.1 and no crashes in 17.0b1 on Mac. There are a few crashes on Windows.

Comment 15

[Lukas Blakk [:lsblakk] use ?needinfo]

Given comment 14 I'm going to untrack and let this take it's natural course. If there's a fix we'll consider for uplift if the timing works with the Beta release we're at, and if the volume increases please renominate as well.

Comment 16

[u279076]

I've been unable to find any steps to reproduce this bug. Given this has been untracked for Firefox 17, I'm also dropping qawanted. If someone is able to reliably reproduce this crash, please comment your steps below.

Comment 17

[Mihai Morar, (:MihaiMorar)]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #16)

There are 0 crashes in Soccoro for first signature starting with FF 18.b1 and only 10 crashes for second signature starting with FF 18.0.2 in last 4weeks. As Lukas said in Comment 15 it looks like it's natural course got in a good way.

Comment 18

[Mihai Morar, (:MihaiMorar)]

(In reply to MarioMi (:MarioMi) from comment #17)
> (In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #16)

The only notable thing for the other signatures is that [@ mozalloc_abort(char const* const) | NS_DebugBreak_P ] has 50 crashes and a percentage of 81.967 % on 21.0a1 in last 4 weeks.

Comment 19

[Mihai Morar, (:MihaiMorar)]

There are no crashes in last 4 weekes for FF >16.02 for any of the signatures mentioned in Comment 0. Should this be closed?

Comment 20

[Scoobidiver (away)]

(In reply to MarioMi (:MarioMi) from comment #19)
> Should this be closed?
Let's do that.

Comment 21

[Mihai Morar, (:MihaiMorar)]

Thanks Scoobi!