1105896 - crash in nsNPAPIPluginInstance::GetIsOOP

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Trevor Rowbotham [:rowbot]]

STR:
1) Watch a stream on Twitch.tv
2) Repeat as necessary, as this does not occur 100% of the time.

Actual Results:
The Flash player begins to load, then crashes.

Expected Results:
The Flash player should load and the stream should play.

bp-230a9446-893f-4df3-aea5-b28c42141128
bp-1f8290bb-241c-42e7-8135-0e1d52141126

I only started getting this crash within the last few days. Crash stats[1], shows 1,056 crashes with this signature in the past 7 days.

[1] https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsNPAPIPluginInstance%3A%3AGetIsOOP%28bool*%29#tab-reports

Comment 1

[Glenn Randers-Pehrson]

Observed with Nightly 36.0a1 2014-11-25 (changeset 217254)
Nightly 37.0a1 2014-11-30 (changeset 218105) and with two
local builds on Ubuntu based on changeset 218105.  In each
case I opened www.washingtonpost.com, watched a lot of ads
appear, then the crash happened.

bp-808a02c8-37d7-488c-b1e7-b09ff2141130	11/30/2014	08:01 AM
bp-a5ecacdb-25be-49c8-8f7e-c66522141130	11/30/2014	07:47 AM
bp-27ff9fea-4fb2-4693-ac8c-269ed2141130	11/30/2014	07:46 AM
bp-a1c48e63-da52-4733-80de-961af2141130	11/30/2014	07:39 AM
bp-33ad2f30-e461-469e-90d3-904032141130	11/30/2014	07:39 AM

Comment 2

[Glenn Randers-Pehrson]

My Shockwave Flash add-on was last updated on 11/19/2014 to 11.2.202.424.

Comment 3

[Georg Fritzsche [:gfritzsche]]

Is there a chance you could provide a regression range for this?
We have a tool for finding these ranges:
http://mozilla.github.io/mozregression/

Comment 4

[Trevor Rowbotham [:rowbot]]

Last good: 2014-11-24
Fist bad: 2014-11-25
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=be4ba3d5ca9a&tochange=74edfbf0e6a3

Last good: 2014-11-24
First bad: 2014-11-25
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d24d7dfddb48&tochange=74edfbf0e6a3

Suspected: Bug 1099410 [e10s] Fix re-entrant plugin loading (r=bsmedberg)

Comment 5

[Benjamin Smedberg]

Does this occur only in e10s mode or also in non-e10s mode? Proactively assigning to billm since he's the regressor.

[Tracking Requested - why for this release]: if this affects non-e10s we should uplift to 36.

Comment 6

[Glenn Randers-Pehrson]

I'm running a private build off of m-c revision 218105 -- the same build that was crashing last week -- but am not seeing any crashes now. The only difference is that my SWF plugin got updated by Ubuntu this morning.  A fresh build from revision 219001 which was tip of mozilla-central repo earlier today, also doesn't exhibit the problem.

Comment 7

[Trevor Rowbotham [:rowbot]]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #5)
> Does this occur only in e10s mode or also in non-e10s mode? Proactively
> assigning to billm since he's the regressor.
> 
> [Tracking Requested - why for this release]: if this affects non-e10s we
> should uplift to 36.

This only occurs in e10s mode for me.

Comment 8

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I'm planning to remove that code in a few days. Since this is e10s-only, I think this bug can wait for that.

Comment 9

[Jim Mathies [:jimm]]

This is the #2 top content crasher for nightly.

https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=7&range_unit=days&date=2014-12-11&signature=nsNPAPIPluginInstance%3A%3AGetIsOOP%28bool*%29&version=Firefox%3A37.0a1

Comment 10

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

OK, I backed out bug 1099410. Hopefully that will fix the crashes. I'm not really sure what was going on here, but this code is pretty awful. Bug 1109883 will clean it up.

Let's close this bug if the crashes go away.

Comment 11

[Trevor Rowbotham [:rowbot]]

This appears to be fixed in today's nightly.

Comment 12

[Jim Mathies [:jimm]]

thanks for reporting back!

Comment 15

[Sylvestre Ledru [:Sylvestre]]

e10s only, not tracking for 36.