Closed Bug 1116825 Opened 5 years ago Closed 5 years ago

crash in RevocableStore::Revocable::Revocable(RevocableStore*)

Categories

(Core :: Plug-ins, defect, critical)

37 Branch
All
Windows 7
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla37
Tracking Status
firefox36 --- unaffected
firefox37 + verified

People

(Reporter: stephend, Assigned: aklotz)

References

()

Details

(Keywords: crash, regression, reproducible)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-2f1719e6-6ca6-4749-8954-af01e2141231.
=============================================================

STR:

1. With E10S enabled, and using Build identifier: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:37.0) Gecko/20100101 Firefox/37.0, load http://www.octoshape.com/showcase/download-free/ (and/or switch between stream types)
2. Crash:

Frame 	Module 	Signature 	Source
0 	xul.dll 	RevocableStore::Revocable::Revocable(RevocableStore*) 	ipc/chromium/src/base/revocable_store.cc
1 		@0x1f5cfff 	
2 		@0x1f2c53f 	
3 	kernelbase.dll 	RtlAnsiStringToUnicodeString 	
4 	npswf64_16_0_0_235.dll 	F_576329275__________________________________________________________________________________________________ 	c:\program files (x86)\microsoft visual studio 9.0\vc\atlmfc\include\atlwin.h:3081
5 	mozglue.dll 	choose_arena 	memory/mozjemalloc/jemalloc.c
At a glance, it looks like maybe somebody is trying to pass -1 to the ctor.
tracking-e10s: --- → ?
Using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:37.0) Gecko/20100101 Firefox/37.0 ID:20141231030205 CSet: 88037f94b7d7 I can reproduce this fairly consistently by doing the following:

1. Start playing https://www.youtube.com/watch?v=VQJnr1huuCE
2. Select another video in the right hand column and start playing

At least 1 out of 3 times I crash with "The Adobe Flash plugin has crashed" and I get this stack.
Keywords: reproducible
I can also reproduce this with e10s turned off.
The stacks make this look like more of a Flash plugin issue than an IPC issue.  (The stack in comment 4 is much better than the one in comment 0.)

FWIW, I can't reproduce this with any of the STR in this bug so far, on OSX Nightly.
tracking-e10s: ? → ---
Component: IPC → Plug-ins
Here's is an STR that works reliably for me:

1. Play a flash video on YouTube
2. Single click the video to make sure the flash player object is focused
3. Repeatedly tap the right arrow keyboard key (i.e ->) -- normally this would advance playback forward -- a few times in rapid succession
4. By about the 3rd to 5th key press, the plugin should have crashed.
5. The crash also occurs when repeatedly using the left arrow key to advance backwards.
NOTE: To reproduce on YouTube with my STR in comment 6, you'll need to install the following extension to force the use of Flash Player: https://addons.mozilla.org/en-US/firefox/addon/youtube-flash-player/?src=search
[Tracking Requested - why for this release]: YouTube crashes
Can everybody please let me know what the state of their dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to confirm.
Flags: needinfo?(stephen.donner)
Flags: needinfo?(mozillamarcia.knous)
Flags: needinfo?(aklotz)
(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #10)
> Can everybody please let me know what the state of their
> dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to
> confirm.

Hello Aaron - dom.ipc.plugins.asyncInit is set to false on the Windows machine I am seeing the crashes with.
Flags: needinfo?(mozillamarcia.knous)
I can reproduce. Investigating...
Assignee: nobody → aklotz
Status: NEW → ASSIGNED
Flags: needinfo?(stephen.donner)
Attachment #8543409 - Flags: review?(jmathies)
Blocks: asyncplugininit
No longer blocks: 998863
Crash report: bp-4c87411c-46eb-4f92-838a-52baa2150103

If it's of any use:
I can reproduce with 100% crash failure at http://www.bbc.com/news/technology-30657349
I can watch with 100% success rate at http://www.bbc.com/news/uk-30657551

I'm wondering if both pages use the same player.
This is not flash only. Silverlight (Netflix) also crashes.

https://crash-stats.mozilla.com/report/index/0221c127-e67e-4f0a-a02a-b39632150105

dom.ipc.plugins.asyncInit: false
E10s disabled
(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #10)
> Can everybody please let me know what the state of their
> dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to
> confirm.

dom.ipc.plugins.asyncInit is false on my Windows 7 machine.
Attachment #8543409 - Flags: review?(jmathies) → review+
https://hg.mozilla.org/mozilla-central/rev/7866b505b059
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
Confirmed fixed in latest nightly build, with both settings of dom.ipc.plugins.asyncInit

https://hg.mozilla.org/mozilla-central/rev/33781a3a5201
Status: RESOLVED → VERIFIED
Encountered this crash while navigating to http://www.microsoft.com/silverlight/iis-smooth-streaming/demo/#/live with Nightly from 2015-01-06, Windows 7 64-bit:
bp-68526185-d72e-4893-93df-ab4862150106
bp-81aa01bb-8d4a-4ea8-8e4f-57e9c2150106

Verified as fixed with latest Nightly (Build ID: 20150107030217) on Windows 7 64-bit.
(In reply to CAK from comment #14)
> Crash report: bp-4c87411c-46eb-4f92-838a-52baa2150103
> 
> If it's of any use:
> I can reproduce with 100% crash failure at
> http://www.bbc.com/news/technology-30657349
> I can watch with 100% success rate at http://www.bbc.com/news/uk-30657551
> 
> I'm wondering if both pages use the same player.

Works fine now. 

Thank you Aaron, Ryan!
You need to log in before you can comment on or make changes to this bug.