crash in RevocableStore::Revocable::Revocable(RevocableStore*)

VERIFIED FIXED in Firefox 37

Status

()

Core
Plug-ins
--
critical
VERIFIED FIXED
3 years ago
3 years ago

People

(Reporter: stephend, Assigned: aklotz)

Tracking

({crash, regression, reproducible})

37 Branch
mozilla37
All
Windows 7
crash, regression, reproducible
Points:
---

Firefox Tracking Flags

(firefox36 unaffected, firefox37+ verified)

Details

(crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
This bug was filed from the Socorro interface and is 
report bp-2f1719e6-6ca6-4749-8954-af01e2141231.
=============================================================

STR:

1. With E10S enabled, and using Build identifier: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:37.0) Gecko/20100101 Firefox/37.0, load http://www.octoshape.com/showcase/download-free/ (and/or switch between stream types)
2. Crash:

Frame 	Module 	Signature 	Source
0 	xul.dll 	RevocableStore::Revocable::Revocable(RevocableStore*) 	ipc/chromium/src/base/revocable_store.cc
1 		@0x1f5cfff 	
2 		@0x1f2c53f 	
3 	kernelbase.dll 	RtlAnsiStringToUnicodeString 	
4 	npswf64_16_0_0_235.dll 	F_576329275__________________________________________________________________________________________________ 	c:\program files (x86)\microsoft visual studio 9.0\vc\atlmfc\include\atlwin.h:3081
5 	mozglue.dll 	choose_arena 	memory/mozjemalloc/jemalloc.c
At a glance, it looks like maybe somebody is trying to pass -1 to the ctor.
tracking-e10s: --- → ?
Using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:37.0) Gecko/20100101 Firefox/37.0 ID:20141231030205 CSet: 88037f94b7d7 I can reproduce this fairly consistently by doing the following:

1. Start playing https://www.youtube.com/watch?v=VQJnr1huuCE
2. Select another video in the right hand column and start playing

At least 1 out of 3 times I crash with "The Adobe Flash plugin has crashed" and I get this stack.
Keywords: reproducible
I can also reproduce this with e10s turned off.
(Reporter)

Comment 4

3 years ago
(If it helps, I hit this nearly 100% right now on http://www.gametrailers.com/videos/qihwn6/sukeima-tutorial-mp4 - https://crash-stats.mozilla.com/report/index/607d8166-0ea0-4af6-8984-22d0d2141231)
The stacks make this look like more of a Flash plugin issue than an IPC issue.  (The stack in comment 4 is much better than the one in comment 0.)

FWIW, I can't reproduce this with any of the STR in this bug so far, on OSX Nightly.
tracking-e10s: ? → ---
Component: IPC → Plug-ins

Comment 6

3 years ago
Here's is an STR that works reliably for me:

1. Play a flash video on YouTube
2. Single click the video to make sure the flash player object is focused
3. Repeatedly tap the right arrow keyboard key (i.e ->) -- normally this would advance playback forward -- a few times in rapid succession
4. By about the 3rd to 5th key press, the plugin should have crashed.
5. The crash also occurs when repeatedly using the left arrow key to advance backwards.

Comment 7

3 years ago
Regression pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=beba124659ca&tochange=54c85be89886

Caused by bug 998863
Blocks: 998863
Keywords: regression

Comment 8

3 years ago
NOTE: To reproduce on YouTube with my STR in comment 6, you'll need to install the following extension to force the use of Flash Player: https://addons.mozilla.org/en-US/firefox/addon/youtube-flash-player/?src=search
status-firefox36: --- → unaffected
status-firefox37: --- → affected
Flags: needinfo?(aklotz)
[Tracking Requested - why for this release]: YouTube crashes
tracking-firefox37: --- → ?
Version: unspecified → 37 Branch
Can everybody please let me know what the state of their dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to confirm.
Flags: needinfo?(stephen.donner)
Flags: needinfo?(mozillamarcia.knous)
Flags: needinfo?(aklotz)
(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #10)
> Can everybody please let me know what the state of their
> dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to
> confirm.

Hello Aaron - dom.ipc.plugins.asyncInit is set to false on the Windows machine I am seeing the crashes with.
Flags: needinfo?(mozillamarcia.knous)
I can reproduce. Investigating...
Assignee: nobody → aklotz
Status: NEW → ASSIGNED
Created attachment 8543409 [details] [diff] [review]
Clear StreamNotifyChild's associated stream if BrowserStreamChild::StreamConstructed fails
Flags: needinfo?(stephen.donner)
Attachment #8543409 - Flags: review?(jmathies)
Blocks: 1116806
No longer blocks: 998863

Comment 14

3 years ago
Crash report: bp-4c87411c-46eb-4f92-838a-52baa2150103

If it's of any use:
I can reproduce with 100% crash failure at http://www.bbc.com/news/technology-30657349
I can watch with 100% success rate at http://www.bbc.com/news/uk-30657551

I'm wondering if both pages use the same player.

Comment 15

3 years ago
This is not flash only. Silverlight (Netflix) also crashes.

https://crash-stats.mozilla.com/report/index/0221c127-e67e-4f0a-a02a-b39632150105

dom.ipc.plugins.asyncInit: false
E10s disabled
(Reporter)

Comment 16

3 years ago
(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #10)
> Can everybody please let me know what the state of their
> dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to
> confirm.

dom.ipc.plugins.asyncInit is false on my Windows 7 machine.
tracking-firefox37: ? → +

Updated

3 years ago
Attachment #8543409 - Flags: review?(jmathies) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/7866b505b059
https://hg.mozilla.org/mozilla-central/rev/7866b505b059
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
status-firefox37: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla37

Comment 19

3 years ago
Confirmed fixed in latest nightly build, with both settings of dom.ipc.plugins.asyncInit

https://hg.mozilla.org/mozilla-central/rev/33781a3a5201
Status: RESOLVED → VERIFIED

Comment 20

3 years ago
Encountered this crash while navigating to http://www.microsoft.com/silverlight/iis-smooth-streaming/demo/#/live with Nightly from 2015-01-06, Windows 7 64-bit:
bp-68526185-d72e-4893-93df-ab4862150106
bp-81aa01bb-8d4a-4ea8-8e4f-57e9c2150106

Verified as fixed with latest Nightly (Build ID: 20150107030217) on Windows 7 64-bit.
status-firefox37: fixed → verified

Comment 21

3 years ago
(In reply to CAK from comment #14)
> Crash report: bp-4c87411c-46eb-4f92-838a-52baa2150103
> 
> If it's of any use:
> I can reproduce with 100% crash failure at
> http://www.bbc.com/news/technology-30657349
> I can watch with 100% success rate at http://www.bbc.com/news/uk-30657551
> 
> I'm wondering if both pages use the same player.

Works fine now. 

Thank you Aaron, Ryan!
You need to log in before you can comment on or make changes to this bug.