1116825 - crash in RevocableStore::Revocable::Revocable(RevocableStore*)

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

This bug was filed from the Socorro interface and is 
report bp-2f1719e6-6ca6-4749-8954-af01e2141231.
=============================================================

STR:

1. With E10S enabled, and using Build identifier: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:37.0) Gecko/20100101 Firefox/37.0, load http://www.octoshape.com/showcase/download-free/ (and/or switch between stream types)
2. Crash:

Frame 	Module 	Signature 	Source
0 	xul.dll 	RevocableStore::Revocable::Revocable(RevocableStore*) 	ipc/chromium/src/base/revocable_store.cc
1 		@0x1f5cfff 	
2 		@0x1f2c53f 	
3 	kernelbase.dll 	RtlAnsiStringToUnicodeString 	
4 	npswf64_16_0_0_235.dll 	F_576329275__________________________________________________________________________________________________ 	c:\program files (x86)\microsoft visual studio 9.0\vc\atlmfc\include\atlwin.h:3081
5 	mozglue.dll 	choose_arena 	memory/mozjemalloc/jemalloc.c

Comment 1

[Andrew McCreight [:mccr8]]

At a glance, it looks like maybe somebody is trying to pass -1 to the ctor.

Comment 2

[Marcia Knous [:marcia]]

Using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:37.0) Gecko/20100101 Firefox/37.0 ID:20141231030205 CSet: 88037f94b7d7 I can reproduce this fairly consistently by doing the following:

1. Start playing https://www.youtube.com/watch?v=VQJnr1huuCE
2. Select another video in the right hand column and start playing

At least 1 out of 3 times I crash with "The Adobe Flash plugin has crashed" and I get this stack.

Comment 3

[Marcia Knous [:marcia]]

I can also reproduce this with e10s turned off.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

(If it helps, I hit this nearly 100% right now on http://www.gametrailers.com/videos/qihwn6/sukeima-tutorial-mp4 - https://crash-stats.mozilla.com/report/index/607d8166-0ea0-4af6-8984-22d0d2141231)

Comment 5

[Andrew McCreight [:mccr8]]

The stacks make this look like more of a Flash plugin issue than an IPC issue.  (The stack in comment 4 is much better than the one in comment 0.)

FWIW, I can't reproduce this with any of the STR in this bug so far, on OSX Nightly.

Comment 6

[IU]

Here's is an STR that works reliably for me:

1. Play a flash video on YouTube
2. Single click the video to make sure the flash player object is focused
3. Repeatedly tap the right arrow keyboard key (i.e ->) -- normally this would advance playback forward -- a few times in rapid succession
4. By about the 3rd to 5th key press, the plugin should have crashed.
5. The crash also occurs when repeatedly using the left arrow key to advance backwards.

Comment 7

[IU]

Regression pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=beba124659ca&tochange=54c85be89886

Caused by bug 998863

Comment 8

[IU]

NOTE: To reproduce on YouTube with my STR in comment 6, you'll need to install the following extension to force the use of Flash Player: https://addons.mozilla.org/en-US/firefox/addon/youtube-flash-player/?src=search

Comment 9

[Andrew McCreight [:mccr8]]

[Tracking Requested - why for this release]: YouTube crashes

Comment 10

[(No longer employed by Mozilla) Aaron Klotz]

Can everybody please let me know what the state of their dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to confirm.

Comment 11

[Marcia Knous [:marcia]]

(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #10)
> Can everybody please let me know what the state of their
> dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to
> confirm.

Hello Aaron - dom.ipc.plugins.asyncInit is set to false on the Windows machine I am seeing the crashes with.

Comment 12

[(No longer employed by Mozilla) Aaron Klotz]

I can reproduce. Investigating...

Comment 13

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Clear StreamNotifyChild's associated stream if BrowserStreamChild::StreamConstructed fails

Comment 14

[CAK]

Crash report: bp-4c87411c-46eb-4f92-838a-52baa2150103

If it's of any use:
I can reproduce with 100% crash failure at http://www.bbc.com/news/technology-30657349
I can watch with 100% success rate at http://www.bbc.com/news/uk-30657551

I'm wondering if both pages use the same player.

Comment 15

[Adam Frisby]

This is not flash only. Silverlight (Netflix) also crashes.

https://crash-stats.mozilla.com/report/index/0221c127-e67e-4f0a-a02a-b39632150105

dom.ipc.plugins.asyncInit: false
E10s disabled

Comment 16

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #10)
> Can everybody please let me know what the state of their
> dom.ipc.plugins.asyncInit preference is? I'm assuming false but I'd like to
> confirm.

dom.ipc.plugins.asyncInit is false on my Windows 7 machine.

Comment 17

[(No longer employed by Mozilla) Aaron Klotz]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7866b505b059

Comment 18

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7866b505b059

Comment 19

[IU]

Confirmed fixed in latest nightly build, with both settings of dom.ipc.plugins.asyncInit

https://hg.mozilla.org/mozilla-central/rev/33781a3a5201

Comment 20

[Ada [:adalucinet]]

Encountered this crash while navigating to http://www.microsoft.com/silverlight/iis-smooth-streaming/demo/#/live with Nightly from 2015-01-06, Windows 7 64-bit:
bp-68526185-d72e-4893-93df-ab4862150106
bp-81aa01bb-8d4a-4ea8-8e4f-57e9c2150106

Verified as fixed with latest Nightly (Build ID: 20150107030217) on Windows 7 64-bit.

Comment 21

[CAK]

(In reply to CAK from comment #14)
> Crash report: bp-4c87411c-46eb-4f92-838a-52baa2150103
> 
> If it's of any use:
> I can reproduce with 100% crash failure at
> http://www.bbc.com/news/technology-30657349
> I can watch with 100% success rate at http://www.bbc.com/news/uk-30657551
> 
> I'm wondering if both pages use the same player.

Works fine now. 

Thank you Aaron, Ryan!