crash in mozilla::plugins::PluginScriptableObjectParent::GetPropertyHelper(void*, bool*, bool*, _NPVariant*)

VERIFIED FIXED in Firefox 38

Status

()

Core
Plug-ins
--
critical
VERIFIED FIXED
2 years ago
2 years ago

People

(Reporter: vladan, Assigned: aklotz)

Tracking

({crash})

38 Branch
mozilla38
x86_64
Windows 7
crash
Points:
---

Firefox Tracking Flags

(firefox38 verified)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is 
report bp-ad5cdf89-a443-4791-8968-654652150207.
=============================================================

This crash happens intermittently during page loading with dom.ipc.plugins.asyncInit set to true. A plugin is not being initialized in this stack, but I've only seen this crash happen in my profiles that have asyncInit enabled. Crash occurs both with e10s and non-e10s.

Maybe one of the plugin experts could help interpret this stack?
(Reporter)

Comment 1

2 years ago
25 crashes in Nightly since January 1st

https://crash-stats.mozilla.com/signature/?date=%3E2015-01-01&version=38.0a1&signature=mozilla%3A%3Aplugins%3A%3APluginScriptableObjectParent%3A%3AGetPropertyHelper%28void*%2C+bool*%2C+bool*%2C+_NPVariant*%29&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1
Are there any URLs that this occurs consistently with?
Flags: needinfo?(vdjeric)
(Reporter)

Comment 3

2 years ago
(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #2)
> Are there any URLs that this occurs consistently with?

I can't reproduce it reliably but I've had this crash happen two more times today. All 3 times I had the Plugin Hang UI appear, I then clicked "Stop plugin" and then got the crash.
Flags: needinfo?(vdjeric)
A call stack from the original hang that spawned the plugin hang ui would be very useful here.
Flags: needinfo?(vdjeric)
(Reporter)

Comment 5

2 years ago
Ok i'll keep an eye out
Created attachment 8561162 [details] [diff] [review]
Better error checking

The initial hang is still important to investigate for this bug, but this is a speculative fix that might help with the crashing.
Attachment #8561162 - Flags: review?(jmathies)

Updated

2 years ago
Attachment #8561162 - Flags: review?(jmathies) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/3f53cf53a34e
Keywords: leave-open
https://hg.mozilla.org/mozilla-central/rev/3f53cf53a34e
(Reporter)

Comment 9

2 years ago
Created attachment 8562518 [details]
hangStack.txt

I got another one of these hangs tonight. The Plugin Hang UI popped up, but then Firefox crashed before I could attach a debugger.

I was able to reproduce the hang a second time, and this time I captured this main-thread stack while the Plugin Hang UI was still active. Obviously, I can't be 100% sure this is the same hang.

When I resumed Firefox after a few minutes, it did not crash.
Flags: needinfo?(vdjeric)
(Reporter)

Comment 10

2 years ago
Related crash signature?
https://crash-stats.mozilla.com/report/index/d5f0c7c7-27a3-4fdc-89c2-2a31c2150212
(Reporter)

Updated

2 years ago
Flags: needinfo?(aklotz)
Created attachment 8563739 [details] [diff] [review]
Check for null actor

I compared a crash report from yesterdays build against the binaries of the build itself. Based upon the state of the registers in that crash dump I was able to deduce that the crash is due to a null actor, presumably due to plugin-container termination.

This patch is not speculative; it will definitely eliminate the crashes for this signature.
Assignee: nobody → aklotz
Status: NEW → ASSIGNED
Attachment #8563739 - Flags: review?(jmathies)
(In reply to Vladan Djeric (:vladan) -- please needinfo! from comment #10)
> Related crash signature?
> https://crash-stats.mozilla.com/report/index/d5f0c7c7-27a3-4fdc-89c2-
> 2a31c2150212

That looks like a content bug. There's a null pointer to the nsPluginInstanceOwner object. Please file separately.
Flags: needinfo?(aklotz)

Updated

2 years ago
Attachment #8563739 - Flags: review?(jmathies) → review+
Attachment #8561162 - Flags: checkin+
Flagging checkin-needed for patch https://bugzilla.mozilla.org/attachment.cgi?id=8563739

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e63c87f2adda
Keywords: leave-open → checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/edd04b167f47
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/edd04b167f47
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox38: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Socorro [1] shows zero crashes over the past 4 weeks.
Status: RESOLVED → VERIFIED
status-firefox38: fixed → verified
You need to log in before you can comment on or make changes to this bug.