1130747 - crash in mozilla::plugins::PluginScriptableObjectParent::GetPropertyHelper(void*, bool*, bool*, _NPVariant*)

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Vladan Djeric (:vladan)]

This bug was filed from the Socorro interface and is 
report bp-ad5cdf89-a443-4791-8968-654652150207.
=============================================================

This crash happens intermittently during page loading with dom.ipc.plugins.asyncInit set to true. A plugin is not being initialized in this stack, but I've only seen this crash happen in my profiles that have asyncInit enabled. Crash occurs both with e10s and non-e10s.

Maybe one of the plugin experts could help interpret this stack?

Comment 1

[Vladan Djeric (:vladan)]

25 crashes in Nightly since January 1st

https://crash-stats.mozilla.com/signature/?date=%3E2015-01-01&version=38.0a1&signature=mozilla%3A%3Aplugins%3A%3APluginScriptableObjectParent%3A%3AGetPropertyHelper%28void*%2C+bool*%2C+bool*%2C+_NPVariant*%29&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

Are there any URLs that this occurs consistently with?

Comment 3

[Vladan Djeric (:vladan)]

(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #2)
> Are there any URLs that this occurs consistently with?

I can't reproduce it reliably but I've had this crash happen two more times today. All 3 times I had the Plugin Hang UI appear, I then clicked "Stop plugin" and then got the crash.

Comment 4

[(No longer employed by Mozilla) Aaron Klotz]

A call stack from the original hang that spawned the plugin hang ui would be very useful here.

Comment 5

[Vladan Djeric (:vladan)]

Ok i'll keep an eye out

Comment 6

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Better error checking

The initial hang is still important to investigate for this bug, but this is a speculative fix that might help with the crashing.

Comment 7

[(No longer employed by Mozilla) Aaron Klotz]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3f53cf53a34e

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3f53cf53a34e

Comment 9

[Vladan Djeric (:vladan)]

Attachment: hangStack.txt

I got another one of these hangs tonight. The Plugin Hang UI popped up, but then Firefox crashed before I could attach a debugger.

I was able to reproduce the hang a second time, and this time I captured this main-thread stack while the Plugin Hang UI was still active. Obviously, I can't be 100% sure this is the same hang.

When I resumed Firefox after a few minutes, it did not crash.

Comment 10

[Vladan Djeric (:vladan)]

Related crash signature?
https://crash-stats.mozilla.com/report/index/d5f0c7c7-27a3-4fdc-89c2-2a31c2150212

Comment 11

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Check for null actor

I compared a crash report from yesterdays build against the binaries of the build itself. Based upon the state of the registers in that crash dump I was able to deduce that the crash is due to a null actor, presumably due to plugin-container termination.

This patch is not speculative; it will definitely eliminate the crashes for this signature.

Comment 12

[(No longer employed by Mozilla) Aaron Klotz]

(In reply to Vladan Djeric (:vladan) -- please needinfo! from comment #10)
> Related crash signature?
> https://crash-stats.mozilla.com/report/index/d5f0c7c7-27a3-4fdc-89c2-
> 2a31c2150212

That looks like a content bug. There's a null pointer to the nsPluginInstanceOwner object. Please file separately.

Comment 13

[(No longer employed by Mozilla) Aaron Klotz]

Flagging checkin-needed for patch https://bugzilla.mozilla.org/attachment.cgi?id=8563739

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e63c87f2adda

Comment 14

[(No longer employed by Mozilla) Aaron Klotz]

https://hg.mozilla.org/integration/mozilla-inbound/rev/edd04b167f47

Comment 15

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/edd04b167f47

Comment 16

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows zero crashes over the past 4 weeks.