1136961 - crash in nsNPAPIPluginInstance::GetValueFromPlugin(NPPVariable, void*)

Status: RESOLVED DUPLICATE of bug 883134

(Core :: DOM: Core & HTML, defect)

Description

[Mats Palmgren (:mats)]

This bug was filed from the Socorro interface and is 
report bp-f7adbb34-91bb-439b-a6a8-50d552150128.
=============================================================

This signature appears to be spiking in v36.
All crashes on Windows so far.

@0x8f068890
nsNPAPIPluginInstance::GetValueFromPlugin(NPPVariable, void*)
nsNPAPIPluginInstance::GetJSObject(JSContext*, JSObject**)
nsObjectLoadingContent::GetPluginJSObject(JSContext*, JS::Handle<JSObject*>, nsNPAPIPluginInstance*, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSObject*>)
nsObjectLoadingContent::SetupProtoChain(JSContext*, JS::Handle<JSObject*>)
mozilla::dom::HTMLObjectElement::WrapNode(JSContext*)
mozilla::dom::Element::WrapObject(JSContext*)
mozilla::dom::DocumentBinding::getElementById
js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)
Interpret
js::RunScript(JSContext*, js::RunState&)
js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)
js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&)
js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)
Interpret
js::RunScript(JSContext*, js::RunState&)
js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)
js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&)
js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)
js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>)
mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)
mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*)
mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)
mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*)
nsGlobalWindow::QueryInterface(nsID const&, void**)
nsGlobalChromeWindow::QueryInterface(nsID const&, void**)


More Reports:
https://crash-stats.mozilla.com/report/list?range_unit=days&range_value=28&signature=nsNPAPIPluginInstance%3A%3AGetValueFromPlugin(NPPVariable%2C+void*)

Comment 1

[u279076]

Current Volume:
* Firefox 36: 2219 crashes reported (#32 @ 0.32%)
* Firefox 37: 826 crashes reported (#43 @ 0.42%)
* Firefox 38: 5 crashes reported
* Firefox 39: 0 crashes reported

It's also worth noting that this is a startup crash. Unfortunately I don't have any leads on this.

Comment 2

[:dmajor]

This is a long-time crash associated with a Brazilian banking addon.

  nsNPAPIPluginInstance::Stop()|EXCEPTION_ACCESS_VIOLATION_EXEC (180 crashes)
     46% (83/180) vs.   1% (484/45918) {87F8774F-B485-47E2-A755-A40A8A5E886C}
     37% (67/180) vs.   1% (407/45918) {87F8774F-B485-47E2-A755-A40A8A5E886D}
     31% (56/180) vs.   1% (282/45918) {87F8774F-B485-47E2-A755-A40A8A5E8873}
     20% (36/180) vs.   0% (168/45918) {87F8774F-B485-47E2-A755-A40A8A5E8874}

(Those are from the v36 correlations file on the date of comment 0)