1155241 - crash in nsPluginInstanceOwner::SetFrame(nsPluginFrame*)

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[(No longer employed by Mozilla) Aaron Klotz]

This bug was filed from the Socorro interface and is 
report bp-3512fd28-e6fc-4b6b-8194-28cc32150415.
=============================================================

nsObjectLoadingContent's pointer to the plugin owner is nullptr by the time the crash notification occurs. This can happen in async init if content stopped the plugin while init was still running asynchronously.

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Add nullptr check

It is now possible for the owner to be nullptr under async plugin init, so we need to add a check for that.

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

Thanks for the quick review!
try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=2677ec44adba

Comment 3

[(No longer employed by Mozilla) Aaron Klotz]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b944090e464d

Comment 4

[(No longer employed by Mozilla) Aaron Klotz]

Comment on attachment 8594944 [details] [diff] [review]
Add nullptr check

Approval Request Comment
[Feature/regressing bug #]: Async plugin init
[User impact if declined]: Instability. #2 topcrasher on aurora
[Describe test coverage new/current, TreeHerder]: Local, landing on m-c
[Risks and why]: None, trivial patch to eliminate nullptr dereference
[String/UUID change made/needed]: None

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b944090e464d

Comment 6

[Robert Kaiser]

[Tracking Requested - why for this release]:
This is 10% of all Dev Edition browser crashes right now.

Comment 7

[Lawrence Mandel [:lmandel] (use needinfo)]

Interestingly, I see this crash signature in 35+. However, the volume is much lower in releases prior to 39. Tracking 39+

Comment 8

[Lawrence Mandel [:lmandel] (use needinfo)]

Comment on attachment 8594944 [details] [diff] [review]
Add nullptr check

Given that this is a fix for plug-in async init, which can't be tested in Nightly, and that it is a simple fix, I'm approving for Aurora. Aurora+

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/678bcebcb8a5