Closed Bug 1158406 Opened 10 years ago Closed 9 years ago

Crash [@ OnWrapperDestroyed] with bad Flash URL

Categories

(Core Graveyard :: Plug-ins, defect)

defect
Not set
critical

Tracking

(firefox40 affected)

RESOLVED WORKSFORME
Tracking Status
firefox40 --- affected

People

(Reporter: jruderman, Unassigned)

Details

(4 keywords)

Crash Data

Attachments

(2 files)

Attached file testcase
== Debug with e10s off == ###!!! ASSERTION: expecting a spawned plugin: 'Not Reached', file dom/base/nsObjectLoadingContent.cpp, line 588 ###!!! ASSERTION: Got data for channel with no connected final listener: 'Not Reached', file dom/base/nsObjectLoadingContent.cpp, line 1193 Assertion failure: sCallbackRuntime, at dom/plugins/base/nsJSNPRuntime.cpp:353 (Once I got "Assertion failure: IsInPurpleBuffer()" but I couldn't repro that.) == Nightly with e10s off == Crash [@ OnWrapperDestroyed] https://crash-stats.mozilla.com/report/index/eec2e882-5014-4370-b7e4-1784d2150424 == Nightly with e10s on == Sad tab sometimes, upon reloading(?)
Attached file stack
Aaron: any idea how much trouble these assertions represent?
Group: dom-core-security
Crash Signature: [@ OnWrapperDestroyed ]
Flags: needinfo?(aklotz)
I cannot reproduce these on debug builds of 43 and 46.
Flags: needinfo?(aklotz)
Jesse, can you still reproduce these assertions? Thanks.
Flags: needinfo?(jruderman)
I'm going to mark this sec-high, as it sounds bad, but maybe it isn't still an issue. I'm just waiting on Jesse to try to reproduce this.
Keywords: sec-high
I couldn't reproduce the crash either. I attempted to open the poc attached in comment #0 in the following builds using both e10s enabled/disabled: (builds were built using --enable-debug) * m-c fx49.0a1 buildID: 20160427113439 changeset: ab0044bfa1df - couldn't reproduce * m-a fx48.0a2 buildID: 20160427143641 changeset: d6d1b8b21016 - couldn't reproduce * m-b fx47.0b2 buildID: 20160427150518 changeset: 8c546512c771 - couldn't reproduce * m-r fx46.0.1 buildID: 20160427153125 changeset: e7ba7fb7f6f1 - couldn't reproduce Jesse, is this still an issue? As per comment #4, can you still reproduce this?
I can't reproduce, and no assertions in a debug build. I think this got fixed as part of another refactoring that landed. I'm going to resolve this and open it.
Group: dom-core-security
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(jruderman)
Resolution: --- → WORKSFORME
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: