1182917 - crash in nsRefPtr<T>::assign_with_AddRef(mozilla::dom::Blob*) | nsBaseWidget::AddChild(nsIWidget*)

Status: RESOLVED DUPLICATE of bug 1182919

(Core :: Widget, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-251fdd26-a328-4262-b746-c1be82150712.
=============================================================

This crash started happening on 7/11. It showed up on the list of explosive reports for Fx42. This seems to be a startup crash. There are many duplicates. It's happening mostly on Windows 7 and Windows 8.1 machines. The URLs associated with this crash seem to be video related, perhaps with Flash content. There are no comments in the reports so far. 

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsRefPtr%3CT%3E%3A%3Aassign_with_AddRef%28mozilla%3A%3Adom%3A%3ABlob%2A%29+%7C+nsBaseWidget%3A%3AAddChild%28nsIWidget%2A%29

0 	xul.dll 	nsRefPtr<mozilla::dom::Blob>::assign_with_AddRef(mozilla::dom::Blob*) 	xpcom/base/nsRefPtr.h
1 	xul.dll 	nsBaseWidget::AddChild(nsIWidget*) 	widget/nsBaseWidget.cpp
2 	xul.dll 	nsBaseWidget::BaseCreate(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsWidgetInitData*) 	widget/nsBaseWidget.cpp
3 	xul.dll 	mozilla::widget::PluginWidgetProxy::Create(nsIWidget*, void*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsWidgetInitData*) 	widget/PluginWidgetProxy.cpp
4 	xul.dll 	mozilla::dom::TabChild::CreatePluginWidget(nsIWidget*, nsIWidget**) 	dom/ipc/TabChild.cpp
5 	xul.dll 	nsPluginInstanceOwner::CreateWidget() 	dom/plugins/base/nsPluginInstanceOwner.cpp
6 	xul.dll 	nsPluginHost::CreateWidget(nsPluginInstanceOwner*) 	dom/plugins/base/nsPluginHost.cpp
7 	xul.dll 	nsPluginHost::InstantiatePluginInstance(nsACString_internal const&, nsIURI*, nsObjectLoadingContent*, nsPluginInstanceOwner**) 	dom/plugins/base/nsPluginHost.cpp
8 	xul.dll 	nsObjectLoadingContent::InstantiatePluginInstance(bool) 	dom/base/nsObjectLoadingContent.cpp
9 	xul.dll 	nsObjectLoadingContent::SyncStartPluginInstance() 	dom/base/nsObjectLoadingContent.cpp
10 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
11 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
12 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
13 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
14 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
15 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
16 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
17 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
18 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
19 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
20 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
21 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
22 	plugin-container.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp
23 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
24 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
25 	kernel32.dll 	BaseThreadInitThunk 	
26 	ntdll.dll 	RtlUserThreadStart 	
27 	kernel32.dll 	BasepReportFault 	
28 	kernel32.dll 	BasepReportFault

Comment 1

[juan becerra [:juanb]]

[Tracking Requested - why for this release]: Because this is a new explosive report, and it seems to be a startup crash. We probably need to keep an eye on this.

Comment 2

[juan becerra [:juanb]]

Just noticed this is crash in content. I'm not sure if it should be tracked in e10s, but I will request tracking, just in case.

Comment 3

[Robert Kaiser]

This as well as some other similar signatures - see top of https://crash-analysis.mozilla.com/rkaiser/2015-07-12/2015-07-12.firefox.42.explosiveness.html - are probably all the same cause and right now by far the largest stability issue on Nightly.

Comment 4

[Brad Lassey [:blassey] (use needinfo?)]

This looks to be entirely windows according to crash stats and is related to plugins. Bob, have you landed anything related to NPAPI sandboxing lately?

Comment 5

[Jim Mathies [:jimm]]

This appears to have started on the 11th, but I don't see any crashes in newer builds.

Comment 6

[Bob Owen (:bobowen)]

(In reply to Brad Lassey [:blassey] (use needinfo?) from comment #4)
> This looks to be entirely windows according to crash stats and is related to
> plugins. Bob, have you landed anything related to NPAPI sandboxing lately?

No ... sadly I haven't landed anything for NPAPI for a couple or more weeks. :-(

Comment 7

[Jim Mathies [:jimm]]

Robert what do we usually do with bugs like this? I'm not sure what the offending landing was, but apparently it was backed out. Can we just close this bug and its friends WFM?

Comment 8

[Robert Kaiser]

(In reply to Jim Mathies [:jimm] from comment #7)
> Robert what do we usually do with bugs like this? I'm not sure what the
> offending landing was, but apparently it was backed out. Can we just close
> this bug and its friends WFM?

I don't think it has been backed out. And we have another bug tracking all this. It even made its way to Dev Edition now. I just hope we did not land this on Beta, as it's *really* bad.

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

No need to track this bug here for 42. It is already tracked in bug 1182921.

Comment 11

[Kate Glazko]

Untracking as already tracked in bug 1182919, and changing status to reflect bug 1182919. Feel free to re-set tracking flags if anything changes.