1243309 - crash in nsTArray_Impl<T>::RemoveElementsAt | mozilla::dom::DeferredFinalizerImpl<T>::DeferredFinalize

Status: RESOLVED DUPLICATE of bug 1045992

(Core Graveyard :: Plug-ins, defect, P5)

Description

[Petruta Horea [:phorea], Desktop Test Engineering]

This bug was filed from the Socorro interface and is 
report bp-0ab02458-4f2f-4dec-aa79-9a3ca2160127.
=============================================================

I've installed Silverlight 5.1 under Ubuntu 15.04 64-bit using the steps from http://askubuntu.com/questions/668340/pipelight-silverlight-not-working-in-firefox.
Loading or re-loading pages with Silverlight content results in Firefox or plugin crashes. Samples:
http://silverlightgames.org/game/dr-popper/play/
http://silverlightgames.org/game/defend-stuff/play/
http://bubblemark.com/silverlight2.html

Comment 1

[Petruta Horea [:phorea], Desktop Test Engineering]

Setting the status-flags according to Socorro info: all systems are affected (Windows mainly), all Firefox versions. 

Many Socorro comments are mentioning Flash. 
I could only reproduce under Ubuntu while refreshing Silverlight webpages.

Comment 2

[Benjamin Smedberg]

Starting in Firefox 44 all plugins are forced out-of-process, so if this plugin crashes it won't take down all of Firefox, just the plugin.

Comment 3

[Vasilica Tamas, QA [:vtamas]]

I am still able to reproduce this issue on Firefox 46.0a2 (2016-02-17) and I encountered a Firefox crash, not a plugin crash:
- bp-cb145f60-773e-4aba-91c8-dd2ec2160218
- bp-4f422e43-0312-468e-b0d0-f357d2160218

So, this contradicts what is written above, in Comment 2.
Benjamin, any thoughts about this?

Comment 4

[Benjamin Smedberg]

I'm torn. This configuration does not matter at all: Silverlight in Linux!?

But it shouldn't be able to make Firefox crash. I cannot explain what's going on there, and with rr we might be able to figure this out without too much work.

Comment 5

[Andrew McCreight [:mccr8]]

There's a bunch of similar crashes in this code we've never been able to figure out (bug 1045992, bug 1162024, bug 997908) so it would be nice to have an instance of this that is reproducible.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsTArray_Impl<T>::RemoveElementsAt | mozilla::dom::DeferredFinalizerImpl<T>::DeferredFinalize':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 0 crash from 2016-06-06.
 - release (version 47): 0 crash from 2016-05-31.
 - esr     (version 45): 328 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           0          0          0          0          0          0          0
 - beta             0          0          0          0          0          0          0
 - release          0          0          0          0          0          0          0
 - esr             31         35         26         30         36         31         27

Affected platforms: Windows, Linux