1253434 - crash in mozilla::plugins::PluginInstanceParent::UpdateScrollCapture

Status: VERIFIED FIXED

(Core :: Plug-ins, defect)

Description

[Jim Mathies [:jimm]]

This bug was filed from the Socorro interface and is 
report bp-ce152304-0c15-487d-bd8c-1205f2160303.
=============================================================

Comment 1

[Jim Mathies [:jimm]]

I ran into this today. Sometimes you can have a plugin that has a width or height > 0 with the other dim equal to zero. My check here didn't catch this condition causing execution to fall through to the image allocation code. The GetSourceSurfaceForSurface call would then fail causing a crash in the subsequent GetSize call on that result.

Comment 2

[Jim Mathies [:jimm]]

Attachment: MozReview Request: Bug 1253434 - Avoid trying to capture plugin windows that have a zero width or height and a positive value for the other dim. r?aklotz

Review commit: https://reviewboard.mozilla.org/r/38019/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/38019/

Comment 3

[Aaron Klotz [:aklotz]]

Comment on attachment 8726459 [details]
MozReview Request: Bug 1253434 - Avoid trying to capture plugin windows that have a zero width or height and a positive value for the other dim. r?aklotz

https://reviewboard.mozilla.org/r/38019/#review34561

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/788f3c251d57

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/788f3c251d57

Comment 6

[Benjamin Smedberg]

Did the related scroll-capture land for 46?

Comment 7

[Jim Mathies [:jimm]]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #6)
> Did the related scroll-capture land for 46?

Only 47 so far, I haven't flagged this work for uplift yet.

Comment 8

[Jim Mathies [:jimm]]

confirmed, only shows up in one build.

https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Aplugins%3A%3APluginInstanceParent%3A%3AUpdateScrollCapture#tab-table

Comment 9

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

Crash volume for signature 'mozilla::plugins::PluginInstanceParent::UpdateScrollCapture':
 - nightly (version 50): 0 crashes from 2016-06-06.
 - aurora  (version 49): 0 crashes from 2016-06-07.
 - beta    (version 48): 43 crashes from 2016-06-06.
 - release (version 47): 417 crashes from 2016-05-31.
 - esr     (version 45): 0 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       0       0       0
 - aurora        0       0       0       0       0       0       0
 - beta          7       6      10       4       4       4       5
 - release      32      49     180      35      29      30      39
 - esr           0       0       0       0       0       0       0

Affected platform: Windows