1279340 - PPluginSurfaceChild tries to send a delete message from PluginInstanceChild::ActorDestroy()

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[Andrew McCreight [:mccr8]]

This bug was filed from the Socorro interface and is 
report bp-46bd127f-056b-47f1-ae3b-1dc652160608.
=============================================================

Comment 1

[Andrew McCreight [:mccr8]]

PluginInstanceChild::ClearAllSurfaces() calls PPluginSurfaceChild::Send__delete__(), but I think it fails because we're already in some kind of shutdown or error state.

Comment 2

[Andrew McCreight [:mccr8]]

I see 195 crash reports with this signature.

Comment 3

[Benjamin Smedberg]

This should only be for the new async drawing mode which is in Flash betas but not Flash release. dvander?

Comment 4

[Andrew McCreight [:mccr8]]

72% of these crashes are with Flash version 21.0.0.242, which looks like the current version you can download. (Another 17% are on 21.0.0.213.)

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch

It looks like this predates direct drawing. We're trying to send a __delete__ message over IPDL, but sending anything after an ActorDestroy will trigger a MOZ_CRASH. I think we can just set these actors to null so PluginInstanceChild doesn't try to access them again.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/971c1ee26cad
Don't try to send PPluginSurface::__delete__ within ActorDestroy. (bug 1279340, r=bsmedberg)

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/971c1ee26cad

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozalloc_abort | NS_DebugBreak | mozilla::ipc::FatalError | mozilla::plugins::PPluginSurfaceChild::FatalError | mozilla::plugins::PPluginSurfaceChild::Write':
 - nightly (version 50): 202 crashes from 2016-06-06.
 - aurora  (version 49): 2565 crashes from 2016-06-07.
 - beta    (version 48): 10 crashes from 2016-06-06.
 - release (version 47): 0 crash from 2016-05-31.
 - esr     (version 45): 0 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          6          5         44         40         68         37
 - aurora         353        389        420        428        419        332         51
 - beta             0          5          2          0          1          0          0
 - release          0          0          0          0          0          0          0
 - esr              0          0          0          0          0          0          0

Affected platform: Windows