1428515 - Intermittent dom/plugins/test/mochitest/test_npruntime_identifiers.html | application crashed [@ JS::ExposeObjectToActiveJS]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect, P5)

Description

[Treeherder Bug Filer]

Filed by: aiakab [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=154500293&repo=mozilla-central

https://queue.taskcluster.net/v1/task/OFts-8rzQXiq_EW7r5eSJg/runs/0/artifacts/public/logs/live_backing.log

Comment 1

[Intermittent Failures Robot]

4 failures in 462 pushes (0.009 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 2
* mozilla-inbound: 1
* mozilla-central: 1

Platform breakdown:
* windows7-32: 4

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1428515&startday=2018-01-01&endday=2018-01-07&tree=all

Comment 2

[Jon Coppeard (:jonco)]

nsJSNPRuntime::OnPluginDestroy() seems to be accessing an object that is about to be finalized.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1428515-plugin-wrappers

This was caused by the incremental finalisation of foreground finalised objects in bug 1352430.

The sNPObjWrappers table can contain entries for dead JSObjects that have not yet been finalised.  We need to take care not to trigger mJSObj's read barrier for such entries since that will attempt to expose the object to JS and cause this assertion.

The patch does this by calling unbarrieredGetPtr() which avoids the barrier.

Note converting a TenuredHeap to bool and testing equality against a pointer don't trigger the barrier.

Comment 4

[Andrew McCreight [:mccr8]]

It looks like this was previously filed as bug 1425751.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8941889 [details] [diff] [review]
bug1428515-plugin-wrappers

Most of comment 3 should be in the commit message here.

r=me with that.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d119babafa27
Check for dying JSObjects when accessing plugin wrapper table r=bz

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/d119babafa27

Comment 8

[Intermittent Failures Robot]

23 failures in 788 pushes (0.029 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 9
* mozilla-inbound: 7
* try: 3
* mozilla-central: 3
* oak: 1

Platform breakdown:
* windows7-32: 23

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1428515&startday=2018-01-08&endday=2018-01-14&tree=all

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Too late for 58, unfortunately.