154023 - Crash when voting on espn.go.com [@ nsPluginInstanceOwner::Notify]

Status: VERIFIED FIXED

(Camino Graveyard :: Plug-ins, defect)

Description

[Winnie Lam]

06-24 build
OS 10.1.5

1.  Go to espn.go.com
2.  On the right side of screen, click on one of the radio buttons to vote.
3.  Click "Submit vote".

Application crashes.  Crash log to come.

Comment 1

[Winnie Lam]

Attachment: Crash log

Comment 2

[saari (gone)]

dupe of the plugin timer crash

Comment 3

[Chris Petersen]

Simply reloading the page results in a crash too. Form submission not required.

Comment 4

[Greg K.]

Confirmed using Chimera/20020625. Stack shows activity around
PluginInstanceOwner. Will attach.

Comment 5

[Greg K.]

Attachment: Crash report from Chimera/20020625 showing crash in nsPluginInstanceOwner::Notify

Comment 6

[saari (gone)]

Brian, looks like this is a reproducable crash on reload of ESPN

Comment 7

[Brian Ryner (not reading)]

Is this now fixed?

Comment 8

[Brian Nesse (gone)]

Yes. This should be fixed. Though difficult to verify. Last time I went to the
site, there was no vote...

Comment 9

[Winnie Lam]

Brian, I am using today's build (07-09-05).  Just went to espn.go.com, submitted
my vote (on the right hand side of the page) and chimera still crashed.

Reopening...

Comment 10

[Brian Nesse (gone)]

Hmm, so the coolest thing about this site appears to be that if you have cookies
disabled, you get colored bars instead of radio buttons and a submit button. ;)

After looking at this on win2k, I'd guess that the timer is firing during or
after the deletion of the applet. I need to do some additional testing.

Comment 11

[saari (gone)]

This works for me now... someone double check please

Comment 12

[Winnie Lam]

Just tried this again using the 07-16 build.  Went to espn.com, let the page
finish loading, hit reload, and the app crashed.  From what I can tell, the
stack is the same as the one I attached on 6-24.

Comment 13

[Brian Nesse (gone)]

*** Bug 157300 has been marked as a duplicate of this bug. ***

Comment 14

[Greg K.]

Encountered this again using Chimera/20020718 to access URL in bug 158244.

Comment 15

[Alexander Ranaldi]

This bug definitely still exists, just go to www.digitalexpressions.nu and it'll crash after 
clicking a link or two. Please fix soon, it drives me nuts ;) thanks. Chimera rocks!

Comment 16

[Winnie Lam]

*** Bug 159380 has been marked as a duplicate of this bug. ***

Comment 17

[Winnie Lam]

*** Bug 159721 has been marked as a duplicate of this bug. ***

Comment 18

[Winnie Lam]

*** Bug 159710 has been marked as a duplicate of this bug. ***

Comment 19

[Winnie Lam]

*** Bug 159922 has been marked as a duplicate of this bug. ***

Comment 20

[Winnie Lam]

*** Bug 160901 has been marked as a duplicate of this bug. ***

Comment 21

[Winnie Lam]

grrr... so many dupes.  really gotta fix this one.

Comment 22

[Winnie Lam]

*** Bug 161295 has been marked as a duplicate of this bug. ***

Comment 23

[Winnie Lam]

*** Bug 161350 has been marked as a duplicate of this bug. ***

Comment 24

[Winnie Lam]

*** Bug 161728 has been marked as a duplicate of this bug. ***

Comment 25

[Brian Nesse (gone)]

After a whole lot of debugging, printf's, and false leads, I think I'm on the
right track now. This, and probably many of the other plugin crashers as well,
appears to be releated to problems with the fCallbacks structure in the plugin.
This is a table of function pointers that the browser can call to tell the
plugin to do things (read, write, paint, etc.) Under mach-o, these CFM callbacks
need to be "wrapped" with some glue code. I believe this table is being
corrupted and/or not refreshed properly when plugins are load, unloaded, and
reloaded.

Comment 26

[Brian Nesse (gone)]

*** Bug 163574 has been marked as a duplicate of this bug. ***

Comment 27

[Greg K.]

*** Bug 163833 has been marked as a duplicate of this bug. ***

Comment 28

[Greg K.]

*** Bug 164418 has been marked as a duplicate of this bug. ***

Comment 29

[Brian Nesse (gone)]

*** Bug 165258 has been marked as a duplicate of this bug. ***

Comment 30

[Greg K.]

*** Bug 166079 has been marked as a duplicate of this bug. ***

Comment 31

[Claudius Gayle]

just as a me too, I'm seeing the same crash on 10.1.5 with 2002082705 and
2002090405 builds reliably and repeatedly by simply clicking(trying to click) a
link on the espn.com home page

Comment 32

[Greg K.]

*** Bug 166870 has been marked as a duplicate of this bug. ***

Comment 33

[Greg K.]

*** Bug 167348 has been marked as a duplicate of this bug. ***

Comment 34

[Greg K.]

*** Bug 167604 has been marked as a duplicate of this bug. ***

Comment 35

[Greg K.]

*** Bug 168163 has been marked as a duplicate of this bug. ***

Comment 36

[Brian Nesse (gone)]

*** Bug 166841 has been marked as a duplicate of this bug. ***

Comment 37

[Greg K.]

*** Bug 169541 has been marked as a duplicate of this bug. ***

Comment 38

[Greg K.]

*** Bug 170242 has been marked as a duplicate of this bug. ***

Comment 39

[Brian Nesse (gone)]

*** Bug 170819 has been marked as a duplicate of this bug. ***

Comment 40

[JC]

Attachment: Build(2002092504) Crash Log

Comment 41

[JC]

still experiencing this, seems more frequent with the more recent builds.  The
strange thing is that sometimes it's smooth even though I just click on the same
link that crashed a few seconds ago.

Comment 42

[Brian Nesse (gone)]

Ok, so not refcounting the plugin library is a bad idea... patch coming.

Comment 43

[Brian Nesse (gone)]

Attachment: Refcount (and remove debugging code

Comment 44

[Simon Fraser [no longer active]]

Comment on attachment 101320 [details] [diff] [review]
Refcount (and remove debugging code

r/sr=sfraser

Comment 45

[saari (gone)]

Nice catch.
Would this be affecting the current CFM builds too? 

Comment 46

[Brian Nesse (gone)]

No this bug only exists in the chimera tree.

Unfortunately, this patch appears to cause the component manager to shutdown
prematurely.

In NS_ShutdownXPCOM the call to:
  nsComponentManagerImpl::gComponentManager->FreeServices();
causes the last nsComponentManagerImpl reference to be released, which
unfortunately looks like it is supposed to happen about 11 lines later at the
  rv = (nsComponentManagerImpl::gComponentManager)->Shutdown();
call. This causes a second call to Shutdown which throws an assertion because it
has already been shutdown. This seems to imply that we are not holding enough
references to the component manager.

Comment 47

[[e-mail]]

I am experiencing a crash that also contains
nsPluginInstanceOwner::Notify(nsITimer*), and might be related.  I ran into the
crash on Build ID: 2002100204.  I opened www.exploitationnow.com, which is a
"keenspot" comic in a Tab.  I switched to that tab, began scrolling down the
page using the scroll wheel and Navigator crashed.  I will attach the new crash.log.

Comment 48

[[e-mail]]

Attachment: related crash.log

See comments by Paul Pichardo in the bug.

Comment 49

[Brian Nesse (gone)]

I verified that I was wrong about the component manager problem. This exists
without my patch as well. I will open a new bug with my findings. Patch checked in.

Comment 50

[Chris Petersen]

Using the 2002-10-10-14, I can no longer crash Chimera by either submitting a
form or reloading the page. Shouldn't this bug be closed out  ?

Comment 51

[Brian Nesse (gone)]

Chris, I closed it on 10/2. Verifying based on your comments.