166713 - crash in [@ PluginViewerImpl::StartLoad] Trunk

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[serge (gone)]

here is some reports with comments
http://climate.mcom.com/reports/singleincidentinfo.cfm?dynamicBBID=9894802
    Email: [e-mail]
    URL: http://www.arcanatech.com
    Comments: Go to http://www.arcanatech.com Click on NCF-Framework. 
    Crashes all the time for me
http://climate.mcom.com/reports/singleincidentinfo.cfm?dynamicBBID=9894620
    Email: [e-mail]
    URL: forum.rackshack.net
http://climate.mcom.com/reports/singleincidentinfo.cfm?dynamicBBID=10196837
    Email: [e-mail]
    URL: www.google.de;www.telekom.de
    Comments: trying to open an Adobe Acrobat document with Acrobat Reader 5.0 -

Comment 1

[shrirang khanzode]

could not repro crash on http://www.arcanatech.com with 0823 branch on my NT. 
still trying...

Comment 2

[serge (gone)]

unfortunately I cannot reproduce the crash too,
but the disassembly code from TB reports shows we are dereferencing null ptr in
nsPluginViewer.cpp, line 343
EAX: 00000000 EBX: 60ec96b8 ECX: 0281d730 EDX: 0064fa24
Code Around the PC:
605100f0 8b08             mov     ecx,[eax] <== HERE eax == 0
605100f2 52               push    edx
605100f3 50               push    eax
so I did some debugging and figured out that if by some reason initialization of
mWindow fails here
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/modules/plugin/base/src/nsPluginViewer.cpp&rev=1.123&root=/cvsroot#531
nsDocShell::Embed()
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/docshell/base/nsDocShell.cpp&rev=1.468&root=/cvsroot#3940
does not check return code and eventually we'll hit up here
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/modules/plugin/base/src/nsPluginViewer.cpp&rev=1.123&root=/cvsroot#343
with mWindow == 0

Comment 3

[serge (gone)]

Attachment: patch v1

simple check for !mWindow & mNextStream = 0 to prevent possible crashes.

Comment 4

[av (gone)]

Comment on attachment 97864 [details] [diff] [review]
patch v1

r=av

Comment 5

[serge (gone)]

Patrick, could you sr=, please?

Comment 6

[greer]

serge / shrirang,
FWIW,
I just reproduced this one twice at the arcanatech.com site. Using 20020909
build on Win2K:
1) Goto the site.
2) click on the "Arcana Technologies" header
3) crash.

Comment 7

[shrirang khanzode]

Yes,Greer, I just tried the TRUNK and could easily reproduce this. Thx for the 
steps...the branch seemed fine tho, I could not crash the canditate build.

Comment 8

[shrirang khanzode]

no kidding, I was thinking this is a topcrash from the branch...which is not the 
case.

Comment 9

[greer]

No crashes currently on the branch, and only 2 in the N700 final (from Gecko1.0
branch). I'll put Trunk in the summary.

Comment 10

[greer]

crash -> critical

Comment 11

[Patrick C. Beard]

Comment on attachment 97864 [details] [diff] [review]
patch v1

sr=beard

Comment 12

[serge (gone)]

on the trunk
<--  nsPluginViewer.cpp
new revision: 1.126; previous revision: 1.125

thanks to all.

Comment 13

[serge (gone)]

*** Bug 168754 has been marked as a duplicate of this bug. ***

Comment 14

[shrirang khanzode]

does not crash on 0916 trunk build anymore. used greer's steps.