189457 - Plugin Hangs in NPP_Destroy method of plugin

Status: VERIFIED INVALID

(Core Graveyard :: Plug-ins, defect, P2)

Description

[kdekorte]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3; Linux)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2) Gecko/20021202

I have written a custom plugin. You can get the source at  
http://mplayerplug-in.sourceforge.net/  
  
The plugin works perfectly, if you select a video, it will play using the  
plugin. If you close mozilla and reopen you can play another video. But if you  
don't close Mozilla and select another video Mozilla will hang. Sometimes  
using 100% cpu sometimes not. I see this problem in Mozilla 1.2.1, Netscape  
4.x, Phoenix 0.50, but NOT in Konqueror. The problem seems to occur either  
right before or right after Mozilla calls NPP_Destory in my plugin when 
dealing with the mode NP_EMBED.  
  
Bug could be related to other bugs 148829, 178494 and 175588  
  
Machine info:  
  
RedHat 8.0  
Mozilla downloaded from mozilla.org as an RPM   
mozilla-1.2.1-0_rh8_xft.i386.rpm  
mozilla-chat-1.2.1-0_rh8_xft.i386.rpm  
mozilla-devel-1.2.1-0_rh8_xft.i386.rpm  
mozilla-dom-inspector-1.2.1-0_rh8_xft.i386.rpm  
mozilla-js-debugger-1.2.1-0_rh8_xft.i386.rpm  
mozilla-mail-1.2.1-0_rh8_xft.i386.rpm  
mozilla-nspr-1.2.1-0_rh8_xft.i386.rpm  
mozilla-nspr-devel-1.2.1-0_rh8_xft.i386.rpm  
mozilla-nss-1.2.1-0_rh8_xft.i386.rpm  
mozilla-nss-devel-1.2.1-0_rh8_xft.i386.rpm  
mozilla-psm-1.2.1-0_rh8_xft.i386.rpm  
  
Plugin compiled with   
  
gcc -v  
Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/3.2/specs  
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man  
--infodir=/usr/share/info --enable-shared --enable-threads=posix  
--disable-checking --host=i386-redhat-linux --with-system-zlib  
--enable-__cxa_atexit  
Thread model: posix  
gcc version 3.2 20020903 (Red Hat Linux 8.0 3.2-7)  
  
  
Debug info  
  
Note: in this example PID 4558 is the root mozilla-bin process  
  
Program received signal SIGSEGV, Segmentation fault.  
[Switching to Thread 8192 (LWP 4558)]     
0x089abf7e in ?? ()  
  
(gdb) bt  
#0  0x089abf7e in ?? ()  
#1  0x414da5e1 in imgRequestProxy::GetImage ()  
   from /usr/lib/mozilla-1.2.1/components/libimglib2.so  
#2  0x41b4246f in nsImageFrame::GetDesiredSize ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#3  0x41b42afc in nsImageFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#4  0x41b50037 in nsLineLayout::ReflowFrame ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#5  0x41b4c4e4 in nsInlineFrame::ReflowInlineFrame ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#6  0x41b4c18b in nsInlineFrame::ReflowFrames ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#7  0x41b4bff8 in nsInlineFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#8  0x41b50037 in nsLineLayout::ReflowFrame ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#9  0x41b1e638 in nsBlockFrame::ReflowInlineFrame ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#10 0x41b1e402 in nsBlockFrame::DoReflowInlineFrames ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#11 0x41b1e1e7 in nsBlockFrame::DoReflowInlineFramesAuto ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#12 0x41b1e095 in nsBlockFrame::ReflowInlineFrames ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#13 0x41b1c9b1 in nsBlockFrame::ReflowLine ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#14 0x41b1c101 in nsBlockFrame::ReflowDirtyLines ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#15 0x41b1ac04 in nsBlockFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#16 0x41b22c08 in nsBlockReflowContext::ReflowBlock ()  
---Type <return> to continue, or q <return> to quit---  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#17 0x41b1da2b in nsBlockFrame::ReflowBlockFrame ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#18 0x41b1c60f in nsBlockFrame::ReflowLine ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#19 0x41b1c101 in nsBlockFrame::ReflowDirtyLines ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#20 0x41b1ac04 in nsBlockFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#21 0x41b22c08 in nsBlockReflowContext::ReflowBlock ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#22 0x41b1da2b in nsBlockFrame::ReflowBlockFrame ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#23 0x41b1c60f in nsBlockFrame::ReflowLine ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#24 0x41b1c101 in nsBlockFrame::ReflowDirtyLines ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#25 0x41b1ac04 in nsBlockFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#26 0x41b292d4 in nsContainerFrame::ReflowChild ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#27 0x41b3c503 in CanvasFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#28 0x41c0e0ef in nsBoxToBlockAdaptor::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#29 0x41c0db60 in nsBoxToBlockAdaptor::DoLayout ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#30 0x41c0ab91 in nsBox::Layout ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#31 0x41c004b7 in nsScrollBoxFrame::DoLayout ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#32 0x41c0ab91 in nsBox::Layout ()  
---Type <return> to continue, or q <return> to quit---  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#33 0x41c0fed8 in nsContainerBox::LayoutChildAt ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#34 0x41b38c64 in nsGfxScrollFrameInner::LayoutBox ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#35 0x41b38f45 in nsGfxScrollFrameInner::Layout ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#36 0x41b38cab in nsGfxScrollFrame::DoLayout ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#37 0x41c0ab91 in nsBox::Layout ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#38 0x41c1d413 in nsBoxFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#39 0x41b381d7 in nsGfxScrollFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#40 0x41b292d4 in nsContainerFrame::ReflowChild ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#41 0x41b8559a in ViewportFrame::Reflow ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#42 0x41b62305 in IncrementalReflow::Dispatch ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#43 0x41b6e996 in PresShell::ProcessReflowCommands ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#44 0x41b6e4db in HandlePLEvent ()  
   from /usr/lib/mozilla-1.2.1/components/libgklayout.so  
#45 0x401870ff in PL_HandleEvent () from /usr/lib/libxpcom.so  
#46 0x4018700d in PL_ProcessPendingEvents () from /usr/lib/libxpcom.so  
#47 0x401880e7 in nsEventQueueImpl::ProcessPendingEvents ()  
   from /usr/lib/libxpcom.so  
#48 0x40c55e76 in event_processor_callback ()  
   from /usr/lib/mozilla-1.2.1/components/libwidget_gtk.so  
#49 0x40c55bc5 in our_gdk_io_invoke ()  
---Type <return> to continue, or q <return> to quit---  
   from /usr/lib/mozilla-1.2.1/components/libwidget_gtk.so  
#50 0x403e3076 in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0  
#51 0x403e497e in g_main_dispatch () from /usr/lib/libglib-1.2.so.0  
#52 0x403e4e59 in g_main_iterate () from /usr/lib/libglib-1.2.so.0  
#53 0x403e50f4 in g_main_run () from /usr/lib/libglib-1.2.so.0  
#54 0x402e46df in gtk_main () from /usr/lib/libgtk-1.2.so.0  
#55 0x40c562be in nsAppShell::Run ()  
   from /usr/lib/mozilla-1.2.1/components/libwidget_gtk.so  
#56 0x40c3b122 in nsAppShellService::Run ()  
   from /usr/lib/mozilla-1.2.1/components/libnsappshell.so  
#57 0x0805308f in main1 ()  
#58 0x08053995 in main ()  
#59 0x420158d4 in __libc_start_main () from /lib/i686/libc.so.6  
  
  
  
  

Reproducible: Always

Steps to Reproduce:
1.open page with embedded video  
2.watch part of video  
3.select a different video, repeat step 1 
Actual Results:  
Mozilla will hang after 2nd or 3rd selected video 

Expected Results:  
Mozilla should not hang 

If I replace the call in the plugin to spawn some other app other than mplayer  
(gedit for example) the results are the same. So it does not appear to be app  
specific.  
  
I have also tried capturing the window destory event for the child window and  
it never seems to get to me.   
 
If there is a work around or a recommended proceedure that I am not doing 
please let me know. I have been struggling with this issue for days.  
 
Also, the problem only seems to occur when the plugin recieves a link of type 
NP_EMBED of I get a NP_FULL I have no problems at all.

Comment 1

[Peter Lubczynski]

can you attach a plugin log?

set NSPR_LOG_MODULES=Plugin:8,PluginNPN:8,PluginNPP:8
set NSPR_LOG_FILE=/tmp/plugin.log

Comment 2

[kdekorte]

Attachment: Requested plugin log

Here is the requested file

Comment 3

[kdekorte]

Also, I have captured the Window destroy event now, but it does not seem to help
much.

Comment 4

[kdekorte]

I took a look at another log I generated... and here are the main diffs

Section 1

8192[80896e0]: NPN_Status: npp=89df168, message=Done
8192[80896e0]: nsPluginStreamListenerPeer::OnDataAvailable this=8975e20
request=89409d8, offset=1086, length=2750,
url=http://a944.g.akamai.net/7/944/51/a814f5c0bdf5ef/www.apple.com/switch/ads/images/janieporche_ctp2.mov
8192[80896e0]: nsPluginStreamListenerPeer::OnStopRequest this=8975e20
aStatus=-2147467259 request=89409d8
8192[80896e0]: nsPluginStreamListenerPeer::dtor this=8975e20,
url=http://a944.g.akamai.net/7/944/51/a814f5c0bdf5ef/www.apple.com/switch/ads/images/janieporche_ctp2.mov
8192[80896e0]: NPN_MemFree: ptr=86b5548
8192[80896e0]: nsPluginHostImpl::StopPluginInstance called instance=89df150

End of log at the crash:
8192[80896e0]: NPN_Status: npp=86ef1d8, message=Done
8192[80896e0]: nsPluginStreamListenerPeer::OnDataAvailable this=86bcc58
request=8a425e0, offset=1111, length=2750,
url=http://a1392.g.akamai.net/7/1392/51/03ec2621e43100/www.apple.com/switch/ads/images/tonyhawk_ctp2.mov
8192[80896e0]: nsPluginStreamListenerPeer::OnStopRequest this=86bcc58
aStatus=-2147467259 request=8a425e0
8192[80896e0]: nsPluginStreamListenerPeer::dtor this=86bcc58,
url=http://a1392.g.akamai.net/7/1392/51/03ec2621e43100/www.apple.com/switch/ads/images/tonyhawk_ctp2.mov


Notice that the NPN_Memfree is missing from the end of the log?
Perhaps that is where the code is crashing?

Comment 5

[kdekorte]

Problem turned out to be a pointer error in the plugin, that only showed up
after 2 or 3 runs...

Comment 6

[Olivier Cahagne]

.

Comment 7

[Olivier Cahagne]

Marking INVALID as no specific patch fixed this bug and it wasn't a mozilla bug
anyway.

Comment 8

[Owen Marshall (Not reading bugmail)]

VERIFIED INVALID based upon reporters comments.