312055 - [@ nsPresContext::GetContainerInternal]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[timeless]

Incident ID: 10512762
Stack Signature	nsPresContext::GetContainerInternal() ed52d7eb
Email Address	
Product ID	FirefoxTrunk
Build ID	2005101104
Trigger Time	2005-10-11 05:08:15.0
Platform	LinuxIntel
Operating System	Linux 2.6.14-rc4-g907a4261
Module	firefox-bin + (001ccf2f)
URL visited	http://www.ghcc.msfc.nasa.gov/GOES/ (running a java applet)
User Comments	See my addendum to bug #309986. I think this crash is related to
Boris's fix for that bug. I was running a java applet in one tab and I just
finished submitting my addendum to the bug report in a second tab and clicked on
"Back to bug#309986" when
Since Last Crash	0 sec
Total Uptime	0 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.
/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresContext.cpp,
line 208
Stack Trace 	
nsPresContext::GetContainerInternal() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresContext.cpp,
line 208]
nsPluginInstanceOwner::ShowStatus() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 336]
nsPluginInstanceOwner::ShowStatus() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 2307]
nsPluginInstancePeerImpl::ShowStatus() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/modules/plugin/base/src/nsPluginInstancePeer.cpp,
line 297]
libjavaplugin_oji.so + 0x20a0d (0xb4d15a0d)
libjavaplugin_oji.so + 0x1f00b (0xb4d1400b)
libjavaplugin_oji.so + 0x1eea7 (0xb4d13ea7)
libjavaplugin_oji.so + 0x19b34 (0xb4d0eb34)
handleRunnableEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/modules/oji/src/nsJVMManager.cpp,
line 305]
PL_HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/plevent.c,
line 689]
PL_ProcessPendingEvents() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/plevent.c,
line 623]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/nsEventQueue.cpp,
line 423]
event_processor_callback() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x476fd (0xb79696fd)
libglib-2.0.so.0 + 0x2315f (0xb794515f)
libglib-2.0.so.0 + 0x24152 (0xb7946152)
libglib-2.0.so.0 + 0x2448b (0xb794648b)
libglib-2.0.so.0 + 0x24a01 (0xb7946a01)
libgtk-x11-2.0.so.0 + 0x112833 (0xb7bdb833)
nsAppShell::Run() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 141]
nsAppStartup::Run() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 162]
XRE_main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 2291]
main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 62]
libc.so.6 + 0x150da (0xb747c0da)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Sounds like the plugin instance owner is calling methods on an already-destroyed
context.  It really shouldn't do that.

Why is it caching mContext anyway?  It has the frame (mOwner), so why not get
the prescontext from that?  Failing that, it should null out mContext when it
nulls out mOwner, right at
http://lxr.mozilla.org/seamonkey/source/layout/generic/nsObjectFrame.cpp#3688

Or am I missing something?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch for 1.8 branch if we need it

Comment 3

[Boris Zbarsky [:bzbarsky]]

Walter, is this happening on branch?  Or just trunk?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch for trunk

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk; please let me know if this is an issue on the branch.