318270 - Crashes apparently hastened by plugin? No outer window available!

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[[e-mail]]

When using that page, I get lots of "WARNING: No outer window available!, file C:/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1435", and occasional crashes.

Sample backtrace:
nsDocShell::GetInterface(nsDocShell * const 0x03d2c838, const nsID & {...}, void * * 0x0012e984) line 398 + 34 bytes
398        return mScriptGlobal->QueryInterface(aIID, aSink);
nsWebShell::GetInterface(nsWebShell * const 0x03d2c838, const nsID & {...}, void * * 0x0012e984) line 252
251   return nsDocShell::GetInterface(aIID, aInstancePtr);
nsGetInterface::operator()(void * * 0x0012e984) line 53 + 31 bytes
nsCOMPtr<nsIDOMWindow>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 1292 + 17 bytes
nsCOMPtr<nsIDOMWindow>::operator=(const nsCOMPtr_helper & {...}) line 781
nsWindowWatcher::GetWindowByName(nsWindowWatcher * const 0x00a38f38, const unsigned short * 0x01b49f20, nsIDOMWindow * 0x00000000, nsIDOMWindow * * 0x0012ea54) line 1140
1140    if (domWindow) {
nsPluginHostImpl::GetPrompt(nsIPluginInstanceOwner * 0x049f18b0, nsIPrompt * * 0x0012eca0) line 2832 + 100 bytes
2832      wwatch->GetWindowByName(NS_LITERAL_STRING("_content").get(), nsnull, getter_AddRefs(domWindow));
nsPluginHostImpl::HandleBadPlugin(nsPluginHostImpl * const 0x0272536c, PRLibrary * 0x00000000, nsIPluginInstance * 0x04a2e9d0) line 6254 + 73 bytes
6254  GetPrompt(owner, getter_AddRefs(prompt));
PluginWndProc(HWND__ * 0x001a01c8, unsigned int 513, unsigned int 1, long 1245700) line 340 + 213 bytes
USER32! 77d48734()
USER32! 77d48816()
USER32! 77d489cd()
USER32! 77d48a10()
nsAppShell::Run(nsAppShell * const 0x02559860) line 135
nsAppStartup::Run(nsAppStartup * const 0x025597b0) line 208
main1(int 4, char * * 0x002a2580, nsISupports * 0x009f4130) line 1248 + 32 bytes
main(int 4, char * * 0x002a2580) line 1737 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c816d4f()

Additional information:
WARNING: No outer window available!, file C:/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1435
WARNING: No outer window available!, file C:/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1435
WARNING: No outer window available!, file C:/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1435
###!!! ASSERTION: Unable to get an nsIScriptGlobalObjectOwner from the channel!: 'globalOwner', file C:/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line 136
WARNING: No outer window available!, file C:/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1435
###!!! ASSERTION: Unable to get an nsIScriptGlobalObjectOwner from the channel!: 'globalOwner', file C:/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line 136
###!!! ASSERTION: Plugin performed illegal operation: 'PR_FALSE', file C:/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp, line 6237

Comment 1

[Boris Zbarsky [:bzbarsky]]

> WARNING: No outer window available!, file
> C:/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1435

Neil, what's the stack to that warning?  I can't seem to reproduce this, but I suspect that it's the key here...

Also, what build are you using?  Is it something that has the patches for bug 316794 in it?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Well, I can't reproduce this in a current Linux build, so this might be Windows-Flash-only...

Comment 3

[[e-mail]]

I can't wrap my head around the timezones, but my nsScriptSecuityManager.cpp was last updated 24 hours ago (i.e. not when I just pulled, but last night), and the .obj file is half an hour newer, so I think I had already pulled that patch.

I'll have to try to break on that warning tomorrow.

Comment 4

[Adam Guthrie]

*** Bug 318363 has been marked as a duplicate of this bug. ***

Comment 5

[[e-mail]]

This was the first for hit the breakpoint at the call to NSGlue::Warning, I then continued and got a second similar-looking stacktrace, I then continued again and crashed in nsFocusController::UpdateWWActiveWindow because mCurrentWindow wasn't pointing to a valid nsGlobalWindow (memory contained 0xbaadfood).

nsGlobalWindow::GetGlobalObjectOwner() line 1424 + 35 bytes
1424  FORWARD_TO_OUTER(GetGlobalObjectOwner, (), nsnull);
nsPluginHostImpl::NewPluginURLStream(nsPluginHostImpl * const 0x00f52928, const nsString & {...}, nsIPluginInstance * 0x03966a00, nsIPluginStreamListener * 0x03975e50, const char * 0x00000000, int 0, unsigned int 0, const char * 0x00000000, unsigned int 0) line 5722 + 17 bytes
5722          callbacks = do_QueryInterface(global->GetGlobalObjectOwner());
nsPluginHostImpl::GetURLWithHeaders(nsPluginHostImpl * const 0x00f52928, nsISupports * 0x03966a00, const char * 0x049e7700, const char * 0x00000000, nsIPluginStreamListener * 0x03975e50, const char * 0x00000000, const char * 0x00000000, int 0, unsigned int 0, const char * 0x00000000) line 2907 + 49 bytes
2906      rv = NewPluginURLStream(string, instance, streamListener, nsnull,
2907                              PR_FALSE, nsnull, getHeaders, getHeadersLength);
nsPluginHostImpl::GetURL(nsPluginHostImpl * const 0x00f52928, nsISupports * 0x03966a00, const char * 0x049e7700, const char * 0x00000000, nsIPluginStreamListener * 0x03975e50, const char * 0x00000000, const char * 0x00000000, int 0) line 2852
2850  return GetURLWithHeaders(pluginInst, url, target, streamListener,
2851                           altHost, referrer, forceJSEnabled, nsnull, nsnull);
MakeNew4xStreamInternal(_NPP * 0x03966a1c, const char * 0x049e7700, const char * 0x00000000, eNPPStreamTypeInternal eNPPStreamTypeInternal_Get, int 1, void * 0x00000029, unsigned long 0, const char * 0x00000000, unsigned char 0) line 935 + 50 bytes
935      if (NS_FAILED(pm->GetURL(inst, relativeURL, target, listener)))
_geturlnotify(_NPP * 0x03966a1c, const char * 0x049e7700, const char * 0x00000000, void * 0x00000029) line 981 + 31 bytes
979  return MakeNew4xStreamInternal (npp, relativeURL, target,
980                                  eNPPStreamTypeInternal_Get, PR_TRUE,
981                                  notifyData);
NPSWF32! 04517941()
NPSWF32! 044ff056()
NPSWF32! 04501314()
NPSWF32! 04501572()
NPSWF32! 045024b9()
NPSWF32! 04502932()

Comment 6

[Boris Zbarsky [:bzbarsky]]

Hmm... When you get that inner that has no outer, what does the document in it look like?

Comment 7

[Johnny Stenback (:jst)]

Attachment: Fix refcount problem in ns4xPluginInstance::GetDOMWindow().

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 204746 [details] [diff] [review]
Fix refcount problem in ns4xPluginInstance::GetDOMWindow().

Duh, wrong diff.

Comment 9

[Johnny Stenback (:jst)]

Attachment: Fix refcount problem in ns4xPluginInstance::GetDOMWindow().

Comment 10

[Johnny Stenback (:jst)]

Fix checked in.

Comment 11

[[e-mail]]

I certainly can't reproduce the crash anymore, but I'll let stephend verify it.

Comment 12

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED for me using SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051202 Mozilla/1.0, trunk.