322414 - frequent random crashes [@ _PR_MD_ATOMIC_DECREMENT], especially with adblock

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[JConley]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Firefox/1.6a1

Have numerous random crashes in trunk /w nspr4.dll.
Disabled adblock and problem goes away.
Do not have this issue under 1.5, and only in the last week or so got these frequent crashes, so it may be a recent change in trunk.
I can't say this isn't a bug in adblock - but TB doesn't show any specifics about ablock, and the fact it works under 1.5 makes me think it's a FF Trunk bug.

See talkbacks:
TB13573007Q
TB13573055M
TB13573068X
TB13573092X
TB13577085X
TB13578656M
TB13581911Y
TB13582470M


Reproducible: Always

Steps to Reproduce:
This is the most reliable test - it's random, but can be done reliably.

1. Install adblock. Add filters for http://*.hitbox.com and /banner
(The standard plugins page has version v0.5.2.056 which has bugs with 1.5+ - shame on adblock team - it may well work on this test, but there are other devs that frequently fix issues and post intermediate updates faster than the adblock team, and I used this one most recently (0.5.2.056+):
http://aasted.org/adblock/viewtopic.php?t=2264&sid=a130b3ffc939289c13759b831a46fd8e
)

2. goto www.samsung.com
3. click products
4. click either printer, monitor, display, hard disks, and quickly shift+scroll-down to go back to previous page
5. keep repeating 4 quickly until it crashes


Actual Results:  
Complete crash.

Expected Results:  
No crash.

The crashes happen in other completely random and seemingly unreproducible places - and not solely during page render either. (ie. closing a tab)

Comment 1

[JConley]

note: The fast click/scrollback is only a way to make reproducing it more reliable. I have had this happen under browsing at normal speeds and no back/forth movement.

Comment 2

[Adam Guthrie]

Those IDs don't appear to have any symbols with them; they are worthless. Could you reinstall again and try to get some more?

Comment 3

[JConley]

Installed FF1.6a+adblock on a new VMWare WinXP install, and sorry to dissapoint, but the TB incidents look the same:
TB13592942E
TB13592959M

Comment 4

[JConley]

Found another place where this happens 100% without any back/forth clicking.
On myspace.com, select any profile and click 'view more pics', it will either crash there or when you click on a pic.
(Will likely require a full adblock filterlist instead of the 2 patterns listed above, but I'm sure filterset.g would suffice)
And no, talkbacks don't have any more symbols doing this test.

Comment 5

[JConley]

Strike that last test case comment. Seems it happens 100% on certain profiles, but not all profiles. The samsung test is probably the easiest to reproduce.

Comment 6

[Nickolay_Ponomarev]

(If you have time, you could also try to find out the regression window by trying to reproduce the bug using older trunk builds. That would help identifying the check-ins that could have caused the regression.)

Comment 7

[JConley]

Regression deduction:
Works in 2005-12-30-06-trunk
Fails in 2006-01-03-16-trunk

There are no win32 binary builds between these two. I believe win32 was broken over the new year. Not ideal, but hopefully this narrows it down enough.

Comment 8

[Brian Polidoro]

Looks like this could be a dupe of bug 322480.  I've seen this crash in one place  with adblock plus that disappears without it as well.  

Comment 9

[JConley]

Regarding 322480, yahoo mail beta crashes (for me) with Adblock disabled or enabled, and in safe-mode as well.
Also, the 322480 crashes don't appear to reference nspr4.dll

Comment 10

[Henrik Gemal]

yet another TB13633165Z

Comment 11

[:Gavin Sharp [email: [e-mail]]]

Attachment: stack

Running a debug build I get the following assertion:

###!!! ASSERTION: XPCWrappedNative::GetNewOrUsed called during GC: '!Scope->GetRuntime()->GetThreadRunningGC()', file C:/moz-debug/mozilla/js/src/xpconnect/src/xpcwrapped
native.cpp, line 217
Assertion failure: !rt->gcRunning, at C:/moz-debug/mozilla/js/src/jsgc.c:560

Comment 12

[Peter van der Woude [:Peter6]]

I only see this when I exit Firefox
Adblock 0.5.2.056 (no filterset-G, no regexp filters)

Comment 13

[Peter van der Woude [:Peter6]]

*** Bug 322504 has been marked as a duplicate of this bug. ***

Comment 14

[Brian Polidoro]

I used to a third party build to narrow the regression window:
WORKS: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060102 Firefox/1.6a1 (BlueFyre) ID:2006010213
CRASHES: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060103 Firefox/1.6a1 (BlueFyre) ID:2006010313

Tested with samsung and myspace.  Builds can be found here:
http://pryan.org/firefox/BlueFyre/
Sorry no talkbacks.

Comment 15

[gabe]

ok this is annoying i get it every 20 minutes 

Comment 16

[Boris Zbarsky [:bzbarsky]]

The checkins in the range from comment 14 are:

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20060102+08&maxdate=20060103+16&cvsroot=%2Fcvsroot


(I added a few hours on each side to be safe).

I'm not sure what in that range could be biting us... Bug 322045 perhaps?  I _am_ pretty confused by the stack from comment 11 -- that doesn't seem to be under js_GC...

brendan, Blake, any idea what could be up here?

Comment 17

[gabe]

well im uninstilling adblock TB13674679Z i have tons of ids if you want them

Comment 18

[gabe]

TB13683873X seems too occur without adblock but not as common

Comment 19

[u88484]

This isn't just with adblocker's, I've never had it installed and still get frequent crashes.

Comment 20

[JConley]

(In reply to comment #19)
> This isn't just with adblocker's, I've never had it installed and still get
> frequent crashes.
> 

Agree. Originally found with adblock and the testcase would pass with it disabled.
Have had reports without it before (comment #18), but no-one has found a consistently *reproducible* test case without it yet.
If you find one, please post.

Comment 21

[Henrik Gemal]

crashed a couple of times with this url:
http://www.tcmagazine.info/articles.php?action=show&showarticle=189

it seems to happens mostly on pages with banner ads

Comment 22

[Xavier Fung]

Crash with one government website of HK:
http://www.etwb.gov.hk

Browser crashes after loading the Flash animation, or click the language versions from that page when the animation is loading/running

TB13774820Y
TB13774839Y
TB13774879M
TB13774884M

Comment 23

[Brendan Eich [:brendan]]

No symbols for those four talkback links, which hurts.  Anyone else seeing this and able to generate talkback where the stack backtrace lists functions and line numbers, not just library names?

/be

Comment 24

[:Gavin Sharp [email: [e-mail]]]

Attachment: 2nd stack

I just crashed using adblock on samsung.com with the following stack. (I have it in a debugger, you can find me on IRC if needed).

Comment 25

[JConley]

With the new 20060111 build, TB is now producing symbols!
These are the Samsung test:
TB13827191G
TB13826490Y

One time I tried to run the Samsung test, the browser stalled for a long time, I finally had to close, and on close received this:
TB13826485Y

Also, bug 322480 seems to be magically fixed in this build, but I did get TB13827131X once out of 8 tries logging into Yahoo Mail Beta (same category as the top 2)

Hopefully this is the data we needed...

Comment 26

[Adam Guthrie]

Incident ID: 13827191
Stack Signature	_PR_MD_ATOMIC_DECREMENT c4772a20
Product ID	FirefoxTrunk
Build ID	2006011105
Trigger Time	2006-01-11 07:34:42.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	nspr4.dll + (00016899)
URL visited	
User Comments	samsung
Since Last Crash	110 sec
Total Uptime	1218 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/nsprpub/pr/src/md/windows/ntmisc.c, line 733
Stack Trace 	
_PR_MD_ATOMIC_DECREMENT  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/nsprpub/pr/src/md/windows/ntmisc.c, line 733]
js_GC  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1848]
js_ForceGC  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1510]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 27

[:Mook]

I've been seeing something like Gavin's stack in comment 24 - no adblock here, but I do have flashblock.

In a debug build, I'm hitting http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp&rev=1.12&mark=1359#1359 - and crashing right after.  In _releaseobject (frame 2), the npobj param is invalid (my debugger can't read it).

Still digging, hopefully this is at least somewhat helpful.

Comment 28

[Nickolay_Ponomarev]

*** Bug 323505 has been marked as a duplicate of this bug. ***

Comment 29

[Dave Thorp]

Worth noting that in Bug 323505 which is a dupe of this bug adblock was not installed. Managed to get 3 crashes off one site details of which are on the dupe bug

Comment 30

[Boris Zbarsky [:bzbarsky]]

Mook, do you hit that assert reproducibly with a debug build?  If so, with what steps to reproduce?

Comment 31

[Chris Lawson (gone)]

This looks a lot like the crasher in bug 305789, too. And like this bug, bug 305789 got much worse on 02 January 2006.

cl

Comment 32

[Chris Lawson (gone)]

Sorry about the fumbled assignment; bugzilla checked it for me and I didn't catch it until I had already hit committ. And sorry for the bugspam :-\

cl

Comment 33

[Boris Zbarsky [:bzbarsky]]

So at a guess, we're ending up in nsJSNPRuntime::OnPluginDestroy after the content is removed from the document and as we're destroying the frame.  This calls GetDocument() on the plugin instance owner when it's trying to get the JS context.  With the change for bug 322052, that will now return null, so we won't remove the now-dead stuff from the proto chain of our JSObject...

We should probably either revert the change to GetDocument, or use GetOwnerDoc here with a comment to sort it out for XBL2/sXBL....

Comment 34

[:Mook]

(Note: I have max_total_viewers set to 0 - this is probably important)

I can see the assertion by going to a page with flash and running the following JS (via the javascript: protocol)
e=document.embeds[0];void(0);

Tested with http://www.macromedia.com/ and http://www.ariacompany.net/

I just realized I have also been getting this warning:
WARNING: NS_ENSURE_TRUE(doc) failed, file m:/trunk/mozilla/modules/plugin/base/s
rc/nsJSNPRuntime.cpp, line 238
Not sure if that's part of the bug, since I hadn't been looking at warning before the crashes started.

Comment 35

[Ryan VanderMeulen [:RyanVM]]

Who should own this?

Comment 36

[Boris Zbarsky [:bzbarsky]]

biesi, do you think you can deal with this, or should I look into it?

Comment 37

[Christian :Biesinger (don't email me, ping me on IRC)]

I'll take this

Comment 38

[[e-mail]]

Note my comment #8 in bug 322052

Comment 39

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: patch

this should fix it then, per comment 33. This is somewhat larger than you'd think :) because it includes cleanup:
- remove unnecessary includes
- make the instance owner hold a (strong) ref to the content
  - necessary when plugins move to content
  - should be safe because the content node holds no kind of ref to this node
- removes unecessary sDefaultPluginDisabled

Comment 40

[Ryan VanderMeulen [:RyanVM]]

I applied this patch to my local source and got the following error when I tried to compile:

nsObjectFrame.cpp
Building deps for /cygdrive/d/mozilla/mozilla/layout/generic/nsObjectFrame.cpp
/cygdrive/d/mozilla/mozilla/build/cygwin-wrapper cl -FonsObjectFrame.obj -c  -DMOZILLA_INTERNAL_API -D_IMPL_NS_GFX -D_IMPL_NS_MSG_BASE -D_IMPL_NS_WIDGET  -DOSTYPE=\"WINNT5.1\" -DOSARCH=\"WINNT\" -DBUILD_ID=2006012720 -D_IMPL_NS_LAYOUT -I/cygdrive/d/mozilla/mozilla/layout/generic -I/cygdrive/d/mozilla/mozilla/layout/generic/../base -I/cygdrive/d/mozilla/mozilla/layout/generic/../tables -I/cygdrive/d/mozilla/mozilla/layout/generic/../xul/base/src -I/cygdrive/d/mozilla/mozilla/layout/generic/../../content/xul/content/src -I/cygdrive/d/mozilla/mozilla/layout/generic/../../content/base/src -I/cygdrive/d/mozilla/mozilla/layout/generic/../../content/html/content/src  -I../../dist/include/xpcom -I../../dist/include/string -I../../dist/include/dom -I../../dist/include/content -I../../dist/include/gfx -I../../dist/include/widget -I../../dist/include/locale -I../../dist/include/view -I../../dist/include/necko -I../../dist/include/js -I../../dist/include/caps -I../../dist/include/pref -I../../dist/include/htmlparser -I../../dist/include/webshell -I../../dist/include/plugin -I../../dist/include/docshell -I../../dist/include/uriloader -I../../dist/include/mimetype -I../../dist/include/webbrwsr -I../../dist/include/oji -I../../dist/include/unicharutil -I../../dist/include/lwbrk -I../../dist/include/imglib2 -I../../dist/include/accessibility -I../../dist/include/xpconnect -I../../dist/include/java -I../../dist/include/exthandler -I../../dist/include/intl -I../../dist/include/uconv -I../../dist/include/layout -I../../dist/include -I../../dist/include/nspr    -I../../dist/sdk/include       -TP -nologo -Zc:wchar_t- -W3 -Gy -FdnsObjectFrame.pdb  -DNDEBUG -DTRIMMED -Ox -GALS- -fp:fast -arch:SSE2 -MD            -DX_DISPLAY_MISSING=1 -DMOZILLA_VERSION=\"1.9a1\" -DMOZILLA_VERSION_U=1.9a1 -DHAVE_SNPRINTF=1 -D_WINDOWS=1 -D_WIN32=1 -DWIN32=1 -DXP_WIN=1 -DXP_WIN32=1 -DHW_THREADS=1 -DWINVER=0x400 -D_WIN32_WINNT=0x400 -DSTDC_HEADERS=1 -DWIN32_LEAN_AND_MEAN=1 -DNO_X11=1 -D_X86_=1 -DD_INO=d_ino -DMOZ_ENABLE_CANVAS=1 -DMOZ_DEFAULT_TOOLKIT=\"windows\" -DMOZ_PHOENIX=1 -DMOZ_BUILD_APP=browser -DMOZ_XUL_APP=1 -DMOZ_DISTRIBUTION_ID=\"org.mozilla\" -DOJI=1 -DIBMBIDI=1 -DMOZ_VIEW_SOURCE=1 -DACCESSIBILITY=1 -DMOZ_XPINSTALL=1 -DMOZ_JSLOADER=1 -DNS_PRINTING=1 -DNS_PRINT_PREVIEW=1 -DMOZ_XTF=1 -DMOZ_MATHML=1 -DMOZ_SVG=1 -DMOZ_SVG_RENDERER_CAIRO=1 -DMOZ_UPDATE_CHANNEL=default -DMOZ_LOGGING=1 -DMOZ_USER_DIR=\"Mozilla\" -DHAVE_UINT64_T=1 -DMOZ_XUL=1 -DMOZ_PROFILELOCKING=1 -DMOZ_MORK=1 -DMOZ_DLL_SUFFIX=\".dll\" -DJS_THREADSAFE=1 -DMOZILLA_LOCALE_VERSION=\"1.9a1\" -DMOZILLA_REGION_VERSION=\"1.9a1\" -DMOZILLA_SKIN_VERSION=\"1.8\"  -D_MOZILLA_CONFIG_H_ -DMOZILLA_CLIENT /cygdrive/d/mozilla/mozilla/layout/generic/nsObjectFrame.cpp
nsObjectFrame.cpp
d:/mozilla/mozilla/layout/generic/nsObjectFrame.cpp(3199) : error C2373: 'nsPluginInstanceOwner::Init' : redefinition; different type modifiers
        d:/mozilla/mozilla/layout/generic/nsObjectFrame.cpp(337) : see declaration of 'nsPluginInstanceOwner::Init'
make[5]: *** [nsObjectFrame.obj] Error 2
make[5]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/layout/generic'
make[4]: *** [libs] Error 2
make[4]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/layout'
make[3]: *** [libs_tier_9] Error 2
make[3]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make[2]: *** [tier_9] Error 2
make[2]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make[1]: *** [default] Error 2
make[1]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make: *** [build] Error 2

Comment 41

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: patch v1.1

oh right... thanks. this version should actually compile on windows.

Comment 42

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: patch v1.1, as diff -w

note: it would be great if someone could test this patch

Comment 43

[Ryan VanderMeulen [:RyanVM]]

Working on it ;) I've got a site which crashes 100% of the time on me, so I'll let you know as soon as the compile finishes.

Comment 44

[Christian :Biesinger (don't email me, ping me on IRC)]

awesome, thank you.

Comment 45

[Ryan VanderMeulen [:RyanVM]]

Getting this compile failure now:

nsAccessibilityService.cpp
d:\mozilla\mozilla\foxbuild\dist\include\xpcom\nsHashKeys.h(301) : warning C4996: 'strdup' was declared deprecated
        c:\Program Files\Microsoft Visual Studio 8\VC\INCLUDE\string.h(205) : see declaration of 'strdup'
        Message: 'The POSIX name for this item is deprecated. Instead, use the ISO C++ conformant name: _strdup. See online help for details.'
d:\mozilla\mozilla\foxbuild\dist\include\xpcom\nsHashKeys.h(302) : warning C4996: 'strdup' was declared deprecated
        c:\Program Files\Microsoft Visual Studio 8\VC\INCLUDE\string.h(205) : see declaration of 'strdup'
        Message: 'The POSIX name for this item is deprecated. Instead, use the ISO C++ conformant name: _strdup. See online help for details.'
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(113) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(118) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(144) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(148) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(1670) : errorC3861: 'do_GetInterface': identifier not found
make[6]: *** [nsAccessibilityService.obj] Error 2
make[6]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/accessible/src/base'
make[5]: *** [libs] Error 2
make[5]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/accessible/src'
make[4]: *** [libs] Error 2
make[4]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/accessible'
make[3]: *** [libs_tier_9] Error 2
make[3]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make[2]: *** [tier_9] Error 2
make[2]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make[1]: *** [default] Error 2
make[1]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make: *** [build] Error 2

Comment 46

[Ryan VanderMeulen [:RyanVM]]

On bz's advice, I added #include "nsServiceManagerUtils.h" to nsAccessibilityService.cpp. Unfortunately, I still get the same error when trying to compile.

Comment 47

[Boris Zbarsky [:bzbarsky]]

Er, that should have been

  #include "nsIInterfaceRequestorUtils.h"

Sorry... :(

Comment 48

[Ryan VanderMeulen [:RyanVM]]

nsAccessibilityService.cpp
d:\mozilla\mozilla\foxbuild\dist\include\xpcom\nsHashKeys.h(301) : warning C4996: 'strdup' was declared deprecated
        c:\Program Files\Microsoft Visual Studio 8\VC\INCLUDE\string.h(205) : see declaration of 'strdup'
        Message: 'The POSIX name for this item is deprecated. Instead, use the ISO C++ conformant name: _strdup. See online help for details.'
d:\mozilla\mozilla\foxbuild\dist\include\xpcom\nsHashKeys.h(302) : warning C4996: 'strdup' was declared deprecated
        c:\Program Files\Microsoft Visual Studio 8\VC\INCLUDE\string.h(205) : see declaration of 'strdup'
        Message: 'The POSIX name for this item is deprecated. Instead, use the ISO C++ conformant name: _strdup. See online help for details.'
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(114) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(119) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(145) : error C3861: 'do_GetService': identifier not found
d:/mozilla/mozilla/accessible/src/base/nsAccessibilityService.cpp(149) : error C3861: 'do_GetService': identifier not found
make[6]: *** [nsAccessibilityService.obj] Error 2
make[6]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/accessible/src/base'
make[5]: *** [libs] Error 2
make[5]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/accessible/src'
make[4]: *** [libs] Error 2
make[4]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild/accessible'
make[3]: *** [libs_tier_9] Error 2
make[3]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make[2]: *** [tier_9] Error 2
make[2]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make[1]: *** [default] Error 2
make[1]: Leaving directory `/cygdrive/d/mozilla/mozilla/foxbuild'
make: *** [build] Error 2

Comment 49

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: missing accessible/ part

sigh, when I wrote that part of the patch, I knew I'd forget to diff it.

Comment 50

[[e-mail]]

Looks like you nailed it!
I just compiled Camino trunk with these patches and it built successfully.

Using this test case I was not able to crash my build (five tries):
Open this site in a new tab, view the video and close the tab.
http://video.google.com/videoplay?docid=-5172983273677620146&q=Camino

The same testcase bring down yesterdays official Camino trunk build on first try.

Comment 51

[Ryan VanderMeulen [:RyanVM]]

Everything compiles perfectly now and I can also confirm that Firefox on WinXP also no longer crashes on sites which I could crash 100% on previously :-)

Nice job, biesi!

Comment 52

[Christian :Biesinger (don't email me, ping me on IRC)]

thanks for the testing. credit should go to boris though, who pointed out why this crashes :)

Comment 53

[Andrew Jerman]

I also found that if you go to ottawasenators.com and click the English link, this crash occurs nearly 100% of the time, even with Adblock disabled. I'm going to patch and compile right now to verify that it fixes it for me.

Comment 54

[Andrew Jerman]

Well, I've tried everything, patched up my latest trunk build, and get no difference. I'm still crashing on the site I noted above. However, I'm still new to this (building Firefox), so there is a chance I'm missing something or doing something wrong, so can some of the other people who claim this fixed their build check it out using the ottawasenators.com link? I just click the English link, and if it doesn't do it immediately, click back and click it again. It usually does it on the first time or two for me.

Comment 55

[Andrew Jerman]

Well, I take back what I said before. Like I said, I'm new to this, and apparently I missed something while trying to patch it. I cleaned it all up and started over fresh and the patch seems to have worked perfectly. Tested with all the sites I have had problems with and they're all working fine now. Sorry for the previous comments and thanks for the patch!

Comment 56

[Arkady Sherman]

Boris Zbarsky in the comment https://bugzilla.mozilla.org/show_bug.cgi?id=316012#c23 said that my bug with the incident ID TB14566755W is for here. 

Comment 57

[Arkady Sherman]

Another incident ID after mozilla crashed on www.rbc.ru is TB14582628Q.

Comment 58

[Peter van der Woude [:Peter6]]

(In reply to comment #57)
> Another incident ID after mozilla crashed on www.rbc.ru is TB14582628Q.
> 

Doesn't look like this bug Arkady
Both yours crashes are at nsObjectFrame::Instantiate

Comment 59

[Peter van der Woude [:Peter6]]

ok, i can dupe the http://www.rbc.ru/ crash easily with adblock 0.6.0.4 (even with filters disabled)
repro:
1. open url
2.click on a link
TB14603168X ,talkback is slow so I don't know what stack it has yet.
If needed i'll file a new bug for it

Comment 60

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 209959 [details] [diff] [review]
missing accessible/ part

>Index: accessible/src/base/nsAccessibilityService.cpp
>===================================================================
>-#include "nsPresContext.h"
....
>+#include "nsPresContext.h"

Why move that include?  Undo that change, please, unless it's really needed.

Comment 61

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 209933 [details] [diff] [review]
patch v1.1

>Index: nsObjectFrame.cpp
>+nsresult nsPluginDOMContextMenuListener::Init(nsIContent* aContent)
>+    nsCOMPtr<nsIDOMContextMenuListener> cxMenuListener;
>+    QueryInterface(NS_GET_IID(nsIDOMContextMenuListener), getter_AddRefs(cxMenuListener));
>+    if (cxMenuListener) {
>+      receiver->AddEventListener(NS_LITERAL_STRING("contextmenu"), cxMenuListener, PR_TRUE);

Why not replace all that with:

  receiver->AddEventListener(NS_LITERAL_STRING("contextmenu"), this, PR_TRUE);

?  Should work just as well, methinks.

>+nsresult nsPluginDOMContextMenuListener::Destroy(nsIContent* aContent)
>+    nsCOMPtr<nsIDOMContextMenuListener> cxMenuListener;
>+    QueryInterface(NS_GET_IID(nsIDOMContextMenuListener), getter_AddRefs(cxMenuListener));
>+    if (cxMenuListener) { 
>+      receiver->RemoveEventListener(NS_LITERAL_STRING("contextmenu"), cxMenuListener, PR_TRUE);

And similar here.

>-    else NS_ASSERTION(PR_FALSE, "plugin was not an event listener");
>+    else NS_ASSERTION(PR_FALSE, "Unable to remove event listener for plugin");

And that can go away.

>-  else NS_ASSERTION(PR_FALSE, "plugin had no content");
>+  else NS_ASSERTION(PR_FALSE, "plugin was not an event listener");

And that should be an NS_ERROR.  Or get removed altogether; failure to QI to nsIDOMEventTarget basically means OOM.

r+sr=bzbarsky with those nits picked.

Comment 62

[Christian :Biesinger (don't email me, ping me on IRC)]

I want to note that I just reindented that code. but ok, will fix.

Comment 63

[Christian :Biesinger (don't email me, ping me on IRC)]

(In reply to comment #60)
> Why move that include?  Undo that change, please, unless it's really needed.

Moving it makes the order match the comment above: "Alphabetically ordered"

Comment 64

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: patch for checkin

Comment 65

[Christian :Biesinger (don't email me, ping me on IRC)]

Checking in accessible/src/base/nsAccessibilityService.cpp;
/cvsroot/mozilla/accessible/src/base/nsAccessibilityService.cpp,v  <--  nsAccessibilityService.cpp
new revision: 1.163; previous revision: 1.162
done
Checking in layout/generic/nsObjectFrame.cpp;
/cvsroot/mozilla/layout/generic/nsObjectFrame.cpp,v  <--  nsObjectFrame.cpp
new revision: 1.545; previous revision: 1.544
done
Checking in layout/generic/nsObjectFrame.h;
/cvsroot/mozilla/layout/generic/nsObjectFrame.h,v  <--  nsObjectFrame.h
new revision: 1.55; previous revision: 1.54
done

Comment 66

[Jesse Ruderman]

*** Bug 326460 has been marked as a duplicate of this bug. ***

Comment 67

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060217 SeaMonkey/1.5a.

I used to hit this very frequently, haven't seen it at all.