334905 - nsObjectFrame::StopPlugin should not call plugin code during frame tree destruction

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I found a stack in talkback that shows the Java plugin calling back into Gecko in the middle of frame tree destruction, which may or may not be the cause of the crash.  That still seems to me like it shouldn't happen.  This means that we need to find some (earlier!?) time to stop plugins.

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: talkback incident

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is a known MRJ issue -- it spins the event loop from frame construction too, and we have bugs on that for sure.  We could try doing all plugin stuff async as much as we can, I suppose, but what we really need is to document what plugins are allowed to do inside which calls from Gecko.

Comment 3

[Steven Michaud [:smichaud] (Retired)]

The talkback log is pretty useless.

David, please attach a crashreporterd log for this crash (if you can).

Comment 4

[Steven Michaud [:smichaud] (Retired)]

There are several places where the Java Embedding Plugin needs to spin
the main thread's event loop:

https://bugzilla.mozilla.org/show_bug.cgi?id=324281#c6

Starting the JVM synchronously (as discussed at bug 309122) will allow
me to get rid of some of these, but not all of them.

As of JEP 0.9.5+c (which fixed bug 324281), I've managed to find a way
to stop PL_ProcessPendingEvents() from being re-entered.  But
apparently there are still some cases where Gecko can (in some sense)
be re-entered.  There's probably not anything I can do about this.

(The JEP's current version is 0.9.5+d.)

Comment 5

[Steven Michaud [:smichaud] (Retired)]

> Starting the JVM synchronously ...

This should (of course) be "Starting the JVM _asynchronously_ ..."

Comment 6

[John Schoenick [:johns]]

Does this still occur? Stopping plugins can still spin the event loop, but we've wallpapered over a lot of the issues that causes.

Comment 7

[Timothy Nikkel (:tnikkel)]

Yeah, probably not during frame destruction since we moved the widget handling stuff to content.