345351 - Mac crash [@0x... ns4xPluginInstance::HandleEvent()] on cbs websites

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[chris hofmann]

heard of consistant crashes on the cbs websites so looked at a few talkback queries.

This one shows crashes with cbs in the comments and is sorted by stack trace singature.

http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=comments&match=contains&searchfor=cbs&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=stack&rlimit=1000

One of the crashes the seems to show up consistently is a crash on Mac with a stack signature that looks something like this but there is a a lot of variation in the signatures since top of the stack at crash time moves around..

Stack Signature	 0x040dbd24 18cd2a07
Product ID	Firefox15
Build ID	2006042618
Trigger Time	2006-05-10 22:22:27.0
Platform	MacOSX
Operating System	Darwin 8.6.0
Module	
URL visited	http://www.cbs.com
User Comments	Trying to access "innertube" on cbs.com 2nd time it crashed.
Since Last Crash	45 sec
Total Uptime	447078 sec
Trigger Reason	SIGBUS: Bus Error: (signal 10)
Source File, Line No.	N/A
Stack Trace 	
0x040dbd24
0x040dbc38
0x050da95c
0x050d21d4
0x050dbd04
0x0536dd0c
0x05345cf8
0x053505d0
0x053ce448
0x053cb864
0x053b2bf0
0x053b2b38
0x053c40c8
0x053c4384
0x0531e5ec
0x050fc3a4
0x05077024
0x05053698
0x05056ccc
0x050531e8
0x050564e0
0x050d68d0
0x040ca9ec
0x040d294c
0x040c5500
ns4xPluginInstance::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp, line 1425]
nsPluginInstanceOwner::Notify()   nsTimerImpl::Fire()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 398]
handleTimerEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 462]
PL_HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/xpcom/threads/plevent.c, line 689]
PL_ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/xpcom/threads/plevent.c, line 623]
__CFRunLoopDoSources0()
__CFRunLoopRun()
CFRunLoopRunSpecific()
HIToolbox.225.0.0 + 0x8980 (0x9321d980)
HIToolbox.225.0.0 + 0xecf6c (0x93301f6c)
HIToolbox.225.0.0 + 0xecd20 (0x93301d20)
HIToolbox.225.0.0 + 0xecc80 (0x93301c80)
nsMacMessagePump::GetEvent()   nsMacMessagePump::DoMessagePump()   nsAppShell::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/widget/src/mac/nsAppShell.cpp, line 114]
nsAppStartup::Run()   XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Darwin_7.9.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2353]
_start()   start()

Comment 1

[Mark Mentovai]

Looks like I've got to get some fresh OS symbols onto hal.  In the mean time, if anyone can reproduce and provide a CrashReporter stack as an attachment (or just give some steps to reproduce consistently), it'd be a great help.  Without that, all I can see is that something's happening on a Gecko timer.

Comment 2

[Chris Lawson (gone)]

I just triggered this with trunk (can't trigger at all with Camino 1.0.x) and the crash log (which I'd be happy to attach if someone wants it) points right to bug 336061, at least for the Camino versions of this crash. Here's the relevant portion:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   libSystem.B.dylib              	0x90030f54 strstr + 52
1   ...alNetworks.RealPlayerPlugin 	0x10e80108 main + 24060
2   ...alNetworks.RealPlayerPlugin 	0x10e82044 main + 32056
3   ...alNetworks.RealPlayerPlugin 	0x10e7aad0 main + 1988
4   org.mozilla.camino             	0x006da718 ns4xPluginInstance::InitializePlugin(nsIPluginInstancePeer*) + 636
5   org.mozilla.camino             	0x006c959c nsPluginHostImpl::TrySetUpPluginInstance(char const*, nsIURI*, nsIPluginInstanceOwner*) + 1120
6   org.mozilla.camino             	0x006c9010 nsPluginHostImpl::SetUpPluginInstance(char const*, nsIURI*, nsIPluginInstanceOwner*) + 48
7   org.mozilla.camino             	0x006c81f8 nsPluginHostImpl::InstantiateEmbeddedPlugin(char const*, nsIURI*, nsIPluginInstanceOwner*) + 1600
8   org.mozilla.camino             	0x00561fac nsObjectFrame::InstantiatePlugin(nsIPluginHost*, char const*, nsIURI*) + 220
9   org.mozilla.camino             	0x00563144 nsObjectFrame::Instantiate(char const*, nsIURI*) + 180
10  org.mozilla.camino             	0x0069d00c nsObjectLoadingContent::Instantiate(nsACString_internal const&, nsIURI*) + 656
11  org.mozilla.camino             	0x0069a5f8 nsAsyncInstantiateEvent::Run() + 120
12  libxpcom_core.dylib            	0x2c048f8c nsThread::ProcessNextEvent(int, int*) + 280
13  libxpcom_core.dylib            	0x2c00a274 NS_ProcessPendingEvents_P(nsIThread*, unsigned) + 84
14  org.mozilla.camino             	0x0072d584 nsBaseAppShell::NativeEventCallback() + 80
15  org.mozilla.camino             	0x0070c930 nsAppShell::ProcessGeckoEvents() + 172
16  org.mozilla.camino             	0x0070cea4 non-virtual thunk [nv:-4] to nsAppShell::AfterProcessNextEvent(nsIThreadInternal*, unsigned) + 336
17  com.apple.Foundation           	0x9293c918 __NSFireMachPort + 276
18  com.apple.CoreFoundation       	0x907e9820 __CFMachPortPerform + 176
19  com.apple.CoreFoundation       	0x907e9734 __CFRunLoopDoSource1 + 152
20  com.apple.CoreFoundation       	0x907dbe4c __CFRunLoopRun + 1556
21  com.apple.CoreFoundation       	0x907db47c CFRunLoopRunSpecific + 268
22  com.apple.HIToolbox            	0x931eb740 RunCurrentEventLoopInMode + 264
23  com.apple.HIToolbox            	0x931eadd4 ReceiveNextEventCommon + 380
24  com.apple.HIToolbox            	0x931eac40 BlockUntilNextEventMatchingListInMode + 96
25  com.apple.AppKit               	0x936eeae4 _DPSNextEvent + 384
26  com.apple.AppKit               	0x936ee7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
27  JavaEmbeddingPlugin            	0x07f07000 0x7f05000 + 8192
28  com.apple.AppKit               	0x936eacec -[NSApplication run] + 472
29  com.apple.AppKit               	0x937db87c NSApplicationMain + 452
30  org.mozilla.camino             	0x00008cc8 start + 456
31  dyld                           	0x8fe01048 _dyld_start + 60

Comment 3

[Chris Lawson (gone)]

I can no longer repro the crash in comment 2 (Camino trunk) after giving general.useragent.locale a valid value (en-US).

Investigation continues, however.

Comment 4

[Chris Lawson (gone)]

I've been completely unable to crash the trunk nightly of Camino on Innertube, even after watching the entire series premiere of Jericho (which, incidentally, was fairly good) and playing around with the video player quite a bit.

Based on that Talkback query and a glance at a few of the reports, I'd say what we're seeing is really a bug in the RealPlayer plugin. Without a lot more information (like full crash logs from each incident), I'm not sure there's much more we can hope for here.

Comment 5

[Chris Lawson (gone)]

It occurs to me that a high percentage of people may not have realised Real released a silent update (build 422, still version 10.1; the old one was build 400) to fix bug 336211, and this bug may in fact be a dupe of that one.

cl

Comment 6

[Samuel Sidler (old account; do not CC)]

The crash people experience with Camino may very well be the old-version-of-RealPlayer crash. However, this crash also occurs in Firefox and that specific crash never occurred in Firefox.

Comment 7

[Chris Lawson (gone)]

(In reply to comment #6)
> The crash people experience with Camino may very well be the
> old-version-of-RealPlayer crash. However, this crash also occurs in Firefox and
> that specific crash never occurred in Firefox.

Actually, it did, and not just on the Mac. See comments 12-16 and comment 20 in bug 336211.

cl

Comment 8

[Kurt Weinschenker]

Attachment: Similar crashlog for further investigation

I have been getting random, but somewhat similar crashes to this one when I close tabs.  The maddening thing about this issue is that it seems random, and not consistent.

This crashlog is from Camino TRUNK nightly 2006102501 (v1.2+) running under Mac OS 10.3.9.  It seems to me some of the Camino-specific stuff in Thread 0 is similar to what's happening in the crashes under FF.  But I will leave that judgement to others after a bit more triage.

Comment 9

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Kurt's crash is probably bug 359488.

Comment 10

[Samuel Sidler (old account; do not CC)]

This crash no long appears in the topcrash list or in a search in Talkback for crashes using Firefox 2.0.0.x.