386253 - Crash [@ nsRefPtr<nsPACManCallback>::assign_assuming_AddRef] with flash testcase, toggling display and reloading

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Martijn Wargers (dead)]

Attachment: flash file needed for testcase

See upcoming testcase, which crashes current trunk builds after a few reloads (reloads automatically).
The contenteditable attributes are necessary for the crash to happen, so I guess this is a regression from bug 237964, somehow.

https://crash-reports.mozilla.com/reports/report/index/54bbdb91-25bf-11dc-8c21-001a4bd43ed6
0  	nsRefPtr<nsPACManCallback>::assign_assuming_AddRef(nsPACManCallback *)
1 	nsCOMPtr_base::assign_with_AddRef(nsISupports *)
2 	nsBaseWidget::RemoveChild(nsIWidget *)
3 	nsBaseWidget::Destroy()
4 	nsWindow::Destroy()
5 	nsPluginInstanceOwner::Destroy()
6 	DoStopPlugin
7 	nsStopPluginRunnable::Run()
8 	nsThread::ProcessNextEvent(int,int *)
9 	NS_ProcessNextEvent_P(nsIThread *,int)

(PACManCallback, what on earth is that?)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Jesse Ruderman]

WFM with Mac trunk debug.

Comment 3

[Peter Van der Beken [:peterv]]

I'll look into this, but see also bug 386302.

Comment 4

[Martijn Wargers (dead)]

Need to look if this is fixed in tomorrow's build after the backout from bug 347743.

Comment 5

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a6pre) Gecko/20070629 Minefield/3.0a6pre ID:2007062910

This WFM after bug 347743 was backed out

Comment 6

[Martijn Wargers (dead)]

Ok, thanks, marking fixed then.