395328 - Crash with tabbing and reloading, using plugin, onbeforecopy and contenteditable

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

(not really sure where this belongs into, I guess plugins might be a reasonable choice)

This regressed when bug 280959 landed, but I'm not sure if it's really the cause of the crash.

The testcase uses enhanced privileges, so you need to download it to your computer, use right-click "Save Link Target As..".
It usually crashes after a few reloads.
I also managed to crash 'by hand', but that takes some intensive tabbing and reloading, so the automated testcase is better.

I don't get a breakpad id, I just get an 'uncaught exception' message from windows.

I also had this crash testcase in a debug build, and there I see these assertions appearing right before the crash:
###!!! ASSERTION: Must not have an instance owner here: '!mInstanceOwner', file c:/mozilla-build/mozilla/layout/generic/nsObjectFrame.cpp, line 1379
###!!! ASSERTION: Must not have an instance owner here: '!mInstanceOwner', file c:/mozilla-build/mozilla/layout/generic/nsObjectFrame.cpp, line 1379
JavaScript error: , line 0: uncaught exception: [Exception... "Illegal operation on WrappedNative prototype object"  nsresult: "0x8057000c (NS_ERROR_XPC_BAD_OP_ON_WN_PROTO)"  location: "JS frame :: file:///C:/Documents%20and%20Settings/mw/Bureaublad/crashzone/unnnccauughht/crash1.htm :: onbeforecopy :: line 1"  data: no]

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

So we're reentering nsObjectLoadingContent::Instantiate.
Biesi, could we use mInstantiating to protect from that?
nsObjectLoadingContent::EnsureInstantiation doesn't keep mInstantiating PR_TRUE until Instantiate is called.

#0  0x007a1402 in __kernel_vsyscall ()
#1  0x01042266 in nanosleep () from /lib/libc.so.6
#2  0x0104208f in sleep () from /lib/libc.so.6
#3  0x005d54b8 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:149
#4  0x005efcf2 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:210
#5  <signal handler called>
#6  nsIFrame::GetAncestorWithView (this=0xb1a00680) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsFrame.cpp:3321
#7  0x01367ac1 in nsPluginInstanceOwner::Init (this=0x93bb990, aPresContext=0xb1c2d3b0, aFrame=0xb1a00680, aContent=0x9684898)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsObjectFrame.cpp:3857
#8  0x01367bd3 in nsObjectFrame::PrepareInstanceOwner (this=0xb1a00680)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsObjectFrame.cpp:1386
#9  0x01367c43 in nsObjectFrame::Instantiate (this=0xb1a00680, aMimeType=0x916de10 "application/x-shockwave-flash", aURI=0xb1ea94f8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsObjectFrame.cpp:1413
#10 0x015a16e3 in nsObjectLoadingContent::Instantiate (this=0x96848bc, aFrame=0xb1a006ac, aMIMEType=@0x96848f8, aURI=0xb1ea94f8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/base/src/nsObjectLoadingContent.cpp:1521
#11 0x015a1e58 in nsObjectLoadingContent::EnsureInstantiation (this=0x96848bc, aInstance=0xbfaa7d2c)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/base/src/nsObjectLoadingContent.cpp:668
#12 0x0183f258 in nsHTMLPluginObjElementSH::GetPluginInstance (this=0x93d1f20, wrapper=0x93cf3d8, _result=0xbfaa7d2c)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsDOMClassInfo.cpp:8511
#13 0x0184c6d4 in nsHTMLPluginObjElementSH::NewResolve (this=0x93d1f20, wrapper=0x93cf3d8, cx=0x8d97c98, obj=0x90c3dc0, id=137847196, flags=0, 
    objp=0xbfaa7e48, _retval=0xbfaa7e4c) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsDOMClassInfo.cpp:8981
#14 0x06ec685a in XPC_WN_Helper_NewResolve (cx=0x8d97c98, obj=0x90c3dc0, idval=137847196, flags=0, objp=0xbfaa7eac)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1079
#15 0x00f4899d in js_LookupPropertyWithFlags (cx=0x8d97c98, obj=<value optimized out>, id=<value optimized out>, flags=<value optimized out>, 
    objp=0xbfaa7f0c, propp=0xbfaa7f08) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsobj.c:3259
#16 0x00f48e37 in js_LookupProperty (cx=0x8d97c98, obj=0x90c3dc0, id=137847196, objp=0xbfaa7f0c, propp=0xbfaa7f08)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsobj.c:3163
#17 0x00f450db in js_FindProperty (cx=0x8d97c98, id=137847196, objp=0xbfaa8270, pobjp=0xbfaa826c, propp=0xbfaa824c)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsobj.c:3357
#18 0x00f35f49 in js_Interpret (cx=0x8d97c98, pc=0x93d0838 ";", result=0xbfaa831c)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:4171
#19 0x00f2b351 in js_Invoke (cx=0x8d97c98, argc=1, flags=2) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:1399
#20 0x00f3e66d in js_InternalInvoke (cx=0x8d97c98, obj=0x90c3dc0, fval=151796992, flags=0, argc=1, argv=0x93c5b98, rval=0xbfaa84a8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:1474
#21 0x00eee418 in JS_CallFunctionValue (cx=0x8d97c98, obj=0x90c3dc0, fval=151796992, argc=1, argv=0x93c5b98, rval=0xbfaa84a8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsapi.c:4940
#22 0x017ecccb in nsJSContext::CallEventHandler (this=0x8da1380, aTarget=0x9684898, aScope=0x8e14b60, aHandler=0x90c3d00, aargv=0x93e4e20, 
    arv=0xbfaa85c0) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsJSEnvironment.cpp:1842
#23 0x01860e66 in nsJSEventListener::HandleEvent (this=0x9682f48, aEvent=0x92727f8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/events/nsJSEventListener.cpp:224
#24 0x015ed50a in nsEventListenerManager::HandleEventSubType (this=0x93f58a8, aListenerStruct=0x926f560, aListener=0x9682f48, aDOMEvent=0x92727f8, 
    aCurrentTarget=0x9684898, aPhaseFlags=6) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventListenerManager.cpp:1096
#25 0x015ed9a5 in nsEventListenerManager::HandleEvent (this=0x93f58a8, aPresContext=0xb1c2d3b0, aEvent=0xbfaa8928, aDOMEvent=0xbfaa88d8, 
    aCurrentTarget=0x9684898, aFlags=6, aEventStatus=0xbfaa88dc)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventListenerManager.cpp:1210
#26 0x0161d32c in nsEventTargetChainItem::HandleEvent (this=0x93df008, aVisitor=@0xbfaa88d0, aFlags=6)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventDispatcher.cpp:206
#27 0x0161d453 in nsEventTargetChainItem::HandleEventTargetChain (this=0x93df1e8, aVisitor=@0xbfaa88d0, aFlags=6, aCallback=0x0)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventDispatcher.cpp:264
#28 0x0161e137 in nsEventDispatcher::Dispatch (aTarget=0x9684910, aPresContext=0xb1c2d3b0, aEvent=0xbfaa8928, aDOMEvent=0x0, aEventStatus=0xbfaa8950, 
---Type <return> to continue, or q <return> to quit---
    aCallback=0x0) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventDispatcher.cpp:479
#29 0x01886899 in nsPlaintextEditor::CanCopy (this=0xb1ea3540, aCanCopy=0xbfaa8c08)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp:1267
#30 0x018b0174 in nsCopyCommand::IsCommandEnabled (this=0x8b5cda0, aCommandName=0x8ca0a00 "cmd_copy", aCommandRefCon=0xb1ea3540, 
    outCmdEnabled=0xbfaa8c08) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/editor/libeditor/base/nsEditorCommands.cpp:309
#31 0x07984636 in nsControllerCommandTable::IsCommandEnabled (this=0x8b5a310, aCommandName=0x8ca0a00 "cmd_copy", aCommandRefCon=0xb1ea3540, 
    aResult=0xbfaa8c08) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/embedding/components/commandhandler/src/nsControllerCommandTable.cpp:138
#32 0x0797dcde in nsBaseCommandController::IsCommandEnabled (this=0xb3f24510, aCommand=0x8ca0a00 "cmd_copy", aResult=0xbfaa8c08)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp:138
#33 0x0086efb9 in NS_InvokeByIndex_P () at ../../../../dist/include/xpcom/nsISupportsImpl.h:205
#34 0x06eb7fea in XPCWrappedNative::CallMethod (ccx=@0xbfaa8d38, mode=XPCWrappedNative::CALL_METHOD)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2285
#35 0x06ec5d77 in XPC_WN_CallMethod (cx=0x88f5460, obj=0x8fdf0a0, argc=1, argv=0x93f3034, vp=0xbfaa8e80)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467
#36 0x00f2b2da in js_Invoke (cx=0x88f5460, argc=1, flags=0) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:1378
#37 0x00f35b09 in js_Interpret (cx=0x88f5460, pc=0x8ad2587 ":", result=0xbfaa92c8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:4111
#38 0x00f2b351 in js_Invoke (cx=0x88f5460, argc=1, flags=2) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:1399
#39 0x00f3e66d in js_InternalInvoke (cx=0x88f5460, obj=0x8e2f7e0, fval=149092384, flags=0, argc=1, argv=0x93f2ef8, rval=0xbfaa9454)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsinterp.c:1474
#40 0x00eee418 in JS_CallFunctionValue (cx=0x88f5460, obj=0x8e2f7e0, fval=149092384, argc=1, argv=0x93f2ef8, rval=0xbfaa9454)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/js/src/jsapi.c:4940
#41 0x017ecccb in nsJSContext::CallEventHandler (this=0x88f5420, aTarget=0x8a523f0, aScope=0x854d680, aHandler=0x8e2f820, aargv=0x93bef10, 
    arv=0xbfaa956c) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsJSEnvironment.cpp:1842
#42 0x01860e66 in nsJSEventListener::HandleEvent (this=0x8abfba0, aEvent=0x9272718)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/events/nsJSEventListener.cpp:224
#43 0x015ed50a in nsEventListenerManager::HandleEventSubType (this=0x8abfb70, aListenerStruct=0x8abfbc8, aListener=0x8abfba0, aDOMEvent=0x9272718, 
    aCurrentTarget=0x8a523f0, aPhaseFlags=6) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventListenerManager.cpp:1096
#44 0x015ed9a5 in nsEventListenerManager::HandleEvent (this=0x8abfb70, aPresContext=0x8945c30, aEvent=0xbfaa9970, aDOMEvent=0xbfaa9884, 
    aCurrentTarget=0x8a523f0, aFlags=6, aEventStatus=0xbfaa9888)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventListenerManager.cpp:1210
#45 0x0161d32c in nsEventTargetChainItem::HandleEvent (this=0x93def28, aVisitor=@0xbfaa987c, aFlags=6)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventDispatcher.cpp:206
#46 0x0161d453 in nsEventTargetChainItem::HandleEventTargetChain (this=0x93defe8, aVisitor=@0xbfaa987c, aFlags=6, aCallback=0x0)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventDispatcher.cpp:264
#47 0x0161e137 in nsEventDispatcher::Dispatch (aTarget=0x8a523f0, aPresContext=0x8945c30, aEvent=0xbfaa9970, aDOMEvent=0x0, aEventStatus=0xbfaa99d8, 
    aCallback=0x0) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/events/src/nsEventDispatcher.cpp:479
#48 0x017a7727 in nsXULCommandDispatcher::UpdateCommands (this=0x8325808, aEventName=@0xbfaa9a90)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/xul/document/src/nsXULCommandDispatcher.cpp:407
#49 0x01816668 in nsGlobalWindow::UpdateCommands (this=0x8d97aa8, anAction=@0xbfaa9a90)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsGlobalWindow.cpp:5276
#50 0x017f30e6 in nsFocusController::UpdateCommands (this=0x88f16c0)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsFocusController.cpp:236
#51 0x017f31bb in nsFocusController::SetSuppressFocus (this=0x88f16c0, aSuppressFocus=0, aReason=0x1b09688 "nsPresContext::EnsureVisible Suppression")
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/dom/src/base/nsFocusController.cpp:533
#52 0x012c064b in nsPresContext::EnsureVisible (this=0xb1c2d3b0, aUnsuppressFocus=1)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/base/nsPresContext.cpp:1441
#53 0x01366e51 in nsPluginInstanceOwner::Init (this=0x9685ac0, aPresContext=0xb1c2d3b0, aFrame=0xb1a00680, aContent=0x9684898)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsObjectFrame.cpp:3817
#54 0x01367bd3 in nsObjectFrame::PrepareInstanceOwner (this=0xb1a00680)
---Type <return> to continue, or q <return> to quit---
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsObjectFrame.cpp:1386
#55 0x01367c43 in nsObjectFrame::Instantiate (this=0xb1a00680, aMimeType=0x916de10 "application/x-shockwave-flash", aURI=0xb1ea94f8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/layout/generic/nsObjectFrame.cpp:1413
#56 0x015a16e3 in nsObjectLoadingContent::Instantiate (this=0x96848bc, aFrame=0xb1a006ac, aMIMEType=@0x93c528c, aURI=0xb1ea94f8)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/base/src/nsObjectLoadingContent.cpp:1521
#57 0x015a1fe9 in nsAsyncInstantiateEvent::Run (this=0x93c5278)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/content/base/src/nsObjectLoadingContent.cpp:147
#58 0x00858ca5 in nsThread::ProcessNextEvent (this=0x82edcd0, mayWait=1, result=0xbfaa9dd0)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/xpcom/threads/nsThread.cpp:490
#59 0x007ec3d1 in NS_ProcessNextEvent_P (thread=0xb7f08744, mayWait=1) at nsThreadUtils.cpp:227
#60 0x02c3bf0f in nsBaseAppShell::Run (this=0x87944f0)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
#61 0x06914112 in nsAppStartup::Run (this=0x87c6b88)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
#62 0x005e21e7 in XRE_main (argc=3, argv=0xbfaaa494, aAppData=0x82a99c0)
    at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/toolkit/xre/nsAppRunner.cpp:3069
#63 0x08048f5e in main (argc=3, argv=0x82a9830) at /media/sdb3/users/smaug/mozilla/mozilla_cvs/mozilla/browser/app/nsBrowserApp.cpp:153

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Biesi, any comments on this one?

Comment 3

[Martijn Wargers (dead)]

This is now worksforme, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007110103 Minefield/3.0a9pre