421030 - Crash in [@ nsIFrame::GetView()] refreshing Viewpoint demo page

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008030405 Minefield/3.0b5pre

Summary: Crash in [@ nsIFrame::GetView()] refreshing Viewpoint demo page

Steps to Reproduce:

1. Install the Viewpoint plugin from https://components.viewpoint.com/MTSInstallers/archive/vmp_full_installer.exe
2. Load http://salesdemo.viewpoint.com/vla/asset/demo/29_021951/index.html
3. Click Refresh

Actual Results:

Crash in nsIFrame::GetView

bp-01c97287-ea80-11dc-b9db-001a4bd43ef6

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I tried installing the plugin. I got this in about:plugins:

MetaStream 3 Plugin

    File name: npViewpoint.dll
    MetaStream 3 Plugin r4

MIME Type 	Description 	Suffixes 	Enabled
application/x-mtx 	MetaStream Plugin File 	mtx 	Yes

But the Viewpoint plugins on that page display as "missing plugin". What have I done wrong? 

Comment 2

[timeless]

Signature	nsIFrame::GetView()
UUID	01c97287-ea80-11dc-b9db-001a4bd43ef6
Time	2008-03-04 22:47:18-08:00
Uptime	0
Product	Firefox
Version	3.0b5pre
Build ID	2008030405
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 8
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x24
Comments	
Crashing Thread
Frame 	Signature 	Source
0 	nsIFrame::GetView() 	mozilla/layout/generic/nsFrame.cpp:3327
1 	nsPluginInstanceOwner::ForceRedraw() 	mozilla/layout/generic/nsObjectFrame.cpp:2190
2 	nsPluginInstancePeerImpl::ForceRedraw() 	mozilla/modules/plugin/base/src/nsPluginInstancePeer.cpp:897
3 	_forceredraw 	mozilla/modules/plugin/base/src/ns4xPlugin.cpp:1369
4 	npViewpoint.dll@0xcbbf 	
5 	npViewpoint.dll@0x2bff 	
6 	npViewpoint.dll@0x2d19 	
7 	SceneComponent.dll@0x2ee12 	
8 	SceneComponent.dll@0x6f5f 	
9 	SceneComponent.dll@0x2f3bf 	
10 	SceneComponent.dll@0x9d4e 	
11 	npViewpoint.dll@0x1b54 	
12 	InternalCallWinProc 	
13 	UserCallWinProcCheckWow 	
14 	DispatchMessageWorker 	
15 	DispatchMessageW 	
16 	nsAppShell::ProcessNextNativeEvent(int) 	mozilla/widget/src/windows/nsAppShell.cpp:148
17 	PR_IntervalNow 	mozilla/nsprpub/pr/src/misc/prinrval.c:77

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

So some of the stack is missing?

Comment 4

[timeless]

maybe, i wouldn't worry. I'm posting it because stacks will go away and i want it to be searchable. please note that as soon as you enter a module w/o symbols your ability to get reliable symbols for frames past it instantly approach zero. The PR_IntervalNow frame is almost certainly wrong, but not in a way that i'd worry.

for people curious about other crashers for today, this crash is actually on the main thread (so it's a relatively well behaved library).

Comment 5

[(not currently active) Ted Mielczarek]

I installed the plugin and loaded that page, but I just get a black square, and sometimes a compatibility notice banner at the top of the page.

Comment 7

[David Lawhon]

This bug is also reproducible on Mac OS X 10.4.11 (PPC), as indicated in my duplicate bug 425615. Therefore, the "Hardware" and "OS" listed in the bug should be changed to read "All".

Comment 8

[timeless]

roc, here's the *mac* crash (yes they call their plugin npViewpoint.dll on mac os(x) too... strange people), note that the frames are complete

Signature	nsIFrame::GetView() const
UUID	7facf745-fc94-11dc-98c0-001a4bd43ef6
Time	2008-03-27 23:59:05-07:00
Uptime	20
Product	Firefox
Version	3.0b5
Build ID	2008032619
OS	Mac OS X
OS Version	10.4.11 8S165
CPU	ppc
CPU Info	
Crash Reason	EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash Address	0x2d1f34cc
Comments	Went to www.democraticunderground.com; browser quit.
Crashing Thread
Frame 	Signature 	Source
0 	nsIFrame::GetView() const 	mozilla/layout/generic/nsFrame.cpp:3334
1 	nsPluginInstanceOwner::ForceRedraw() 	mozilla/layout/generic/nsObjectFrame.cpp:2356
2 	_forceredraw 	mozilla/modules/plugin/base/src/ns4xPlugin.cpp:1369
3 	npViewpoint.dll@0x9530 	
4 	npViewpoint.dll@0x3510 	
5 	npViewpoint.dll@0x366c 	
6 	CoreFoundation@0x3736c 	
7 	CoreFoundation@0x23ce4 	
8 	CoreFoundation@0x23298 	
9 	HIToolbox@0x8b1c 	
10 	HIToolbox@0x8128 	
11 	HIToolbox@0x801c 	
12 	AppKit@0x8870 	
13 	AppKit@0x8534 	
14 	nsAppShell::ProcessNextNativeEvent(int) 	mozilla/widget/src/cocoa/nsAppShell.mm:505
15 	nsBaseAppShell::DoProcessNextNativeEvent(int) 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:151
16 	nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int) 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:284
17 	nsAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int) 	mozilla/widget/src/cocoa/nsAppShell.mm:663
18 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:497
19 	NS_ProcessPendingEvents_P(nsIThread*, unsigned int) 	nsThreadUtils.cpp:180
20 	nsBaseAppShell::NativeEventCallback() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:121
21 	nsAppShell::ProcessGeckoEvents(void*) 	mozilla/widget/src/cocoa/nsAppShell.mm:306
22 	CoreFoundation@0x243a0 	
23 	CoreFoundation@0x23818 	
24 	CoreFoundation@0x23298 	
25 	HIToolbox@0x8b1c 	
26 	HIToolbox@0x8128 	
27 	HIToolbox@0x801c 	
28 	AppKit@0x8870 	
29 	AppKit@0x8534 	
30 	AppKit@0x4a78 	
31 	nsAppShell::Run() 	mozilla/widget/src/cocoa/nsAppShell.mm:595
32 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
33 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3154
34 	main 	mozilla/browser/app/nsBrowserApp.cpp:158
35 	start 	crt.c:272
36 	start 	

Comment 9

[timeless]

Attachment: everyone else looks before leaping

Comment 10

[David Lawhon]

Note that, on the Mac, you can prevent the plugin from loading by merely moving the alias to "npViewpoint.plugin" out of the "/Library/Internet Plug-Ins" folder, if you don't wish to uninstall all of the files installed by the plug-in. (That's also a quick way to see, once there's a patch, whether it works, without having to keep uninstalling and reinstalling the Viewpoint package.)

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 312230 [details] [diff] [review]
everyone else looks before leaping

does this actually fix it?

Comment 12

[timeless]

Comment on attachment 312230 [details] [diff] [review]
everyone else looks before leaping

mozilla/layout/generic/nsObjectFrame.cpp 	1.647

[e-mail]: if you can't reproduce this w/ a current build, please indicate as much, if you can, please provide a new breakpad id, thanks.

Comment 13

[David Lawhon]

(In reply to comment #12)
I can't reproduce the crash anymore on the Democraticunderground.com page, either using 3.0b5 (Mac PPC) or the latest 3.0 daily build (4/7/08 Mac), under Mac OS X 10.4.11.

Using 3.0b5, I can still reproduce the crash on the Viewpoint Demo Page cited at the top of this bug report (#421030) every time. However, I cannot reproduce it at all using the latest 3.0 daily build viewing the same Demo page. So, at least for me, it appears the crash bug has been resolved in the latest builds.

Comment 14

[timeless]

thanks!

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

Same steps as in comment 0 still crash for me with today's nightly on XP w/Viewpoint; the stack trace, however, is different.  New bug?:

http://crash-stats.mozilla.com/report/index/ff4bafe8-0dec-11dd-99e7-001cc45a2c28?p=1

Comment 16

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #15)
> Same steps as in comment 0 still crash for me with today's nightly on XP
> w/Viewpoint; the stack trace, however, is different.  New bug?:
> 
> http://crash-stats.mozilla.com/report/index/ff4bafe8-0dec-11dd-99e7-001cc45a2c28?p=1

I spun-off this as bug 429973.

Comment 17

[Hasham]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0

Tried this in RC2 on XP SP3. No crash to be reported.