430576 - Crash [@ RtlEnterCriticalSection] while viewing Quicktime plugin

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Martijn Wargers (dead)]

This is a topcrash, see bug 416521.

Just viewing the url and listening the song (the Quicktime plugin gets invoked here inside the browser), then going forward/back and returning to the site, crashes current trunk build a lot of the times for me. Right-clicking on the plugin also might help get the crash.

I have Quicktime plugin version 7.1.6 on windowsXP installed.

http://crash-stats.mozilla.com/report/index/4e0b97f0-1181-11dd-863f-001cc45a2c28
0  	ntdll.dll  	RtlEnterCriticalSection  	
1 	mozcrt19.dll 	arena_dalloc 	jemalloc.c:4184
2 	mozcrt19.dll 	free 	jemalloc.c:6035
3 	xul.dll 	_releaseobject 	mozilla/modules/plugin/base/src/ns4xPlugin.cpp:1731
4 	xul.dll 	ns4xPluginInstance::GetJSObject 	mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp:1488
5 	xul.dll 	nsHTMLPluginObjElementSH::GetPluginJSObject 	mozilla/dom/src/base/nsDOMClassInfo.cpp:9321
6 	xul.dll 	nsHTMLPluginObjElementSH::SetupProtoChain 	mozilla/dom/src/base/nsDOMClassInfo.cpp:8903
7 	xul.dll 	nsHTMLPluginObjElementSH::PostCreate 	mozilla/dom/src/base/nsDOMClassInfo.cpp:9013
8 	xul.dll 	XPCWrappedNative::GetNewOrUsed 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:546
9 	xul.dll 	XPCWrappedNative::GetNewOrUsed 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:416
10 	xul.dll 	XPCConvert::NativeInterface2JSObject 	mozilla/js/src/xpconnect/src/xpcconvert.cpp:1106
11 	xul.dll 	XPCConvert::NativeData2JS 	mozilla/js/src/xpconnect/src/xpcconvert.cpp:481
12 	xul.dll 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2456
13 	xul.dll 	XPC_WN_GetterSetter 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1505
14 	js3250.dll 	js_Invoke 	mozilla/js/src/jsinterp.c:1283
15 	js3250.dll 	js_InternalInvoke 	mozilla/js/src/jsinterp.c:1355
16 	js3250.dll 	js_GetPropertyHelper 	mozilla/js/src/jsobj.c:3702
17 	js3250.dll 	js_Interpret 	mozilla/js/src/jsinterp.c:4162
18 	js3250.dll 	js_Invoke 	mozilla/js/src/jsinterp.c:1299
19 	js3250.dll 	js_InternalInvoke 	mozilla/js/src/jsinterp.c:1355
20 	js3250.dll 	JS_CallFunctionValue 	mozilla/js/src/jsapi.c:5053
21 	xul.dll 	nsJSContext::CallEventHandler 	mozilla/dom/src/base/nsJSEnvironment.cpp:1962
22 	xul.dll 	nsJSEventListener::HandleEvent 	mozilla/dom/src/events/nsJSEventListener.cpp:248
23 	xul.dll 	nsEventListenerManager::HandleEventSubType 	mozilla/content/events/src/nsEventListenerManager.cpp:1080
24 	xul.dll 	nsEventListenerManager::HandleEvent 	mozilla/content/events/src/nsEventListenerManager.cpp:1184
25 	xul.dll 	nsEventTargetChainItem::HandleEvent 	mozilla/content/events/src/nsEventDispatcher.cpp:210
26 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain 	mozilla/content/events/src/nsEventDispatcher.cpp:268
27 	xul.dll 	nsEventDispatcher::Dispatch 	mozilla/content/events/src/nsEventDispatcher.cpp:483
28 	xul.dll 	nsXULPopupManager::FirePopupShowingEvent 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:1001
29 	xul.dll 	nsXULPopupManager::ShowPopupAtScreen 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:475
30 	xul.dll 	nsXULTooltipListener::LaunchTooltip 	mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:520
31 	xul.dll 	nsXULTooltipListener::ShowTooltip 	mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:415
32 	xul.dll 	nsXULTooltipListener::sTooltipCallback 	mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:748
33 	xul.dll 	nsTimerImpl::Fire 	mozilla/xpcom/threads/nsTimerImpl.cpp:400
34 	xul.dll 	nsTimerEvent::Run 	mozilla/xpcom/threads/nsTimerImpl.cpp:490
35 	xul.dll 	nsThread::ProcessNextEvent 	mozilla/xpcom/threads/nsThread.cpp:510
36 	xul.dll 	nsBaseAppShell::Run 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
37 	nspr4.dll 	PR_GetEnv 	
38 	firefox.exe 	wmain 	mozilla/toolkit/xre/nsWindowsWMain.cpp:87
39 	firefox.exe 	firefox.exe@0x217f 	
40 	kernel32.dll 	BaseProcessStart 	

All the breakpad reports that are very likely related to this type of crash:
http://crash-stats.mozilla.com/report/list?range_unit=weeks&query_search=stack&query_type=contains&product=Firefox&signature=RtlEnterCriticalSection&query=ns4xPluginInstance%3A%3AGetJSObject&range_value=1

Comment 1

[Mats Palmgren (inactive)]

WFM, Firefox 2008042305 + QuickTime Plug-in 7.4.5 on Windows XPSP2
(also WFM with a 04-24 local debug build)

I couldn't find QT 7.1.4 on apple.com but I found 7.1.6:
http://www.apple.com/support/downloads/quicktime716forwindows.html
which I was able to crash: bp-2ad6f0d1-1209-11dd-9b2c-001cc45a2ce4
Also in the local debug build:

 	ntdll.dll!_DbgBreakPoint@0() 	
 	ntdll.dll!_RtlpBreakPointHeap@4()  + 0x28 bytes	
 	ntdll.dll!_RtlpValidateHeapEntry@12()  + 0x113 bytes	
 	ntdll.dll!_RtlValidateHeap@12()  + 0xe0 bytes	
 	kernel32.dll!_HeapValidate@12()  + 0x14 bytes	
 	msvcr80d.dll!__CrtIsValidHeapPointer()  + 0x15a bytes	
 	msvcr80d.dll!__free_dbg_nolock()  + 0x116 bytes	
 	msvcr80d.dll!__free_dbg()  + 0x4e bytes	
 	msvcr80d.dll!_free()  + 0xe bytes	
>	gkplugin.dll!_releaseobject(NPObject * npobj=0x04532e50)  Line 1751 + 0x7 bytes	C++
 	gkplugin.dll!ns4xPluginInstance::GetJSObject(JSContext * cx=0x0284acf8)  Line 1488 + 0xa bytes	C++
 	gklayout.dll!nsHTMLPluginObjElementSH::GetPluginJSObject(JSContext * cx=0x0284acf8, JSObject * obj=0x01b62120, nsIPluginInstance * plugin_inst=0x03cc89f0, JSObject * * plugin_obj=0x0012f2b4, JSObject * * plugin_proto=0x0012f2b0)  Line 9322 + 0x40 bytes	C++
 	gklayout.dll!nsHTMLPluginObjElementSH::SetupProtoChain(nsIXPConnectWrappedNative * wrapper=0x01a75420, JSContext * cx=0x0284acf8, JSObject * obj=0x01b62120)  Line 8903 + 0x1c bytes	C++
 	gklayout.dll!nsHTMLPluginObjElementSH::PostCreate(nsIXPConnectWrappedNative * wrapper=0x01a75420, JSContext * cx=0x0284acf8, JSObject * obj=0x01b62120)  Line 9013 + 0xe bytes	C++
 	xpc3250.dll!XPCWrappedNative::GetNewOrUsed(XPCCallContext & ccx={...}, nsISupports * Object=0x01b62120, XPCWrappedNativeScope * Scope=0x03ae4644, XPCNativeInterface * Interface=0x027cb178, int isGlobal=0, XPCWrappedNative * * resultWrapper=0x0012f470)  Line 546 + 0x25 bytes	C++
 	xpc3250.dll!XPCWrappedNative::GetNewOrUsed(XPCCallContext & ccx={...}, nsISupports * Object=0x00000000, XPCWrappedNativeScope * Scope=0x03ae4644, XPCNativeInterface * Interface=0x027cb178, int isGlobal=0, XPCWrappedNative * * resultWrapper=0x0012f470)  Line 416 + 0x15 bytes	C++
 	xpc3250.dll!XPCConvert::NativeInterface2JSObject(XPCCallContext & ccx={...}, nsIXPConnectJSObjectHolder * * dest=0x0012f4b8, nsISupports * src=0x03dd0d34, const nsID * iid=0x0012f5c8, JSObject * scope=0x01b620e0, int allowNativeWrapper=1, int isGlobal=0, unsigned int * pErr=0x0012f5ac)  Line 1106 + 0x12 bytes	C++
 	xpc3250.dll!XPCConvert::NativeData2JS(XPCCallContext & ccx={...}, long * d=0x0012f5b8, const void * s=0x00000000, const nsXPTType & type={...}, const nsID * iid=0x0012f5c8, JSObject * scope=0x01b620e0, unsigned int * pErr=0x0012f5ac)  Line 481 + 0x2c bytes	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_GETTER)  Line 2456 + 0x24 bytes	C++
 	xpc3250.dll!XPC_WN_GetterSetter(JSContext * cx=0x0284acf8, JSObject * obj=0x01b620e0, unsigned int argc=0, long * argv=0x01b4a0dc, long * vp=0x0012f7cc)  Line 1505 + 0xb bytes	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x0284acf8, unsigned int argc=0, long * vp=0x01b4a0d4, unsigned int flags=2050)  Line 1284	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x0284acf8, JSObject * obj=0x01b620e0, long fval=70129216, unsigned int flags=0, unsigned int argc=0, long * argv=0x00000000, long * rval=0x0012f8d8)  Line 1355 + 0x12 bytes	C
 	js3250.dll!js_NativeGet(JSContext * cx=0x00000000, JSObject * obj=0x01b620e0, JSObject * pobj=0x04110080, JSScopeProperty * sprop=0x03c9b1c0, long * vp=0x0012f8d8)  Line 3551 + 0xda bytes	C
 	js3250.dll!js_GetPropertyHelper(JSContext * cx=0x00000000, JSObject * obj=0x00000000, long id=68223104, long * vp=0x0012f8d8, JSPropCacheEntry * * entryp=0x0012f900)  Line 3701 + 0xf bytes	C
 	js3250.dll!js_Interpret(JSContext * cx=)  Line 4162 + 0x1e bytes	C
 	nspr4.dll!_MD_CURRENT_THREAD()  Line 300	C
 	xpcom_core.dll!nsThreadManager::GetIsMainThread(int * result=0x039083b4)  Line 283 + 0x6 bytes	C++
 	xpcom_core.dll!NS_IsMainThread_P()  Line 131	C++
 	036a3140()	

Comment 2

[timeless]

we should blocklist 7.1.*

Comment 3

[Adam Guthrie]

(In reply to comment #2)
> we should blocklist 7.1.*

I filed bug 430826 for this.

Comment 4

[Damon Sicore (:damons)]

Since this is a blocklisting issue, we're not going to hold the release for it.  

Comment 5

[kitchin]

Note this crash means no Quicktime plugin for Windows 2000.
See: Bug 430826, Comment 9

Comment 6

[Martijn Wargers (dead)]

This was fixed by fixing bug 430826 (blocklisting the offending plugin).