534736 - [OOP] Crash [@ _purecall | mozilla::plugins::PPluginInstanceParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::ActorDestroyReason) ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[IU]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1pre) Gecko/20091214 Minefield/3.7a1pre (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1pre) Gecko/20091214 Minefield/3.7a1pre (.NET CLR 3.5.30729)

Using the latest Electrolysis build: I was clicking on another video, after the video I was watching, on the msnbc.com video player, just finished playing, and I got a crash that took down the whole browser -- not just mozilla-runtime.exe

I am using the latest official Adobe Flash Player build: 10.0.42.34

The crash might not be easy to reproduce, but the crash signature and stack looks interesting enough that I though you all might want a peek.  The crash is: http://crash-stats.mozilla.com/report/index/bp-2766507d-c328-45ad-ac1f-7c3252091214

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	ntdll.dll 	KiFastSystemCallRet 	
1 	ntdll.dll 	ZwWaitForSingleObject 	
2 	kernel32.dll 	WaitForSingleObjectEx 	
3 	kernel32.dll 	WaitForSingleObject 	
4 	xul.dll 	google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:606
5 	xul.dll 	google_breakpad::ExceptionHandler::HandlePureVirtualCall 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:550
6 	mozcrt19.dll 	_purecall 	obj-firefox/memory/jemalloc/crtsrc/purevirt.c:47
7 	xul.dll 	mozilla::plugins::PPluginInstanceParent::DestroySubtree 	obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp:1115
8 	xul.dll 	mozilla::plugins::PPluginModuleParent::DestroySubtree 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:549
9 	xul.dll 	mozilla::plugins::PPluginModuleParent::OnChannelError 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:489
10 	xul.dll 	mozilla::ipc::AsyncChannel::NotifyMaybeChannelError 	ipc/glue/AsyncChannel.cpp:279
11 	xul.dll 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:326
12 	xul.dll 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:334
13 	xul.dll 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:434
14 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:122
15 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:211
16 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:194
17 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:168
18 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:174
19 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:182
20 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3529
21 	firefox.exe 	NS_internal_main 	browser/app/nsBrowserApp.cpp:158
22 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
23 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
24 	kernel32.dll 	BaseProcessStart


Reproducible: Sometimes

Steps to Reproduce:
1. Install the affected electrolysis build
2. Set dom.ipc.plugins.enabled;true, but leave dom.ipc.tabs.enabled;false
3. You may have to restart the browser.  I did.
4. Click a video link.  It should launch in a new window.
5. When your video finishes playing and is beginning countdown for the next video, click another video from the left-hand list.
6. If you are lucky, it will crash.  You may have to perform Step 5 several times before seeing the crash.

Comment 1

[Benjamin Smedberg]

I suspect that we're deleting a PBrowserStreamParent* while in the middle of this loop:

        // Recursively shutting down PBrowserStream kids
        nsTArray<PBrowserStreamParent*> kids = mManagedPBrowserStreamParent;
        for (uint32 i = 0; (i) < ((kids).Length()); (++(i))) {
            (kids[i])->DestroySubtree(subtreewhy);
        }

I was going to say it's likely that we deleted one of the child actors from within this loop, but BrowserStreamParent doesn't implement ActorDestroy, so I don't see how this can re-enter. But if it's not hard to reproduce, it's likely we can catch it in a debugger or record-and-replay VM.

Comment 2

[IU]

You may be able to reproduce this if you click a different video while the one you're watching is still playing.  I tried that and was able to crash consistently.  I also have restoring of my sessions enabled, so after the crash, restarting also crashes until I uncheck the msnbc.com video window.

1. Use a new profile and set dom.ipc.plugins.enabled;true 
2. Go to http://www.msnbc.msn.com/
3. Click any video that launches in a new window
4. While that video is playing, click another video from the thumbnail list on the left.

Comment 3

[Benjamin Smedberg]

http://hg.mozilla.org/projects/electrolysis/rev/0e3ed118aedd

Comment 4

[IU]

This does appear to be fixed in Electrolysis build: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1pre) Gecko/20091223 Minefield/3.7a1pre

http://hg.mozilla.org/projects/electrolysis/rev/179bad633581

No longer able to reproduce this particular crash.

I'll set this to resolved, since this has supposedly landed on m-c and the only crashes I'm now seeing are the myriad [@ Abort ] crashes.  If someone believes otherwise, feel free to reopen.

Thanks

Comment 5

[Benjamin Smedberg]

http://hg.mozilla.org/mozilla-central/rev/0ed8211f4e54