[OOPP] Plugin process crash during mochitest-3/5 [@nsDefaultComparator] or [@ nsTArray_base::Length()]

RESOLVED FIXED in mozilla1.9.3a4

Status

()

RESOLVED FIXED
9 years ago
3 years ago

People

(Reporter: cjones, Assigned: benjamin)

Tracking

({intermittent-failure})

Trunk
mozilla1.9.3a4
x86
Windows XP
intermittent-failure
Points:
---

Firefox Tracking Flags

(status1.9.2 .4-fixed)

Details

(Whiteboard: [qa-noaction-192])

Attachments

(2 attachments)

Thread 2 (crashed)
 0  xul.dll!nsDefaultComparator<mozilla::plugins::ChildAsyncCall *,mozilla::plugins::ChildAsyncCall *>::Equals(mozilla::plugins::ChildAsyncCall * const &,mozilla::plugins::ChildAsyncCall * const &) [nsTArray.h:035ca5e3ea54 : 223 + 0x6]
    eip = 0x61a2c55d   esp = 0x0121dce4   ebp = 0x0121dce8   ebx = 0x00000001
    esi = 0x003301c8   edi = 0x00000000   eax = 0x00341000   ecx = 0x0121dd48
    edx = 0x00341000   efl = 0x00010293
    Found by: given as instruction pointer in context
 1  xul.dll!nsTArray<mozilla::plugins::ChildAsyncCall *>::IndexOf<mozilla::plugins::ChildAsyncCall *,nsDefaultComparator<mozilla::plugins::ChildAsyncCall *,mozilla::plugins::ChildAsyncCall *> >(mozilla::plugins::ChildAsyncCall * const &,unsigned int,nsDefaultComparator<mozilla::plugins::ChildAsyncCall *,mozilla::plugins::ChildAsyncCall *> const &) [nsTArray.h:035ca5e3ea54 : 393 + 0xf]
    eip = 0x61a2c506   esp = 0x0121dcf0   ebp = 0x0121dd08
    Found by: call frame info
 2  xul.dll!nsTArray<mozilla::plugins::ChildAsyncCall *>::RemoveElement<mozilla::plugins::ChildAsyncCall *,nsDefaultComparator<mozilla::plugins::ChildAsyncCall *,mozilla::plugins::ChildAsyncCall *> >(mozilla::plugins::ChildAsyncCall * const &,nsDefaultComparator<mozilla::plugins::ChildAsyncCall *,mozilla::plugins::ChildAsyncCall *> const &) [nsTArray.h:035ca5e3ea54 : 700 + 0x11]
    eip = 0x61a2c46b   esp = 0x0121dd10   ebp = 0x0121dd24
    Found by: call frame info
 3  xul.dll!nsTArray<mozilla::plugins::ChildAsyncCall *>::RemoveElement<mozilla::plugins::ChildAsyncCall *>(mozilla::plugins::ChildAsyncCall * const &) [nsTArray.h:035ca5e3ea54 : 712 + 0x14]
    eip = 0x61a2c43e   esp = 0x0121dd2c   ebp = 0x0121dd3c
    Found by: call frame info
 4  xul.dll!mozilla::plugins::ChildAsyncCall::Run() [ChildAsyncCall.cpp:035ca5e3ea54 : 68 + 0x17]
    eip = 0x61a2c417   esp = 0x0121dd44   ebp = 0x0121dd4c
    Found by: call frame info
 5  xul.dll!nsThread::ProcessNextEvent(int,int *) [nsThread.cpp:035ca5e3ea54 : 527 + 0x18]
    eip = 0x61b4e2fa   esp = 0x0121dd54   ebp = 0x0121dd88
    Found by: call frame info

Looks like a use-after-free of PluginInstanceChild, probably caused by NPP_Destroy() re-entering the callback.
Created attachment 423932 [details] [diff] [review]
Prevent |ChildAsyncCallback|s from touching freed |PluginInstanceChild|s if NPP_Destroy() re-enters or races with the callback
[Checkin: Comment 3]

Probable fix.

I can't figure out a (reliable) way to make NPP_Destroy() re-enter or race with an async callback in a mochitest, so guess we'll need to fly by the seat of our pants for the time being.
Attachment #423932 - Flags: review?(benjamin)
Keywords: testcase-wanted
(Assignee)

Updated

9 years ago
Attachment #423932 - Flags: review?(benjamin) → review+
(Assignee)

Comment 4

9 years ago
we'll call it fixed and reopen if necessary, please update https://wiki.mozilla.org/Plugins/OOPP_Branch_Tracking
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
Looks like it reoccurred after the fix

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1264800596.1264801559.10812.gz#err0
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Time for one of you guys to get down with record-and-replay! It's fun! Builds character!
(Assignee)

Updated

9 years ago
Duplicate of this bug: 543895
(Assignee)

Updated

9 years ago
Summary: [OOPP] Plugin process crash during mochitest-3/5 [@nsDefaultComparator] → [OOPP] Plugin process crash during mochitest-3/5 [@nsDefaultComparator] or [@ nsTArray_base::Length()]
Version: unspecified → Trunk
Blocks: 438871
Whiteboard: [orange]
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1267725817.1267729445.3014.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/04 10:03:37
s: win32-slave06
Duplicate of this bug: 553498
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268975329.1268978193.7280.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/18 22:08:49
s: win32-slave09
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268978253.1268981707.16107.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/18 22:57:33
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268980626.1268983394.20474.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/18 23:37:06
s: win32-slave22
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269099691.1269101482.25805.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/20 08:41:31  
s: win32-slave39
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269132534.1269134293.31443.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/20 17:48:54
s: win32-slave39
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269138418.1269140965.12604.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/20 19:26:58
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269145206.1269147581.24821.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/20 21:20:06
s: win32-slave09
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269172654.1269175160.28030.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/21 04:57:34
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269217055.1269218783.8148.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/21 17:17:35
s: win32-slave39
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269251710.1269253717.15869.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/22 02:55:10  
s: win32-slave39
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269300561.1269303086.7190.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/22 16:29:21
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269311218.1269313778.3850.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/22 19:26:58
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269315423.1269317964.13488.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/22 20:37:03
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269322675.1269325306.30071.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/22 22:37:55
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269351918.1269354528.27541.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/23 06:45:18
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269348755.1269351566.19135.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/23 05:52:35
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269407911.1269410580.22197.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/23 22:18:31
s: win32-slave20
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269446174.1269449124.13756.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/24 08:56:14
s: win32-slave01
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269527014.1269529547.12182.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/25 07:23:34
s: win32-slave43
(Assignee)

Comment 35

9 years ago
Created attachment 434894 [details] [diff] [review]
Actually add stuff to mPendingAsyncCalls, rev. 1
[Checkin: Comment 40]

Boy, I feel dumb. I couldn't reproduce this in recording, but it turns out that we just never added the ChildAsyncCall to the mPendingAsyncCalls list.
Assignee: nobody → benjamin
Status: REOPENED → ASSIGNED
Attachment #434894 - Flags: review?(jones.chris.g)
Attachment #434894 - Flags: review?(jones.chris.g) → review+
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269563434.1269565850.22484.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/25 17:30:34
s: win32-slave23
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269636826.1269639303.11504.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/26 13:53:46
s: win32-slave23
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269643325.1269644983.26525.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/26 15:42:05
s: win32-slave16
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1269818957.1269820558.9674.gz
WINNT 5.2 mozilla-central debug test mochitests-3/5 on 2010/03/28 16:29:17
s: win32-slave16
(Assignee)

Comment 40

9 years ago
http://hg.mozilla.org/mozilla-central/rev/ca3038f38f65
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago9 years ago
Resolution: --- → FIXED
Attachment #423932 - Attachment description: Prevent |ChildAsyncCallback|s from touching freed |PluginInstanceChild|s if NPP_Destroy() re-enters or races with the callback → Prevent |ChildAsyncCallback|s from touching freed |PluginInstanceChild|s if NPP_Destroy() re-enters or races with the callback [Checkin: Comment 3]
Attachment #434894 - Attachment description: Actually add stuff to mPendingAsyncCalls, rev. 1 → Actually add stuff to mPendingAsyncCalls, rev. 1 [Checkin: Comment 40]
Target Milestone: --- → mozilla1.9.3a4
(Assignee)

Comment 41

9 years ago
Comment on attachment 434894 [details] [diff] [review]
Actually add stuff to mPendingAsyncCalls, rev. 1
[Checkin: Comment 40]

I need this on 1.9.2 because bug 558629 depends on it.
Attachment #434894 - Flags: approval1.9.2.4?

Comment 42

9 years ago
Comment on attachment 434894 [details] [diff] [review]
Actually add stuff to mPendingAsyncCalls, rev. 1
[Checkin: Comment 40]

a=LegNeato for 1.9.2.4
Attachment #434894 - Flags: approval1.9.2.4? → approval1.9.2.4+
Whiteboard: [orange] → [orange] [qa-noaction-192]
Keywords: intermittent-failure
Whiteboard: [orange] [qa-noaction-192] → [qa-noaction-192]
Keywords: testcase-wanted
You need to log in before you can comment on or make changes to this bug.