543199 - crash [@ npdeploytk.dll@0x393c] visiting panopticlick.eff.org

Status: RESOLVED WONTFIX

(Core :: IPC, defect)

Description

[Henrik Gemal]

if I visit
https://panopticlick.eff.org/index.php?action=log&js=yes
one of my plugins crashes and I get the plugin crash dialog

http://crash-stats.mozilla.com/report/index/cc46dbdd-86dd-44aa-bd45-696972100130
http://crash-stats.mozilla.com/report/index/764155e1-6a9a-4fe6-9328-ebce62100130
http://crash-stats.mozilla.com/report/index/3cdeefa5-546c-4ff4-99ee-3e7f22100130

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a1pre) Gecko/20100128 Minefield/3.7a1pre ID:20100128051129

Comment 1

[Matthias Versen [:Matti]]

and you don't crash without IPC (just to be sure) ?

Comment 2

[Henrik Gemal]

(In reply to comment #1)
> and you don't crash without IPC (just to be sure) ?

yes. no crash without IPC

Comment 3

[Henrik Gemal]

I also crash at the following pages:
http://browserspy.dk/fonts-java.php
http://browserspy.dk/geolocation.php
http://browserspy.dk/ip.php

seems like all pages that uses java.

I have Java(TM) Platform SE 6 U18

Comment 4

[(mostly gone) XtC4UaLL [:xtc4uall]]

The Examples mentioned in Comment 3 are WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a6pre) Gecko/20100628 Minefield/3.7a6pre ID:20100628035917 + Java Plug-in 1.6.0_20.

The Example mentioned in Comment 0 though, is (still) crashing:

Signature	free | mozilla::plugins::child::_releasevariantvalue
UUID	be014e36-f099-444b-9a24-f6d7a2100628
Process Type	plugin Version: Filename: npdeployJava1.dll
Time 	2010-06-28 07:16:49.579133
Uptime	129
Install Age	2691 seconds (44.9 minutes) since version was first installed.
Product	Firefox
Version	3.7a6pre
Build ID	20100628035917
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
User Comments	
Processor Notes 	
EMCheckCompatibility	False

Frame  	Module  	Signature  	Source
0 	mozcrt19.dll 	free 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6053
1 	xul.dll 	mozilla::plugins::child::_releasevariantvalue 	dom/plugins/PluginModuleChild.cpp:1361
2 	npdeployJava1.dll 	npdeployJava1.dll@0x1e56 	
3 	npdeployJava1.dll 	npdeployJava1.dll@0x19db 	
4 	xul.dll 	mozilla::plugins::PPluginScriptableObjectChild::OnCallReceived(IPC::Message const&,IPC::Message*&) 	obj-firefox/ipc/ipdl/PPluginScriptableObjectChild.cpp:937
5 	xul.dll 	mozilla::plugins::PPluginModuleChild::OnCallReceived(IPC::Message const&,IPC::Message*&) 	obj-firefox/ipc/ipdl/PPluginModuleChild.cpp:460
6 	xul.dll 	mozilla::ipc::RPCChannel::DispatchIncall(IPC::Message const&) 	ipc/glue/RPCChannel.cpp:510
7 	xul.dll 	mozilla::ipc::RPCChannel::Incall(IPC::Message const&,unsigned int) 	ipc/glue/RPCChannel.cpp:496
8 	xul.dll 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne() 	ipc/glue/RPCChannel.cpp:434
9 	xul.dll 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc:336
10 	xul.dll 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc:344
11 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc:444
12 	xul.dll 	base::MessagePumpForUI::DoRunLoop() 	ipc/chromium/src/base/message_pump_win.cc:213
13 	xul.dll 	base::MessagePumpWin::RunWithDispatcher(base::MessagePump::Delegate*,base::MessagePumpWin::Dispatcher*) 	ipc/chromium/src/base/message_pump_win.cc:52
14 	xul.dll 	base::MessagePumpWin::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_win.h:78
15 	xul.dll 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc:216
16 	xul.dll 	MessageLoop::RunHandler() 	
17 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:173
18 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:420
19 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
20 	plugin-container.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
21 	kernel32.dll 	BaseProcessStart

Comment 5

[timeless]

case someone w/ crt access look at the crashing line in free? is it really a null pointer from the caller?

Comment 6

[yusuhail]

Related? : https://bugzilla.mozilla.org/show_bug.cgi?id=740051

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.