Closed Bug 544074 Opened 13 years ago Closed 13 years ago

[OOPP] Detaching tab with Move Player running crashes mozilla-runtime [@ mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)]

Categories

(Core Graveyard :: Plug-ins, defect)

Product:
Core Graveyard
Component:
Plug-ins
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: jmjjeffery, Assigned: benjamin)

References

(
URL
)

Details

(Keywords: crash, Whiteboard: [OOPPTestday])

Crash Data

Attachments

(1 file)

mObjectMap mutates, save the list of objects in a temporary per-instance map, rev. 1
11.76 KB, patch
bent.mozilla
: review+
Details | Diff | Splinter Review 
Visit: http://abc.go.com/watch/greys-anatomy/93515/238356/invasion 
Make sure you have Move Player installed and you have to spoof the UA 
to Firefox/3.6 or the site will not recognize Minefield as a valid browser.

Drag the tab into the body of the window to detach, and when the new browser window opens mozilla-runtime will crash and offer to send a report.  I got two crashes: 
http://crash-stats.mozilla.com/report/index/bp-8758e173-f98e-46ad-9bd5-52c102100203
http://crash-stats.mozilla.com/report/index/bp-2d29ea39-2750-469d-afa9-ff5be2100203


Todays nightly build:
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20100203 Minefield/3.7a1pre
Blocks: OOPP
URL: http://abc.go.com/watch/greys-anatomy...
Whiteboard: [OOPP] Testday
Signature	mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)
UUID	8758e173-f98e-46ad-9bd5-52c102100203
Process Type	plugin Version: Filename: npqmp071503000010.dll
Time 	2010-02-03 12:01:49.650513
Uptime	77
Product	Firefox
Version	3.7a1pre
Build ID	20100203081257
Branch	1.9.3
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	AuthenticAMD family 16 model 2 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0xc
User Comments	
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject 	dom/plugins/PluginModuleChild.cpp:331
1 	xul.dll 	mozilla::plugins::PluginScriptableObjectChild::DropNPObject 	dom/plugins/PluginScriptableObjectChild.cpp:605
2 	xul.dll 	mozilla::plugins::PluginScriptableObjectChild::ScriptableDeallocate 	dom/plugins/PluginScriptableObjectChild.cpp:97
3 	xul.dll 	mozilla::plugins::PluginModuleChild::DeallocNPObject 	dom/plugins/PluginModuleChild.cpp:1582
4 	xul.dll 	mozilla::plugins::PluginModuleChild::NPN_ReleaseObject 	dom/plugins/PluginModuleChild.cpp:1567
5 	npqmp071503000010.dll 	npqmp071503000010.dll@0x148e24 	
6 		@0x47b4a97 	
7 	npqmp071503000010.dll 	npqmp071503000010.dll@0x220a97 	
8 	npqmp071503000010.dll 	npqmp071503000010.dll@0x16a0e 	
9 	npqmp071503000010.dll 	npqmp071503000010.dll@0x213343 	
10 	npqmp071503000010.dll 	npqmp071503000010.dll@0x169a1 	
11 	npqmp071503000010.dll 	npqmp071503000010.dll@0x1650c 	
12 	xul.dll 	mozilla::plugins::PluginModuleChild::DeallocNPObject 	dom/plugins/PluginModuleChild.cpp:1582
13 	xul.dll 	mozilla::plugins::PluginModuleChild::DeallocForInstance 	dom/plugins/PluginModuleChild.cpp:1606
14 	xul.dll 	nsTHashtable<nsPtrHashKey<nsSMILTimeContainer> >::s_EnumStub 	obj-firefox/dist/include/nsTHashtable.h:420
15 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.c:754
16 	xul.dll 	nsTHashtable<mozilla::plugins::PluginModuleChild::NPObjectData>::EnumerateEntries 	obj-firefox/dist/include/nsTHashtable.h:241
17 	xul.dll 	mozilla::plugins::PluginModuleChild::DeallocNPObjectsForInstance 	dom/plugins/PluginModuleChild.cpp:1620
18 	xul.dll 	mozilla::plugins::PluginInstanceChild::AnswerNPP_Destroy 	dom/plugins/PluginInstanceChild.cpp:1167
19 	xul.dll 	mozilla::plugins::PPluginInstanceChild::OnCallReceived 	obj-firefox/ipc/ipdl/PPluginInstanceChild.cpp:1215
20 	xul.dll 	mozilla::plugins::PPluginModuleChild::OnCallReceived 	obj-firefox/ipc/ipdl/PPluginModuleChild.cpp:378
21 	xul.dll 	mozilla::ipc::RPCChannel::DispatchIncall 	ipc/glue/RPCChannel.cpp:373
22 	xul.dll 	mozilla::ipc::RPCChannel::Incall 	ipc/glue/RPCChannel.cpp:358
23 	xul.dll 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:293
24 	xul.dll 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:326
25 	xul.dll 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:334
26 	xul.dll 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:434
27 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run 	ipc/glue/MessagePump.cpp:75
28 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
29 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:142
30 	xul.dll 	xul.dll@0x9bd2eb 	
31 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:211
32 	xul.dll 	MessageLoop::RunHandler 	
33 	npqmp071503000010.dll 	npqmp071503000010.dll@0x1b90eb 	
34 	xul.dll 	_IsNonwritableInCurrentImage 	
35 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:168
36 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:174
37 	kernel32.dll 	kernel32.dll@0x11652 	
38 	xul.dll 	nsAppShell::Run 	widget/src/windows/nsAppShell.cpp:239

Filename 	Version 	Debug Identifier 	Debug Filename
npqmp071503000010.dll 	715.3.0.10 	70009CAF9D194A2A8F2AB596EC43E89A1 	npqmp.pdb
Severity: major → critical
Keywords: crash
Summary: [OOPP] Detaching tab with Move Player running crashes mozilla-runtime → [OOPP] Detaching tab with Move Player running crashes mozilla-runtime [@ mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)]
UUID	2d29ea39-2750-469d-afa9-ff5be2100203 would be bug 536620; possibly bug 536666
Whiteboard: [OOPP] Testday → [OOPPTestday]
Assignee: nobody → benjamin
We're enumerating the scriptable objects at shutdown but re-entering the hashtable. We should be smarter, and I knew it but forgot to file it. Duh.
Blocks: LorentzAlpha
Comment on attachment 428797 [details] [diff] [review]
mObjectMap mutates, save the list of objects in a temporary per-instance map, rev. 1

Awesome!
Attachment #428797 - Flags: review?(bent.mozilla) → review+
http://hg.mozilla.org/mozilla-central/rev/bbe683272abf
This landed 24-February, I forgot to mark it.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
This is not fully fixed.  
STR: 
1. Tear off the tab in the URL given for testing
2. Note that a new window opens and stays on loading as tear off seems to reset to the start of the video, which I believe is expected, however the video never starts
3. Press ctrl+r to reload the page - crash. 

crash-report: stuck in 'throttling' - will post later if it comes back up.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
What buildid?
Today's nightly build win32 on trunk (m-c)

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a2pre) Gecko/20100227 Minefield/3.7a2pre
hrmm, that's strange - thought I had updated, but see its 2/27 build - 

Still.. should contain the fix if you checked in on the 24th..
OK, just updated to today's for sure, and now it seems I'm not crashing when reloading the tear-off / still seems that reloading after the tear-off should not be needed. 

More testing coming before reclosing unless there was something landed between the 27th and 28th that fixed it for good.
Closing,
Sorry Benjamin, didn't notice that https://bugzilla.mozilla.org/show_bug.cgi?id=549112 was fixed 'after' yesterday's nightly, and I wrongly assumed that I had indeed updated to todays...

So.. should a new bug be filed for having to 'reload' the page after tear-off ?  Or is that more-or-less expected ?
Status: REOPENED → RESOLVED
Closed: 13 years ago → 13 years ago
Resolution: --- → FIXED
Jim, I'm not sure whether that is expected or not (and I can't test from outside the United States).
If the behavior is different from Firefox 3.6 (or Minefield restarted after dom.ipc.plugins.enabled is set to false), then a new bug report should be filed.
OK, will see what happens when I turn off OOPP and try a tear-off.  Will post something back tomorrow EST.
The test URL will not even start up with OOPP off, just sits loading forever.  So, I can't test right off, will have to dig back to find where that went broke.  I'll just file new bugs as I find the problem.
Ok, jumped all the way back to an OCT 2009 build before Finding a build that the test URL would even start up on, so now I think ABC has some long outstanding, non-reported issues :) 

At any rate, tab-tear off did not work with this build, so I opened it via right-click 'open in new window', and the video would not start up without refreshing the page, the same as I see when I tear-off the tab with OOPP enabled, so I think its likely not us...
Crash Signature: [@ mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)]
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.