Closed Bug 544074 Opened 15 years ago Closed 15 years ago

[OOPP] Detaching tab with Move Player running crashes mozilla-runtime [@ mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)]

Categories

(Core Graveyard :: Plug-ins, defect)

Product:
Core Graveyard
Component:
Plug-ins
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: jmjjeffery, Assigned: benjamin)

References

(
URL
)

Details

(Keywords: crash, Whiteboard: [OOPPTestday])

Crash Data

Attachments

(1 file)

mObjectMap mutates, save the list of objects in a temporary per-instance map, rev. 1
11.76 KB, patch
bent.mozilla
: review+
Details | Diff | Splinter Review
Visit: http://abc.go.com/watch/greys-anatomy/93515/238356/invasion Make sure you have Move Player installed and you have to spoof the UA to Firefox/3.6 or the site will not recognize Minefield as a valid browser. Drag the tab into the body of the window to detach, and when the new browser window opens mozilla-runtime will crash and offer to send a report. I got two crashes: http://crash-stats.mozilla.com/report/index/bp-8758e173-f98e-46ad-9bd5-52c102100203 http://crash-stats.mozilla.com/report/index/bp-2d29ea39-2750-469d-afa9-ff5be2100203 Todays nightly build: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20100203 Minefield/3.7a1pre
Blocks: OOPP
URL: http://abc.go.com/watch/greys-anatomy...
Whiteboard: [OOPP] Testday
Signature mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*) UUID 8758e173-f98e-46ad-9bd5-52c102100203 Process Type plugin Version: Filename: npqmp071503000010.dll Time 2010-02-03 12:01:49.650513 Uptime 77 Product Firefox Version 3.7a1pre Build ID 20100203081257 Branch 1.9.3 OS Windows NT OS Version 6.1.7600 CPU x86 CPU Info AuthenticAMD family 16 model 2 stepping 3 Crash Reason EXCEPTION_ACCESS_VIOLATION Crash Address 0xc User Comments Processor Notes Crashing Thread Frame Module Signature Source 0 xul.dll mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject dom/plugins/PluginModuleChild.cpp:331 1 xul.dll mozilla::plugins::PluginScriptableObjectChild::DropNPObject dom/plugins/PluginScriptableObjectChild.cpp:605 2 xul.dll mozilla::plugins::PluginScriptableObjectChild::ScriptableDeallocate dom/plugins/PluginScriptableObjectChild.cpp:97 3 xul.dll mozilla::plugins::PluginModuleChild::DeallocNPObject dom/plugins/PluginModuleChild.cpp:1582 4 xul.dll mozilla::plugins::PluginModuleChild::NPN_ReleaseObject dom/plugins/PluginModuleChild.cpp:1567 5 npqmp071503000010.dll npqmp071503000010.dll@0x148e24 6 @0x47b4a97 7 npqmp071503000010.dll npqmp071503000010.dll@0x220a97 8 npqmp071503000010.dll npqmp071503000010.dll@0x16a0e 9 npqmp071503000010.dll npqmp071503000010.dll@0x213343 10 npqmp071503000010.dll npqmp071503000010.dll@0x169a1 11 npqmp071503000010.dll npqmp071503000010.dll@0x1650c 12 xul.dll mozilla::plugins::PluginModuleChild::DeallocNPObject dom/plugins/PluginModuleChild.cpp:1582 13 xul.dll mozilla::plugins::PluginModuleChild::DeallocForInstance dom/plugins/PluginModuleChild.cpp:1606 14 xul.dll nsTHashtable<nsPtrHashKey<nsSMILTimeContainer> >::s_EnumStub obj-firefox/dist/include/nsTHashtable.h:420 15 xul.dll PL_DHashTableEnumerate obj-firefox/xpcom/build/pldhash.c:754 16 xul.dll nsTHashtable<mozilla::plugins::PluginModuleChild::NPObjectData>::EnumerateEntries obj-firefox/dist/include/nsTHashtable.h:241 17 xul.dll mozilla::plugins::PluginModuleChild::DeallocNPObjectsForInstance dom/plugins/PluginModuleChild.cpp:1620 18 xul.dll mozilla::plugins::PluginInstanceChild::AnswerNPP_Destroy dom/plugins/PluginInstanceChild.cpp:1167 19 xul.dll mozilla::plugins::PPluginInstanceChild::OnCallReceived obj-firefox/ipc/ipdl/PPluginInstanceChild.cpp:1215 20 xul.dll mozilla::plugins::PPluginModuleChild::OnCallReceived obj-firefox/ipc/ipdl/PPluginModuleChild.cpp:378 21 xul.dll mozilla::ipc::RPCChannel::DispatchIncall ipc/glue/RPCChannel.cpp:373 22 xul.dll mozilla::ipc::RPCChannel::Incall ipc/glue/RPCChannel.cpp:358 23 xul.dll mozilla::ipc::RPCChannel::OnMaybeDequeueOne ipc/glue/RPCChannel.cpp:293 24 xul.dll MessageLoop::RunTask ipc/chromium/src/base/message_loop.cc:326 25 xul.dll MessageLoop::DeferOrRunPendingTask ipc/chromium/src/base/message_loop.cc:334 26 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:434 27 xul.dll mozilla::ipc::DoWorkRunnable::Run ipc/glue/MessagePump.cpp:75 28 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:527 29 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:142 30 xul.dll xul.dll@0x9bd2eb 31 xul.dll MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:211 32 xul.dll MessageLoop::RunHandler 33 npqmp071503000010.dll npqmp071503000010.dll@0x1b90eb 34 xul.dll _IsNonwritableInCurrentImage 35 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:168 36 xul.dll nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:174 37 kernel32.dll kernel32.dll@0x11652 38 xul.dll nsAppShell::Run widget/src/windows/nsAppShell.cpp:239 Filename Version Debug Identifier Debug Filename npqmp071503000010.dll 715.3.0.10 70009CAF9D194A2A8F2AB596EC43E89A1 npqmp.pdb
Severity: major → critical
Keywords: crash
Summary: [OOPP] Detaching tab with Move Player running crashes mozilla-runtime → [OOPP] Detaching tab with Move Player running crashes mozilla-runtime [@ mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)]
UUID 2d29ea39-2750-469d-afa9-ff5be2100203 would be bug 536620; possibly bug 536666
Whiteboard: [OOPP] Testday → [OOPPTestday]
Assignee: nobody → benjamin
We're enumerating the scriptable objects at shutdown but re-entering the hashtable. We should be smarter, and I knew it but forgot to file it. Duh.
Blocks: LorentzAlpha
Comment on attachment 428797 [details] [diff] [review] mObjectMap mutates, save the list of objects in a temporary per-instance map, rev. 1 Awesome!
Attachment #428797 - Flags: review?(bent.mozilla) → review+
http://hg.mozilla.org/mozilla-central/rev/bbe683272abf This landed 24-February, I forgot to mark it.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
This is not fully fixed. STR: 1. Tear off the tab in the URL given for testing 2. Note that a new window opens and stays on loading as tear off seems to reset to the start of the video, which I believe is expected, however the video never starts 3. Press ctrl+r to reload the page - crash. crash-report: stuck in 'throttling' - will post later if it comes back up.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
What buildid?
Today's nightly build win32 on trunk (m-c) Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a2pre) Gecko/20100227 Minefield/3.7a2pre
hrmm, that's strange - thought I had updated, but see its 2/27 build - Still.. should contain the fix if you checked in on the 24th..
OK, just updated to today's for sure, and now it seems I'm not crashing when reloading the tear-off / still seems that reloading after the tear-off should not be needed. More testing coming before reclosing unless there was something landed between the 27th and 28th that fixed it for good.
Closing, Sorry Benjamin, didn't notice that https://bugzilla.mozilla.org/show_bug.cgi?id=549112 was fixed 'after' yesterday's nightly, and I wrongly assumed that I had indeed updated to todays... So.. should a new bug be filed for having to 'reload' the page after tear-off ? Or is that more-or-less expected ?
Status: REOPENED → RESOLVED
Closed: 15 years ago → 15 years ago
Resolution: --- → FIXED
Jim, I'm not sure whether that is expected or not (and I can't test from outside the United States). If the behavior is different from Firefox 3.6 (or Minefield restarted after dom.ipc.plugins.enabled is set to false), then a new bug report should be filed.
OK, will see what happens when I turn off OOPP and try a tear-off. Will post something back tomorrow EST.
The test URL will not even start up with OOPP off, just sits loading forever. So, I can't test right off, will have to dig back to find where that went broke. I'll just file new bugs as I find the problem.
Ok, jumped all the way back to an OCT 2009 build before Finding a build that the test URL would even start up on, so now I think ABC has some long outstanding, non-reported issues :) At any rate, tab-tear off did not work with this build, so I opened it via right-click 'open in new window', and the video would not start up without refreshing the page, the same as I see when I tear-off the tab with OOPP enabled, so I think its likely not us...
Crash Signature: [@ mozilla::plugins::PluginModuleChild::UnregisterActorForNPObject(NPObject*)]
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: