548197 - Crashes [@ CFDictionaryGetValue ] on all branches, often at startup, due to fbplugin (new Facebook photo uploader). also [@ InterlockedIncrement], [@ npfbplugin_1_0_4.dll@0xe142], [@ CoreFoundation@0x157a4]

Status: RESOLVED INVALID

(Core Graveyard :: Plug-ins, defect)

Description

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Facebook apparently recently rolled out a new photo uploader plug-in, which unfortunately seems prone to crashes.  In the last week, it jumped from nowhere to being the #25 topcrash in Camino 2.0.1, and there are currently 800+ crashes in Firefox 3.0.x, 3.5.x, and 3.6.  (I didn't look at every report, so it's certainly possible there are other sources of CFDictionaryGetValue crashes, but it's probably most of them.)

Most of the crashes seem to be at startup, but others appear to be getting far enough that they crash during the uploading.

Ilya said he'd make sure someone at Facebook heard about this; it might already be known, but it's still worth tracking here, too, if only for crash-stats integration.

Comment 1

[Samuel Sidler (:ss)]

I bet someone at MoCo knows a friend or two at Facebook that can help, especially given this is a new crash.

Comment 2

[Chris Putnam]

We are very interested in these crashes, but the crash reporter's search mechanism seems to have been broken for a while or maybe just not easy to find crashes due to our plugin.

Since it launched, we've periodically visited the Mozilla crash reports page, specifically this filter:
https://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&date=&range_value=1&range_unit=weeks&query_search=signature&query_type=exact&query=&build_id=&process_type=plugin&plugin_field=filename&plugin_query_type=contains&plugin_query=fbplugin&do_query=1

What am I doing wrong?

Comment 3

[Chris Putnam]

Ah, after some digging through these tickets I was able to figure out a workaround. Searching for a stack trace that contains "fbplugin" works.

We are triaging and working on fixes for all these crashers now.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to comment #3)
> Ah, after some digging through these tickets I was able to figure out a
> workaround. Searching for a stack trace that contains "fbplugin" works.

Chris, is this fixed by a newer version of plugin? And  if not, what is the workaround?

Thunderbird users are also seeing this crash

Comment 5

[Wayne Mery (:wsmwk)]

workaround we found in  http://gsfn.us/t/1c7zw is remove the plugin from /Users/<username>/Library/Internet Plug-Ins

two other stack signatures from firefox  - the first has a few hundred crashes:
[@ InterlockedIncrement] bp-69c6756f-fe17-455c-a01d-d3e082100816 
[@ npfbplugin_1_0_4.dll@0xe142] bp-29452bd6-5e39-4774-906b-767b62100804

other facebook crashes - none of which look to be related but someone m ight want to check
https://bugzilla.mozilla.org/buglist.cgi?type1-0-0=anywordssubstr&field0-0-0=short_desc&type0-0-1=substring&field0-0-1=keywords&type1-0-1=allwordssubstr&value1-0-1=face%20book&resolution=---&resolution=INVALID&classification=Client%20Software&classification=Components&query_format=advanced&value1-0-0=%20npfb&value0-0-1=crash&type0-0-0=substring&value0-0-0=crash&field1-0-0=short_desc&product=Core&product=Firefox&field1-0-1=short_desc

Comment 6

[Wayne Mery (:wsmwk)]

the example given in comment 5 for InterlockedIncrement is bad. better is bp-5f435be3-029d-4c67-a93f-ca39b2100827

another Thunderbird signature is CoreFoundation@0x157a4 bp-9b7cef02-321f-4159-a222-ce7832100824

Comment 7

[timeless]

Signature	InterlockedIncrement
UUID	5f435be3-029d-4c67-a93f-ca39b2100827
Time 	2010-08-27 06:30:47.130751
Uptime	3453
Last Crash	3460 seconds (57.7 minutes) before submission
Install Age	2881379 seconds (4.8 weeks) since version was first installed.
Product	Firefox
Version	3.6.8
Build ID	20100722155716
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x18
User Comments	
Processor Notes 	
EMCheckCompatibility	False
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	kernel32.dll 	InterlockedIncrement 	
1 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x26940 	
2 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x269c5 	
3 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x3088f 	
4 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x2faa3 	
5 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x2f184 	
6 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x243b0 	
7 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x240a0 	
8 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x246e6 	
9 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x264de 	
10 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0xd3eba 	
11 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x14a4e5 	
12 	npfbplugin_1_0_4.dll 	npfbplugin_1_0_4.dll@0x14a58a 	

npfbplugin_1_0_4.dll  	1.0.4.0  	288709D32EE34596866D6A3CBA70E9371  	fbplugin.pdb

This is a null pointer dereference (null object with a field which is a counter)