558130 - [OOPP] Closing a tab with flash loaded crashes [@ mozilla::plugins::PluginInstanceParent::NPP_URLNotify(char const*, short, void*) ][@ mozilla::plugins::PStreamNotifyParent::Send__delete__ ]

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[u88484]

Since upgrading to the 20100408 nightly, closing a tab with flash loaded crashes that tab. 

Disabling OOPP and no crash.  User does have ABP enabled and confirmed that disabling ABP results in no crashes even with OOPP enabled.  A user on mozillazine also reported this today.  See https://www.mozdev.org/bugs/show_bug.cgi?id=22700

http://crash-stats.mozilla.com/report/index/6b2683a3-2345-43fe-a180-3d5262100408

Signature	mozilla::plugins::PluginInstanceParent::NPP_URLNotify(char const*, short, void*)
UUID	6b2683a3-2345-43fe-a180-3d5262100408
Time 	2010-04-08 10:55:27.173118
Uptime	474
Last Crash	481 seconds before submission
Product	Firefox
Version	3.7a5pre
Build ID	20100408075050
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0xffffffffffe93e91
User Comments	
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 		@0xffe93e91 	
1 	xul.dll 	mozilla::plugins::PluginInstanceParent::NPP_URLNotify 	dom/plugins/PluginInstanceParent.cpp:875
2 	xul.dll 	mozilla::plugins::PluginModuleParent::NPP_URLNotify 	dom/plugins/PluginModuleParent.cpp:495
3 		@0x8cebbfb 	
4 	xul.dll 	nsNPAPIPluginStreamListener::CleanUpStream 	modules/plugin/base/src/nsNPAPIPluginInstance.cpp:280
5 	xul.dll 	nsNPAPIPluginInstance::Stop 	modules/plugin/base/src/nsNPAPIPluginInstance.cpp:965
6 	xul.dll 	DoStopPlugin 	layout/generic/nsObjectFrame.cpp:2207
7 	xul.dll 	nsStopPluginRunnable::Run 	layout/generic/nsObjectFrame.cpp:2256
8 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
9 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:118
10 	xul.dll 	xul.dll@0x973a23 	
11 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:216
12 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
13 	xul.dll 	xul.dll@0x2e5533 	
14 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
15 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:174
16 	xul.dll 	nsAppShell::Run 	widget/src/windows/nsAppShell.cpp:239


This report was also provided with this information over IRC
http://crash-stats.mozilla.com/report/index/3f9a8cc7-13fe-4694-940f-bd3e32100408

Comment 1

[Gary [:streetwolf52]]

Confirmed

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100408 Minefield/3.7a5pre - Build ID: 20100408075050

Comment 2

[Gary [:streetwolf52]]

Opened a bug report with Wladimir

https://www.mozdev.org/bugs/show_bug.cgi?id=22700

Comment 3

[u88484]

I was able to reproduce this at http://abc.go.com/watch/lost/93372/257416/happily-ever-after

The video there does not load (just a black screen) closing the tab while testing with disabling OOPP, ABP and flashblock and I got a crash with the same signature.

Comment 4

[trg16]

Also happening in Mac OS X 10.6.3, OOPP enabled, Flash 10.1 RC1.

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre)
Gecko/20100408 Minefield/3.7a5pre

Comment 5

[Josh Aas]

I have installed ABP in current Minefield builds on Windows 7 and Mac OS X 10.6 and I'm unable to reproduce this. Do I need to specially configure ABP?

Comment 6

[Gary [:streetwolf52]]

Do you have an rules setup via a subscription?

Comment 7

[Josh Aas]

I have a default ABP install.

Comment 8

[Gary [:streetwolf52]]

you have to subscribe to filters. Go tot Filters in the ABP menu bar and click on Add Filter Subscription.  When the dialog pops up select Easylist.

Comment 10

[Filip Zakrzewski]

Subscribing to any filter is not resolving problem

Comment 11

[Gary [:streetwolf52]]

(In reply to comment #10)
> Subscribing to any filter is not resolving problem

You have to have filters in order to get the crash.  If you don't have filters you don't crash.

Comment 12

[Wladimir Palant]

The crash happens if Adblock Plus blocks any of the object subrequests sent off by Flash. One filter is enough - go to menu Tools / Adblock Plus Preferences, press Delete to remove everything you have and click "Add filter" then: "|http://video-stats.video.google.com/*". Press Enter and click OK. With this filter a YouTube video will crash you.

Comment 13

[Josh Aas]

I can reproduce this now.

Comment 15

[Josh Aas]

This is a regression from bug 554524, I'm going to back out when the tree opens.

Comment 16

[Josh Aas]

fixed by backing out the regressing patch

Comment 17

[[e-mail]]

Confirming the fix with Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a5pre) Gecko/20100410 Minefield/3.7a5pre (.NET CLR 3.5.30729) ID:20100410035858

Comment 18

[Marcia Knous [:marcia]]

Hit this crash while closing some tabs using  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.4) Gecko/20100503 Firefox/3.6.4 (.NET CLR 3.5.30729) (http://crash-stats.mozilla.com/report/index/bp-da7a9f44-6b58-4c9b-adc6-e754f2100504 is my report. This bug just concerned the trunk, so should I open a 1.9.2 specific version of this bug?

Comment 19

[Benjamin Smedberg]

Marcia, you should open a new bug. You had the same crash signature, but it's definitely not the same cause.