560213 - [OOPP] heap corruption when scripting a crashed plugin

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Benjamin Smedberg]

When we try to create a PPluginIdentifier for a dead plugin, we double-delete a PluginIdentifierParent which leads to odd Firefox crashes and heap corruption. This was found as part of bug 559943, and also bug 558647 comment #5.

The bug is in PluginModuleParent::GetIdentifierForNPIdentifier when SendPPluginIdentifierConstructor fails: IPDL owns the actor and will delete it, the calling code shouldn't.

Comment 1

[Benjamin Smedberg]

This bug is probably responsible for most of the crashes [@ operator new(unsigned int) | <lots of frames here>] in 3.6.3plugin1.

Comment 2

[Benjamin Smedberg]

Attachment: Test

Comment 3

[Benjamin Smedberg]

Attachment: Don't double-delete, rev. 1

Comment 4

[Benjamin Smedberg]

http://hg.mozilla.org/mozilla-central/rev/81d503e824a1
http://hg.mozilla.org/mozilla-central/rev/84921f0eb658

Comment 5

[Benjamin Smedberg]

No-risk patch, with tests.

Comment 6

[LegNeato]

Comment on attachment 439921 [details] [diff] [review]
Don't double-delete, rev. 1

a=LegNeato for 1.9.2.4

Comment 7

[Benjamin Smedberg]

1.9.2:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/a0fd28b9f118
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/9a502f8e1196

relbranch:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/c9dc77382545
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/66bd872fb79d

Comment 8

[Al Billings [:abillings - ex-MoCo]]

Is there a repro case for verifying this fix?

Comment 9

[Benjamin Smedberg]

Not really. It relied on the hang from bug 559943, which we also fixed. But it does come with an automated test, which I think is sufficient.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

All right. Marking it as verified for 1.9.2 since the test is currently passing. :-)