562442 - Crash in [@ nsPluginInstanceOwner::ReleasePluginPort(void*)]

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Marcia Knous [:marcia]]

Seen while running Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100428 Minefield/3.7a5pre

https://crash-stats.mozilla.com/report/index/7c982f11-1f35-42ca-bb03-c34a92100428

STR:
1. I was composing an email in Gmail.
2. Added http://www.caltrain.com/pdf/Holiday_Schedules/Caltrain_Weekend_Holiday_Schedule_08-31-2009.pdf to the email and hit Send.
3. The crash occurred

Have not been able to repro

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	nsPluginInstanceOwner::ReleasePluginPort 	layout/generic/nsObjectFrame.cpp:5725
1 	xul.dll 	nsObjectFrame::CallSetWindow 	layout/generic/nsObjectFrame.cpp:1057
2 	xul.dll 	nsObjectFrame::DidReflow 	layout/generic/nsObjectFrame.cpp:1149
3 	xul.dll 	nsLineLayout::ReflowFrame 	layout/generic/nsLineLayout.cpp:967
4 	xul.dll 	nsBlockFrame::ReflowInlineFrame 	layout/generic/nsBlockFrame.cpp:3716
5 	xul.dll 	nsBlockFrame::DoReflowInlineFrames 	layout/generic/nsBlockFrame.cpp:3511
6 	xul.dll 	nsBlockFrame::ReflowInlineFrames 	layout/generic/nsBlockFrame.cpp:3365
7 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2461
8 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1907
9 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:1009
10 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:736
11 	xul.dll 	nsHTMLReflowState::Init 	layout/generic/nsHTMLReflowState.cpp:285
12 	xul.dll 	nsCSSFrameConstructor::RestyleElement 	layout/base/nsCSSFrameConstructor.cpp:8007
13 		@0x3802a3f

Comment 1

[aravindm]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a5pre) Gecko/20100603 Minefield/3.7a5pre
Works for me in the latest trunk build.

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Happens also in XP in Fx4...
http://crash-stats.mozilla.com/report/index/f086e727-aa10-4215-8aa0-73d252101125

Comment 3

[Josh Aas]

Attachment: fix v1.0

This will fix the crash but in cases where we would crash we'll leak the plugin port on Windows. That's much better than what happens now but this patch could be expanded to avoid the leak if someone takes the time to figure out how to re-factor the plugin port memory management here. We could file a separate bug on that and fix it later, a strategy that makes even more sense if we want to lower risk porting this patch to aurora and beta.

Comment 4

[Josh Aas]

Attachment: fix v1.1

Includes a fix for the memory leak.

Comment 5

[Jim Mathies [:jimm]]

Comment on attachment 570696 [details] [diff] [review]
fix v1.1

Looks ok to me.

Comment 6

[Josh Aas]

Attachment: aurora fix v1.0

Comment 7

[Josh Aas]

pushed to mozilla-central

http://hg.mozilla.org/mozilla-central/rev/978002c0b0ad

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 571075 [details] [diff] [review]
aurora fix v1.0

a=drivers per today's meeting.

Comment 9

[Josh Aas]

pushed to aurora

http://hg.mozilla.org/releases/mozilla-aurora/rev/3c039628db9b

Comment 10

[juan becerra [:juanb]]

Adding [qa+] for bug verification. We can try the steps in comment #0, but since we can't reproduce reliably we can check crash-stats before and after fix.

Comment 11

[u279076]

I'm seeing no instances of this crash on crash-stats for anything newer than Firefox 8. Marking verified.

Comment 12

[Daniel Veditz [:dveditz]]

Does not appear to affect the 1.9.2 branch
https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsPluginInstanceOwner%3A%3AReleasePluginPort%28void*%29&reason_type=contains&date=12%2F07%2F2011%2014%3A25%3A51&range_value=1&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsPluginInstanceOwner%3A%3AReleasePluginPort%28void*%29