564607 - Minefield crashes on any O3D demo site [@ mozilla::plugins::PluginScriptableObjectParent::ScriptableEnumerate(NPObject*, void***, unsigned int*) ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Oleg Kuznetsov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.2.4) Gecko/20100503 Firefox/3.6.4 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a5pre) Gecko/20100508 Minefield/3.7a5pre

Minefield crashes every time on loading of any site, which contains O3D elements

Reproducible: Always

Steps to Reproduce:
1. Install O3D plugin from http://tools.google.com/dlpage/o3d
2. Open any demo from o3d sample catalog, for example, "The Journies of Prince IO" demo http://o3d.googlecode.com/svn/trunk/samples/io/io.html
3. Page will complain about unsupported user agent - click on "Ok" button
Actual Results:  
Minefield crashes


bp-d2ce48de-7e2a-4023-9719-071332100508
bp-ae3326b4-f2d0-4193-afc6-784922100508

Comment 1

[Dave Garrett]

bp-2ce48de-7e2a-4023-9719-071332100508
0  	xul.dll  	mozilla::plugins::PluginScriptableObjectParent::ScriptableEnumerate  	 dom/plugins/PluginScriptableObjectParent.cpp:468
1 	xul.dll 	NPObjWrapper_newEnumerate 	modules/plugin/base/src/nsJSNPRuntime.cpp:1580
2 	mozjs.dll 	js_Enumerate 	
3 	mozjs.dll 	js_Interpret 	js/src/jsops.cpp:467
4 	mozjs.dll 	js_Invoke 	js/src/jsinterp.cpp:831
5 	mozjs.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:882
6 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:4922
7 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2172
8 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:8502
9 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:8846
10 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:427
11 	nspr4.dll 	_PR_MD_UNLOCK 	nsprpub/pr/src/md/windows/w95cv.c:344
12 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:519
13 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
14 	nspr4.dll 	_PR_MD_UNLOCK 	nsprpub/pr/src/md/windows/w95cv.c:344
15 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:216
16 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
17 	xul.dll 	xul.dll@0xe9c7f 	
18 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
19 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:175
20 	xul.dll 	nsAppShell::Run 	widget/src/windows/nsAppShell.cpp:239
21 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:184
22 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3564
23 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
24 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
25 	kernel32.dll 	BaseProcessStart

Comment 2

[aravindm]

Build Worked:Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1) Gecko/20100208 MozillaDeveloperPreview/3.7a1
Build Broken:Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a2pre) Gecko/20100209 Minefield/3.7a2pre
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=43e818c28059&tochange=7b97c72399a0

Comment 3

[Benjamin Smedberg]

Aravind, why did you add a closeme tag to this bug? It's pretty obviously a valid bug which shouldn't be closed on a schedule.

Comment 4

[aravindm]

(In reply to comment #3)
> Aravind, why did you add a closeme tag to this bug? It's pretty obviously a
> valid bug which shouldn't be closed on a schedule.

oops! It was a mistake from my side. instead of changing the status from Unconfirmed to New i added Close Me tag. This happened since i was working with other issues where in I was adding CloseMe tag. Apologies.

Comment 5

[Benjamin Smedberg]

Attachment: Patch, rev. 1

This got r=bent on IRC

Comment 6

[Benjamin Smedberg]

AFAIK flash and silverlight do not implement the .enumerate hook (this crash doesn't show up in 3.6.4 crash stats), but we can't be sure and it's trivial to take in build4 or 3.6.5.

Comment 7

[Benjamin Smedberg]

Attachment: Test, rev. 1

Simple test

Comment 8

[Benjamin Smedberg]

http://hg.mozilla.org/mozilla-central/rev/2bdb71ccde71
http://hg.mozilla.org/mozilla-central/rev/6f0852700f3d

Comment 9

[LegNeato]

Comment on attachment 444425 [details] [diff] [review]
Patch, rev. 1

a=LegNeato for 1.9.2.4

Comment 10

[Benjamin Smedberg]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/146818ddcad0
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/403d707c3f63
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/5f6923f9b809
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/a7ce2bf845e4

Comment 11

[Al Billings [:abillings - ex-MoCo]]

(In reply to comment #0)
> Reproducible: Always
> 
> Steps to Reproduce:
> 1. Install O3D plugin from http://tools.google.com/dlpage/o3d
> 2. Open any demo from o3d sample catalog, for example, "The Journies of Prince
> IO" demo http://o3d.googlecode.com/svn/trunk/samples/io/io.html
> 3. Page will complain about unsupported user agent - click on "Ok" button
> Actual Results:  
> Minefield crashes


I tried this on a pre-fix 1.9.2 build and I'm not getting any crash at all on Windows XP (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.4) Gecko/20100503 Firefox/3.6.4 (.NET CLR 3.5.30729)).

Is there another set of repro steps for this?

Comment 12

[Oleg Kuznetsov]

(In reply to comment #11)
> I tried this on a pre-fix 1.9.2 build and I'm not getting any crash at all on
> Windows XP (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.4)
> Gecko/20100503 Firefox/3.6.4 (.NET CLR 3.5.30729)).
> 
> Is there another set of repro steps for this?

Sorry, I don't know. On my machine, the only version which crashed was only trunk/Minefield, stable release (3.6.4) didn't crashed.

Comment 13

[Benjamin Smedberg]

It was fairly easy to reproduce with a trunk build. I think you could probably reproduce with a branch build by:

* setting dom.ipc.plugins.enabled to true
* setting general.useragent.extra.firefox to Minefield instead of Firefox