Closed Bug 574762 Opened 11 years ago Closed 10 years ago

Crash in [@ SetPluginParameter ]


(Core :: Plug-ins, defect)

Not set



Tracking Status
status2.0 --- ?


(Reporter: marcia, Unassigned)




(Keywords: crash, regression)

Crash Data

Seen while running Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a6pre) Gecko/20100625 Minefield/3.7a6pre

1. Load site in URL.
2. Crash

Frame  	Module  	Signature [Expand]  	Source
0 	QuickTime Plugin 	SetPluginParameter 	
1 	QuickTime Plugin 	initMovieSettings 	
2 	QuickTime Plugin 	NPP_New 	
3 	QuickTime Plugin 	WebHelper_Private_New 	
4 	XUL 	mozilla::PluginPRLibrary::NPP_New 	modules/plugin/base/src/PluginPRLibrary.cpp:183
5 	XUL 	nsNPAPIPluginInstance::InitializePlugin 	modules/plugin/base/src/nsNPAPIPluginInstance.cpp:1210
6 	XUL 	nsPluginHost::TrySetUpPluginInstance 	modules/plugin/base/src/nsPluginHost.cpp:2562
7 	XUL 	nsPluginHost::SetUpPluginInstance 	modules/plugin/base/src/nsPluginHost.cpp:2443
8 	XUL 	nsPluginHost::InstantiateEmbeddedPlugin 	modules/plugin/base/src/nsPluginHost.cpp:2225
9 	XUL 	nsPluginStreamListenerPeer::OnStartRequest 	modules/plugin/base/src/nsPluginHost.cpp:1045
10 	XUL 	nsObjectLoadingContent::OnStartRequest 	content/base/src/nsObjectLoadingContent.cpp:732
11 	XUL 	nsHttpChannel::CallOnStartRequest 	netwerk/protocol/http/nsHttpChannel.cpp:826
12 	XUL 	nsHttpChannel::ProcessNormal 	netwerk/protocol/http/nsHttpChannel.cpp:1150
13 	XUL 	nsHttpChannel::ProcessResponse 	netwerk/protocol/http/nsHttpChannel.cpp:1002
14 	XUL 	nsHttpChannel::OnStartRequest 	netwerk/protocol/http/nsHttpChannel.cpp:4221
15 	XUL 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:441
16 	XUL 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:112
17 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:547
18 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
19 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:126
20 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/
21 	CoreFoundation 	__CFRunLoopDoSources0 	
22 	CoreFoundation 	__CFRunLoopRun 	
23 	CoreFoundation 	CFRunLoopRunSpecific 	
24 	CoreFoundation 	CFRunLoopRunInMode 	
25 	HIToolbox 	RunCurrentEventLoopInMode 	
26 	HIToolbox 	ReceiveNextEventCommon 	
27 	HIToolbox 	BlockUntilNextEventMatchingListInMode 	
28 	AppKit 	_DPSNextEvent 	
29 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
30 	AppKit 	-[NSApplication run] 	
31 	XUL 	nsAppShell::Run 	widget/src/cocoa/
32 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:192
33 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3623
34 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
35 	firefox-bin 	firefox-bin@0xbf5 	
36 		@0x3
Happens using Windows as well, changing to all.

Will try to find a regression window.
OS: Mac OS X → All
Hardware: x86 → All
On windows, I get a crash in  [@ free | nsPluginInstanceOwner::~nsPluginInstanceOwner() ] . See
Works: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a6pre) Gecko/20100623 Minefield/3.7a6pre

Broken: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a6pre) Gecko/20100624 Minefield/3.7a6pre

I bisected the range in comment 3, which lead to this:

The first bad revision is:
changeset:   44204:e910fd948e5b
user:        Ben Turner <>
date:        Wed Jun 23 12:46:08 2010 -0700
summary:     Bug 553413 - 'Implement Asynchronous parts of the Indexed Database API.' p=sdwilsh+bent, r=jst.

It doesn't make much sense to me though.
er...our diff doesn't even touch anything this code would use, right?
This seems to crash in Beta 1 quite easily on the Mac using Using the site in the URL, I don't crash right away in B1.
Closed: 10 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: CVE-2010-2755
Crash Signature: [@ SetPluginParameter ]
You need to log in before you can comment on or make changes to this bug.