620223 - crash [@ RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>() ]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Alice0775 White]

Build Identifier:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b9pre) Gecko/20101217
Firefox/4.0b9pre ID:20101217030324

After toggle enable/disable plug-ins several times,
Browser crashes on exit.
Maybe related to Bug 620114.

Reproducible: Always

Steps to Reproduce:
1. Start Minefield + Silverlight plug-ins + other Plug-ins
2. Open Add-ons Manager, and select "Plug-ins" pane
3. Toggle enable/disable plug-ins several times
4. repeat start 1-3

Actual Results:
 Browser crashes on exit with crash reports.
 bp-e8f16ed1-5ca8-46dd-9d1e-57d042101219

Expected Results:
 Should not crash

Comment 1

[timeless]

Signature	RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>()
UUID	e8f16ed1-5ca8-46dd-9d1e-57d042101219
Time	2010-12-19 03:53:36.353260
Uptime	97
Last Crash	80089 seconds (22.2 hours) before submission
Install Age	75266 seconds (20.9 hours) since version was first installed.
Product	Firefox
Version	4.0b9pre
Build ID	20101218030347
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_STACK_OVERFLOW
Crash Address	0x659f40a0
Processor Notes	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	False
Crashing Thread

Frame	Module	Signature [Expand]	Source
0	xul.dll	RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>	obj-firefox/dist/include/nsAutoPtr.h:969
1	xul.dll	nsInvalidPluginTag::~nsInvalidPluginTag	modules/plugin/base/src/nsPluginHost.cpp:251
2	xul.dll	nsInvalidPluginTag::`scalar deleting destructor'	
3	xul.dll	nsEmbedStream::Release	js/src/xpconnect/src/xpccomponents.cpp:3448
4	xul.dll	RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>	obj-firefox/dist/include/nsAutoPtr.h:969
5	xul.dll	nsInvalidPluginTag::~nsInvalidPluginTag	modules/plugin/base/src/nsPluginHost.cpp:251
6	xul.dll	nsInvalidPluginTag::`scalar deleting destructor'

Comment 2

[timeless]

74 class nsInvalidPluginTag : public nsISupports
75 {
76 public:
77   nsInvalidPluginTag(const char* aFullPath, PRInt64 aLastModifiedTime = 0);
78   virtual ~nsInvalidPluginTag();
79   
80   NS_DECL_ISUPPORTS
81   
82   nsCString   mFullPath;
83   PRInt64     mLastModifiedTime;
84   bool        mSeen;
85   
86   nsRefPtr<nsInvalidPluginTag> mPrev;
87   nsRefPtr<nsInvalidPluginTag> mNext;
88 };

248 nsInvalidPluginTag::~nsInvalidPluginTag()
249 {
250   
251 }

mPrev/mNext in a doubly linked list without a useful destructor is a recipe for disaster.

Comment 3

[Wayne Mery (:wsmwk)]

Alice, can you reproduce?

WFM Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:16.0) Gecko/16.0 Firefox/16.0a1

Comment 4

[Alice0775 White]

I cannot reproduce anymore in
http://hg.mozilla.org/releases/mozilla-esr10/rev/5713c92407dd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.5) Gecko/20100101 Firefox/10.0.5 ID:20120531185831
and
http://hg.mozilla.org/releases/mozilla-release/rev/f48d675ffa9f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1 ID:20120614114901

set WFM