crash [@ RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>() ]

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
8 years ago
6 years ago

People

(Reporter: alice0775, Unassigned)

Tracking

({crash})

Trunk
mozilla2.0
x86
Windows 7
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [closeme 2012-07-15], crash signature)

(Reporter)

Description

8 years ago
Build Identifier:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b9pre) Gecko/20101217
Firefox/4.0b9pre ID:20101217030324

After toggle enable/disable plug-ins several times,
Browser crashes on exit.
Maybe related to Bug 620114.

Reproducible: Always

Steps to Reproduce:
1. Start Minefield + Silverlight plug-ins + other Plug-ins
2. Open Add-ons Manager, and select "Plug-ins" pane
3. Toggle enable/disable plug-ins several times
4. repeat start 1-3

Actual Results:
 Browser crashes on exit with crash reports.
 bp-e8f16ed1-5ca8-46dd-9d1e-57d042101219

Expected Results:
 Should not crash
(Reporter)

Updated

8 years ago
Severity: normal → critical

Comment 1

8 years ago
Signature	RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>()
UUID	e8f16ed1-5ca8-46dd-9d1e-57d042101219
Time	2010-12-19 03:53:36.353260
Uptime	97
Last Crash	80089 seconds (22.2 hours) before submission
Install Age	75266 seconds (20.9 hours) since version was first installed.
Product	Firefox
Version	4.0b9pre
Build ID	20101218030347
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_STACK_OVERFLOW
Crash Address	0x659f40a0
Processor Notes	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	False
Crashing Thread

Frame	Module	Signature [Expand]	Source
0	xul.dll	RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>	obj-firefox/dist/include/nsAutoPtr.h:969
1	xul.dll	nsInvalidPluginTag::~nsInvalidPluginTag	modules/plugin/base/src/nsPluginHost.cpp:251
2	xul.dll	nsInvalidPluginTag::`scalar deleting destructor'	
3	xul.dll	nsEmbedStream::Release	js/src/xpconnect/src/xpccomponents.cpp:3448
4	xul.dll	RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>	obj-firefox/dist/include/nsAutoPtr.h:969
5	xul.dll	nsInvalidPluginTag::~nsInvalidPluginTag	modules/plugin/base/src/nsPluginHost.cpp:251
6	xul.dll	nsInvalidPluginTag::`scalar deleting destructor'

Comment 2

8 years ago
74 class nsInvalidPluginTag : public nsISupports
75 {
76 public:
77   nsInvalidPluginTag(const char* aFullPath, PRInt64 aLastModifiedTime = 0);
78   virtual ~nsInvalidPluginTag();
79   
80   NS_DECL_ISUPPORTS
81   
82   nsCString   mFullPath;
83   PRInt64     mLastModifiedTime;
84   bool        mSeen;
85   
86   nsRefPtr<nsInvalidPluginTag> mPrev;
87   nsRefPtr<nsInvalidPluginTag> mNext;
88 };

248 nsInvalidPluginTag::~nsInvalidPluginTag()
249 {
250   
251 }

mPrev/mNext in a doubly linked list without a useful destructor is a recipe for disaster.
(Assignee)

Updated

8 years ago
Crash Signature: [@ RefPtr<ID2D1BitmapBrush>::~RefPtr<ID2D1BitmapBrush>() ]

Comment 3

6 years ago
Alice, can you reproduce?

WFM Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:16.0) Gecko/16.0 Firefox/16.0a1
Whiteboard: [closeme 2012-07-15]
(Reporter)

Comment 4

6 years ago
I cannot reproduce anymore in
http://hg.mozilla.org/releases/mozilla-esr10/rev/5713c92407dd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.5) Gecko/20100101 Firefox/10.0.5 ID:20120531185831
and
http://hg.mozilla.org/releases/mozilla-release/rev/f48d675ffa9f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1 ID:20120614114901

set WFM
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.