620668 - spike in crashes [@ nsAString_internal::IsEmpty() ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature that exist in 3.5, 3.6 and trunk builds.
There is a spike in crashes from 4.0b9pre/20101220.
It is #10 top crasher in this build.

Signature	nsAString_internal::IsEmpty()
UUID	ec881959-cc9f-447e-9dd9-1c4832101221
Time 	2010-12-21 04:25:40.770040
Uptime	36207
Install Age	47959 seconds (13.3 hours) since version was first installed.
Product	Firefox
Version	4.0b9pre
Build ID	20101220030345
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x14
User Comments	
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: 2a42
MSAFD Tcpip [TCP/IP] : 2 : 1 :
MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll
RSVP UDP Service Provider : 6 : 2 : %SystemRoot%\system32\rsvpsp.dll
RSVP TCP Service Provider : 6 : 1 : %SystemRoot%\system32\rsvpsp.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{F0A47259-0106-48BF-A2F8-350017895B35}] SEQPACKET 7 : 2 : 5 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{F0A47259-0106-48BF-A2F8-350017895B35}] DATAGRAM 7 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{C92DDFC3-1145-437E-922D-9ABDE669EA34}] SEQPACKET 4 : 2 : 5 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{C92DDFC3-1145-437E-922D-9ABDE669EA34}] DATAGRAM 4 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{8962F6BF-FD76-42C7-B2FC-12FC31420EFF}] SEQPACKET 3 : 2 : 5 : %SystemRoot%\syste

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsAString_internal::IsEmpty 	obj-firefox/dist/include/nsTSubstring.h:218
1 	xul.dll 	nsPluginHost::HandleBadPlugin 	modules/plugin/base/src/nsPluginHost.cpp:3420
2 	xul.dll 	nsCOMPtr<nsIPluginHost>::nsCOMPtr<nsIPluginHost> 	obj-firefox/dist/include/nsCOMPtr.h:635
3 	mozcrt19.dll 	_CallSettingFrame 	lowhelpr.asm:71
4 	mozcrt19.dll 	_CallCatchBlock2 	trnsctrl.cpp:512
5 	mozcrt19.dll 	CallCatchBlock 	frame.cpp:1463
6 	mozcrt19.dll 	CatchIt 	frame.cpp:1273
7 	mozcrt19.dll 	FindHandlerForForeignException 	frame.cpp:974
8 	mozcrt19.dll 	FindHandler 	frame.cpp:866
9 	mozcrt19.dll 	__InternalCxxFrameHandler 	frame.cpp:524
10 	mozcrt19.dll 	__CxxFrameHandler3 	trnsctrl.cpp:311
11 	ntdll.dll 	ExecuteHandler2@20 	

The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=be8006fc9c4a&tochange=fc50c521bf48

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsAString_internal%3A%3AIsEmpty%28%29

Comment 1

[Benjamin Smedberg]

The full stack is:

 	xul.dll!nsAString_internal::IsEmpty()  Line 218	C++
 	xul.dll!nsPluginHost::HandleBadPlugin(aLibrary=0x00000000, aInstance=0x09a95340)  Line 3420	C++
 	xul.dll!nsCOMPtr<nsIPluginHost>::nsCOMPtr<nsIPluginHost>(gs={...})  Line 636	C++
 	mozcrt19.dll!_CallSettingFrame(funclet=0x0012dbe4, pRN=0x00000100, dwInCode=0x0012d68c)  Line 73	Asm
 	mozcrt19.dll!_CallCatchBlock2(pRN=0x0012dbe4, pFuncInfo=0x10c3c68c, handlerAddress=0x10943716, CatchDepth=0x00000000, NLGCode=0x00000100)  Line 512	C++
 	mozcrt19.dll!CallCatchBlock(pExcept=0x0012d8c0, pRN=0x0012dbe4, pContext=0x00000001, pFuncInfo=0x10c3c68c, handlerAddress=0x00000000, CatchDepth=0x00000000, NLGCode=0x00000100)  Line 1463	C++
 	mozcrt19.dll!CatchIt(pExcept=0x0012d8c0, pRN=0x00000000, pContext=0x0012d8dc, pDC=0x0012d894, pFuncInfo=0x10c3c68c, pCatch=0x00000000, pConv=0x00000000, pEntry=0x00000000, CatchDepth=0x00000000, pMarkerRN=0x00000000, IsRethrow='')  Line 1273	C++
 	mozcrt19.dll!FindHandlerForForeignException(pExcept=0x0012d8c0, pRN=0x0012dbe4, pContext=0x0012d8dc, pDC=0x0012d894, pFuncInfo=0x10c3c68c, curState=0x00000000, CatchDepth=0x00000000, pMarkerRN=0x00000000)  Line 974	C++
 	mozcrt19.dll!FindHandler(pExcept=0x0012d8c0, pRN=0x0012dbe4, pContext=0x0012d8dc, pDC=0x0012d894, pFuncInfo=0x10c3c68c, recursive=0x00, CatchDepth=0x00000000, pMarkerRN=0x00000000)  Line 866	C++
 	mozcrt19.dll!__InternalCxxFrameHandler(pExcept=0x0012d8c0, pRN=0x0012dbe4, pContext=0x0012d8dc, pDC=0x0012d894, pFuncInfo=0x10c3c68c, CatchDepth=0x00000000, pMarkerRN=0x00000000, recursive=0x00)  Line 524	C++
 	mozcrt19.dll!__CxxFrameHandler3(pExcept=0x0012dbe4, pRN=0x0012d8dc, pContext=0x0012d894, pDC=0x0012dbe4)  Line 311	C++
 	ntdll.dll!ExecuteHandler2@20() 	
 	ntdll.dll!ExecuteHandler@20() 	
 	ntdll.dll!_KiUserExceptionDispatcher@8() 	
 	0073006f()	
>	xul.dll!nsNPAPIPluginInstance::Stop()  Line 213	C++
 	xul.dll!DoStopPlugin(aInstanceOwner=0x09a95340, aDelayedStop=0x00000000)  Line 2522	C++
 	xul.dll!nsStopPluginRunnable::Run()  Line 2569	C++
 	xul.dll!nsThread::ProcessNextEvent(mayWait=0x0035b402, result=0x2c427619)  Line 632	C++
 	nspr4.dll!PR_AssertCurrentThreadOwnsLock(lock=)  Line 404	C
 	xul.dll!MessageLoop::RunHandler()  Line 203	C++
 	xul.dll!MessageLoop::Run()  Line 177	C++
 	xul.dll!nsBaseAppShell::Run()  Line 198	C++
 	xul.dll!nsAppShell::Run()  Line 264	C++
 	xul.dll!nsAppStartup::Run()  Line 192	C++
 	xul.dll!XRE_main(argc=0x00000001, argv=0x0082b0a8, aAppData=0x008131c0)  Line 3695	C++

At http://hg.mozilla.org/mozilla-central/annotate/fc50c521bf48/modules/plugin/base/src/nsPluginHost.cpp#l3420 pluginTag is null.

Tentatively blocking.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: wallpaper fix

I guess this could happen if the plugin does something bad during destruction after we've disabled it.

Comment 3

[Benjamin Smedberg]

Comment on attachment 499110 [details] [diff] [review]
wallpaper fix

Josh wrote this, so I'm going to punt to him.

Comment 4

[Jacek Caban]

http://hg.mozilla.org/mozilla-central/rev/fdbca21063bf

Comment 5

[Jacek Caban]

bustage fix:
http://hg.mozilla.org/mozilla-central/rev/572175c2a64f

Comment 7

[LegNeato]

As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if  you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)