Closed Bug 620794 Opened 15 years ago Closed 13 years ago

crash in nsPluginInstanceOwner::ProcessEvent @ nsNPAPIPluginInstance::HandleEvent

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
blocking2.0 --- -

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

It is a new crash signature that exists in trunk. There is a spike in crashes from 4.0b9pre/20101220. It is #4 top crasher on Mac OS X in this build. Dupe of bug 620512? Signature nsNPAPIPluginInstance::HandleEvent UUID 0e5fa578-5415-4427-84e6-3ff052101221 Time 2010-12-21 13:54:13.932415 Uptime 19247 Install Age 92319 seconds (1.1 days) since version was first installed. Product Firefox Version 4.0b9pre Build ID 20101220030345 Branch 2.0 OS Mac OS X OS Version 10.6.3 10D573 CPU amd64 CPU Info family 6 model 15 stepping 6 Crash Reason EXC_BAD_ACCESS / 0x0000000d Crash Address 0x0 App Notes Renderers: 0x22600,0x20400 Frame Module Signature [Expand] Source 0 XUL nsNPAPIPluginInstance::HandleEvent modules/plugin/base/src/nsNPAPIPluginInstance.cpp:587 1 XUL nsPluginInstanceOwner::ProcessEvent layout/generic/nsObjectFrame.cpp:5010 2 XUL nsObjectFrame::HandleEvent layout/generic/nsObjectFrame.cpp:2232 3 XUL nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:386 4 XUL nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:628 5 XUL PresShell::HandleEventInternal layout/base/nsPresShell.cpp:6949 6 XUL PresShell::HandleEvent layout/base/nsPresShell.cpp:6688 7 XUL nsViewManager::DispatchEvent view/src/nsViewManager.cpp:1092 8 XUL HandleEvent view/src/nsView.cpp:161 9 XUL nsChildView::DispatchEvent widget/src/cocoa/nsChildView.mm:1786 10 XUL nsChildView::DispatchWindowEvent widget/src/cocoa/nsChildView.mm:1796 11 XUL -[ChildView updatePluginTopLevelWindowStatus:] widget/src/cocoa/nsChildView.mm:2293 12 XUL -[ChildView windowResignedMain:] widget/src/cocoa/nsChildView.mm:2315 13 Foundation Foundation@0x1086d 14 CoreFoundation CoreFoundation@0xe4cf 15 CoreFoundation CoreFoundation@0x58ae9 16 CoreFoundation CoreFoundation@0xf75e 17 libobjc.A.dylib libobjc.A.dylib@0x70e5 18 CoreFoundation CoreFoundation@0x45097 19 CoreFoundation CoreFoundation@0x24444 20 CoreFoundation CoreFoundation@0x84d7 21 CoreFoundation CoreFoundation@0x242b8 22 Foundation Foundation@0x78e6 23 Foundation Foundation@0x77d7 24 AppKit AppKit@0x73d857 25 AppKit AppKit@0x390e9 26 AppKit AppKit@0x770991 27 AppKit AppKit@0x73f77f 28 AppKit AppKit@0x786a1f 29 AppKit AppKit@0x771317 30 AppKit AppKit@0x38d4b 31 AppKit AppKit@0x38cb1 32 XUL nsCocoaWindow::Show widget/src/cocoa/nsCocoaWindow.mm:722 33 XUL nsXULWindow::SetVisibility xpfe/appshell/src/nsXULWindow.cpp:817 34 XUL nsXULWindow::OnChromeLoaded xpfe/appshell/src/nsXULWindow.cpp:1036 35 XUL nsWebShellWindow::OnStateChange xpfe/appshell/src/nsWebShellWindow.cpp:602 36 XUL nsDocLoader::FireOnStateChange uriloader/base/nsDocLoader.cpp:1334 37 XUL nsDocLoader::DocLoaderIsEmpty uriloader/base/nsDocLoader.cpp:953 38 XUL nsDocLoader::OnStopRequest uriloader/base/nsDocLoader.cpp:702 39 XUL nsLoadGroup::RemoveRequest netwerk/base/src/nsLoadGroup.cpp:680 40 XUL nsDocument::DoUnblockOnload content/base/src/nsDocument.cpp:7269 41 XUL nsBindingManager::DoProcessAttachedQueue content/xbl/src/nsBindingManager.cpp:999 42 XUL nsRunnableMethodImpl<void ,true>::Run nsThreadUtils.h:345 43 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:626 44 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:200 45 XUL nsBaseAppShell::NativeEventCallback widget/src/xpwidgets/nsBaseAppShell.cpp:132 46 XUL nsAppShell::ProcessGeckoEvents widget/src/cocoa/nsAppShell.mm:399 47 CoreFoundation CoreFoundation@0x4df20 48 CoreFoundation CoreFoundation@0x4c118 49 CoreGraphics CoreGraphics@0x2e9f 50 libSystem.B.dylib libSystem.B.dylib@0x85bd 51 libSystem.B.dylib libSystem.B.dylib@0x4b2e 52 libSystem.B.dylib libSystem.B.dylib@0x6f79 53 libnspr4.dylib PR_Unlock nsprpub/pr/src/pthreads/ptsynch.c:237 54 libSystem.B.dylib libSystem.B.dylib@0x6f79 55 XUL nsDOMEventRTTearoff::Release nsCOMPtr.h:492 56 XUL nsXULTooltipListener::MouseMove nsCOMPtr.h:492 57 @0x13af9f4cf 58 libSystem.B.dylib libSystem.B.dylib@0x85bd 59 libSystem.B.dylib libSystem.B.dylib@0xa65a 60 libSystem.B.dylib libSystem.B.dylib@0x5686 61 CoreFoundation CoreFoundation@0x60579 62 libSystem.B.dylib libSystem.B.dylib@0x9d83 63 libSystem.B.dylib libSystem.B.dylib@0x85bd 64 CarbonCore CarbonCore@0x22945 65 CarbonCore CarbonCore@0x22854 66 HIToolbox HIToolbox@0x55155 67 HIToolbox HIToolbox@0x301f1 68 HIToolbox HIToolbox@0x3013c 69 libSystem.B.dylib libSystem.B.dylib@0x4b2e 70 HIToolbox HIToolbox@0x2fd6f 71 CoreFoundation CoreFoundation@0x500c2 72 XUL nsCacheProfilePrefObserver::Observe netwerk/cache/nsCacheService.cpp:405 The regression range for the spike is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=be8006fc9c4a&tochange=fc50c521bf48 More reports at: http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsNPAPIPluginInstance%3A%3AHandleEvent
blocking2.0: --- → ?
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b9pre) Gecko/20101220 Firefox/4.0b9pre ID:20101220030345 This crash happened right now for me, while I was working on a patch review on Bugzilla. By switching to another application, Firefox crashed. See: bp-dbfa063c-35f4-42da-928b-87c852101223
OK, I backed out part 5 of bug 617152 to try to fix this bug, bug 621099, and bug 620955.
As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)
No longer blocks: 617152
blocking2.0: beta9+ → betaN+
Keywords: crash, regression
Blocks: 617152
Keywords: crash, regression
The spike is gone but it is not fixed in 4.0b11: #21 top crasher on Mac OS X. I am reopening it.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(adding hardblocker so we can evaluate)
Whiteboard: [hardblocker]
And we decided not to block!
blocking2.0: betaN+ → -
Whiteboard: [hardblocker]
Crash Signature: [@ nsNPAPIPluginInstance::HandleEvent ]
I can crash reproducibly with this stacktrace in a complicated case, where I first had to tap on the "Tap here to activate plugin" plugin placeholder and then opened the camera dialog, by tapping on the input type=file capture button. After that, some dynamic dom stuff was going on on that page, which seems to have caused the crash. Normally, when the capture dialog is open, the page can't be modified, everything is frozen in that state, but the "Tap here to activate plugin" plugin placeholder causes the page to be in the chrome process, I think, and that enables the page to be dynamically changed. This was tested on a EEE Tranformer, nightly build. The fact that the "Tap here to activate plugin" plugin placeholder can be seen at all on Honeycomb is bug 695826. I got this crash while investigating bug 695875.
OS: Mac OS X → All
Hardware: x86_64 → All
I filed bug 758872 for STR in comment 10. There are no crashes in Firefox versions above 4.0 over the last four weeks. I close it as WFM.
Status: REOPENED → RESOLVED
Closed: 15 years ago → 13 years ago
OS: All → Mac OS X
Hardware: All → x86_64
Resolution: --- → WORKSFORME
Summary: crash [@ nsNPAPIPluginInstance::HandleEvent ] → crash in nsPluginInstanceOwner::ProcessEvent @ nsNPAPIPluginInstance::HandleEvent
You need to log in before you can comment on or make changes to this bug.