Closed Bug 623108 Opened 14 years ago Closed 14 years ago

Flash crashes when reloading youtube since 2010/10/29


(Core :: Layout, defect)

Not set



Tracking Status
blocking2.0 --- betaN+


(Reporter: Mardak, Assigned: BenWa)



(Keywords: crash, regression, reproducible, Whiteboard: [hardblocker])

I was tracking down a regression range for bug 590955 and ended up somewhere in the ~2010/04/05 range (when OOPP was first enabled for flash on os x), but I wasn't able to consistently determine a good build as it didn't always crash.

But I noticed that trunk crashes much more easily than those builds from april. So for a simpler STR, I just load a youtube page, e.g., and hit cmd-r to reload. And it'll crash pretty consistently. Make sure to run in 32bit mode if you want a crash report.

The crash reports are the same as those in bug 590955 (going all the way back to april too), but something in that pushlog caused flash to crash much easier. Perhaps bug 604734?
blocking1.9.2: --- → ?
blocking1.9.2: ? → ---
blocking2.0: --- → ?
Keywords: reproducible
Severity: normal → critical
I found something suspicious, taking this to investigate.
Assignee: nobody → b56girard
blocking2.0: ? → betaN+
So far what I have found is that Flash is calling ConvertPoint, however instead of getting a response the browser process called NPP_Destroy, then once the plugin process returns from ConvertPoint the plugin instance has been destroyed presumably causing a crash within flash.

I'll look why we are calling NPP_Destroy in the middle of a ConvertPoint RPC call.

Also commenting out the ConvertPoint RPC call in the plugin process makes the crash go away.

Test logging I used to diagnose the problem (May not be useful to others):
Calling Convert Point
cast instance 0x2459A8C
ndata = 0x2459A60
PARENT: CallNPP_Destroy();
Destroy instance 0x2459A8C
ndata = 0x0
Destroy plugin instance

###!!! [Parent][RPCChannel] Error: Route error: message sent to unknown actor ID

Convert Point return
cast instance 0x2459A8C
ndata = 0x0
I believe this is a dup of bug 572134.
And is also probably the same as bug 617469, although the stacks are different.
I'm pretty sure this is a dupe of bug 617469, the stacks are sometimes different when reproducing it in that the last call isn't always NPN_ConvertPoint.
Closed: 14 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.