636114 - Crash [@ PluginBackgroundSink::~PluginBackgroundSink() ]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that first appeared in 4.0b12pre/20110209.
It is #65 top crasher in 4.0b12pre over the last week.

The first 3 frames of various stack traces are identical.

Signature	PluginBackgroundSink::~PluginBackgroundSink()
UUID	1f17b6d4-2a36-4b52-9f16-bf2482110222
Time 	2011-02-22 19:30:05.391042
Uptime	4227
Last Crash	3619081 seconds (6.0 weeks) before submission
Install Age	28914 seconds (8.0 hours) since version was first installed.
Product	Firefox
Version	4.0b12pre
Build ID	20110222030357
Branch	2.0
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
CPU	x86
CPU Info	GenuineIntel family 6 model 26 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0x1c3bde3c
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 6738, AdapterDriverVersion: 8.821.0.0

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	PluginBackgroundSink::~PluginBackgroundSink 	layout/generic/nsObjectFrame.cpp:653
1 	xul.dll 	PluginBackgroundSink::`vector deleting destructor' 	
2 	xul.dll 	nsAutoPtr<txList>::assign 	obj-firefox/dist/include/nsAutoPtr.h:71
3 	xul.dll 	mozilla::layers::ReadbackLayer::NotifyRemoved 	obj-firefox/dist/include/ReadbackLayer.h:155
4 	xul.dll 	mozilla::layers::ContainerLayer::DidRemoveChild 	
5 	xul.dll 	nsXULWindow::Destroy 	xpfe/appshell/src/nsXULWindow.cpp:555
6 	xul.dll 	nsWebShellWindow::Destroy 	xpfe/appshell/src/nsWebShellWindow.cpp:832
7 	xul.dll 	nsWebShellWindow::HandleEvent 	
8 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3771
9 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3809
10 	xul.dll 	nsWindow::DispatchStandardEvent 	widget/src/windows/nsWindow.cpp:3802
11 	xul.dll 	nsWindow::ProcessMessage 	
12 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4616
13 	xul.dll 	nsIMM32Handler::ProcessMessage 	widget/src/windows/nsIMM32Handler.cpp:401
14 	xul.dll 	nsIMM32Handler::ProcessMessage 	widget/src/windows/nsIMM32Handler.cpp:401
15 	xul.dll 	xul.dll@0x35acbd 	

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=PluginBackgroundSink%3A%3A~PluginBackgroundSink%28%29

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

It looks like mFrame is already dead here.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: [checked-in] fix?

This is all I can think of. It's perfectly safe and worth landing to see if it fixes the crash.

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Comment on attachment 514986 [details] [diff] [review]
[checked-in] fix?

Looked for a while and don't have any ideas.  Couldn't catch it in valgrind either.  Sigh, ok...

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I think we actually do need this patch whether or not it fixes the crash. Layers are refcounted so something could keep an old ReadbackLayer alive and we have no guarantee that we'll find the old one here, so an old PluginReadbackSink could still exist after we call SetSink(nsnull) on the new layer.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 514986 [details] [diff] [review]
[checked-in] fix?

Very very safe, may fix a topcrasher

Comment 6

[Rob Campbell [:rc] (:robcee)]

Comment on attachment 514986 [details] [diff] [review]
[checked-in] fix?

http://hg.mozilla.org/mozilla-central/rev/44f9507b17c7