Crash [@ PluginBackgroundSink::~PluginBackgroundSink() ]

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
9 years ago
8 years ago

People

(Reporter: scoobidiver, Assigned: roc)

Tracking

({crash, regression})

Trunk
x86
Windows 7
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

It is a new crash signature that first appeared in 4.0b12pre/20110209.
It is #65 top crasher in 4.0b12pre over the last week.

The first 3 frames of various stack traces are identical.

Signature	PluginBackgroundSink::~PluginBackgroundSink()
UUID	1f17b6d4-2a36-4b52-9f16-bf2482110222
Time 	2011-02-22 19:30:05.391042
Uptime	4227
Last Crash	3619081 seconds (6.0 weeks) before submission
Install Age	28914 seconds (8.0 hours) since version was first installed.
Product	Firefox
Version	4.0b12pre
Build ID	20110222030357
Branch	2.0
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
CPU	x86
CPU Info	GenuineIntel family 6 model 26 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0x1c3bde3c
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 6738, AdapterDriverVersion: 8.821.0.0

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	PluginBackgroundSink::~PluginBackgroundSink 	layout/generic/nsObjectFrame.cpp:653
1 	xul.dll 	PluginBackgroundSink::`vector deleting destructor' 	
2 	xul.dll 	nsAutoPtr<txList>::assign 	obj-firefox/dist/include/nsAutoPtr.h:71
3 	xul.dll 	mozilla::layers::ReadbackLayer::NotifyRemoved 	obj-firefox/dist/include/ReadbackLayer.h:155
4 	xul.dll 	mozilla::layers::ContainerLayer::DidRemoveChild 	
5 	xul.dll 	nsXULWindow::Destroy 	xpfe/appshell/src/nsXULWindow.cpp:555
6 	xul.dll 	nsWebShellWindow::Destroy 	xpfe/appshell/src/nsWebShellWindow.cpp:832
7 	xul.dll 	nsWebShellWindow::HandleEvent 	
8 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3771
9 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3809
10 	xul.dll 	nsWindow::DispatchStandardEvent 	widget/src/windows/nsWindow.cpp:3802
11 	xul.dll 	nsWindow::ProcessMessage 	
12 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4616
13 	xul.dll 	nsIMM32Handler::ProcessMessage 	widget/src/windows/nsIMM32Handler.cpp:401
14 	xul.dll 	nsIMM32Handler::ProcessMessage 	widget/src/windows/nsIMM32Handler.cpp:401
15 	xul.dll 	xul.dll@0x35acbd 	

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=PluginBackgroundSink%3A%3A~PluginBackgroundSink%28%29
It looks like mFrame is already dead here.
Blocks: 626602
This is all I can think of. It's perfectly safe and worth landing to see if it fixes the crash.
Assignee: nobody → roc
Attachment #514986 - Flags: review?(jones.chris.g)
Comment on attachment 514986 [details] [diff] [review]
[checked-in] fix?

Looked for a while and don't have any ideas.  Couldn't catch it in valgrind either.  Sigh, ok...
Attachment #514986 - Flags: review?(jones.chris.g) → review+
I think we actually do need this patch whether or not it fixes the crash. Layers are refcounted so something could keep an old ReadbackLayer alive and we have no guarantee that we'll find the old one here, so an old PluginReadbackSink could still exist after we call SetSink(nsnull) on the new layer.
Comment on attachment 514986 [details] [diff] [review]
[checked-in] fix?

Very very safe, may fix a topcrasher
Attachment #514986 - Flags: approval2.0?
Attachment #514986 - Flags: approval2.0? → approval2.0+
Keywords: checkin-needed
Whiteboard: [needs landing]
Comment on attachment 514986 [details] [diff] [review]
[checked-in] fix?

http://hg.mozilla.org/mozilla-central/rev/44f9507b17c7
Attachment #514986 - Attachment description: fix? → [checked-in] fix?
Status: NEW → RESOLVED
Closed: 9 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Whiteboard: [needs landing]
Crash Signature: [@ PluginBackgroundSink::~PluginBackgroundSink() ]
You need to log in before you can comment on or make changes to this bug.