Closed Bug 637282 Opened 13 years ago Closed 13 years ago

Crash [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstance::Transition(mozilla::plugins::PPluginInstance::State, mozilla::ipc::Trigger, mozilla::plugins::PPluginInstance::State*) ]

Categories

(Core Graveyard :: Plug-ins, defect)

x86
Windows 7
defect
Not set
critical

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: scoobidiver, Assigned: cjones)

References

Details

(Keywords: crash, regression)

Crash Data

It is a new crash signature that first appeared in 4.0b12pre/20110222.
It is currently #47 top crasher in 4.0b12.

Signature	mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstance::Transition(mozilla::plugins::PPluginInstance::State, mozilla::ipc::Trigger, mozilla::plugins::PPluginInstance::State*)
UUID	79a47188-ad81-4f5d-b702-758af2110228
Time 	2011-02-28 03:26:48.542361
Uptime	667
Install Age	77232 seconds (21.5 hours) since version was first installed.
Product	Firefox
Version	4.0b12
Build ID	20110222210221
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	AuthenticAMD family 15 model 107 stepping 1
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x6f6a1a39
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 9589, AdapterDriverVersion: 8.632.1.2000
xpcom_runtime_abort(###!!! ABORT: __delete__()d actor: file e:\builds\moz2_slave\rel-cen-w32-bld\build\obj-firefox\ipc\ipdl\_ipdlheaders\mozilla/plugins/PPluginInstance.h, line 524)

Frame 	Module 	Signature [Expand] 	Source
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:77
1 	xul.dll 	NS_DebugBreak_P 	xpcom/base/nsDebugImpl.cpp:350
2 	xul.dll 	mozilla::plugins::PPluginInstance::Transition 	obj-firefox/ipc/ipdl/_ipdlheaders/mozilla/plugins/PPluginInstance.h:524
3 	xul.dll 	mozilla::plugins::PPluginInstanceParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp:968
4 	xul.dll 	mozilla::plugins::PPluginModuleParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp:528
5 	xul.dll 	mozilla::ipc::AsyncChannel::OnDispatchMessage 	ipc/glue/AsyncChannel.cpp:262
6 	xul.dll 	mozilla::ipc::RPCChannel::Call 	ipc/glue/RPCChannel.cpp:244
7 	xul.dll 	mozilla::plugins::PPluginInstanceParent::Call__delete__ 	obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp:207
8 	xul.dll 	mozilla::plugins::PluginModuleParent::NPP_Destroy 	dom/plugins/PluginModuleParent.cpp:440
9 	xul.dll 	nsNPAPIPluginInstance::Stop 	modules/plugin/base/src/nsNPAPIPluginInstance.cpp:215
10 	xul.dll 	nsPluginHost::StopPluginInstance 	modules/plugin/base/src/nsPluginHost.cpp:3451
11 	xul.dll 	DoStopPlugin 	layout/generic/nsObjectFrame.cpp:2824
12 	xul.dll 	nsStopPluginRunnable::Run 	layout/generic/nsObjectFrame.cpp:2869
13 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
14 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
15 	xul.dll 	xul.dll@0xb2f7a7 	
16 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
17 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:202
18 	mozcrt19.dll 	_VEC_memzero 	
19 	xul.dll 	xul.dll@0x359b4d 	
20 	firefox.exe 	firefox.exe@0x1bb7 	
21 	ntdll.dll 	ntdll.dll@0x70ae4 	
22 	ntdll.dll 	ntdll.dll@0x39ed4 	
23 	firefox.exe 	firefox.exe@0x186f 	
24 	firefox.exe 	firefox.exe@0x186f

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=mozalloc_abort%28char%20const*%20const%29%20|%20NS_DebugBreak_P%20|%20mozilla%3A%3Aplugins%3A%3APPluginInstance%3A%3ATransition%28mozilla%3A%3Aplugins%3A%3APPluginInstance%3A%3AState%2C%20mozilla%3A%3Aipc%3A%3ATrigger%2C%20mozilla%3A%3Aplugins%3A%3APPluginInstance%3A%3AState*%29
Comment: "Pressed Alt+F4 inside a flash video then tried to close the browser (flash was not being display on the page anymore)"
Assignee: nobody → jones.chris.g
I think the user comment may be something of a red herring, but this crash is __delete__ racing with something, probably a paint message.  This looks like a pre-existing bug exacerbated by 626602 and friends.
Hm actually the code should be preventing this correctly; looks like something is trying to do work after NPP_Destroy() on the plugin side.
Pushed http://hg.mozilla.org/mozilla-central/rev/1cc322a175fe as a speculative fix for bug 637004; might fix this too.  Or bug 637278 might have made the volume of these decrease significantly.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Depends on: 637278, 637004
Went through several scenarios which led to this crash. E.g. Moving from iframe based pages (gmail.com) to another pages, installing quicktime plugin, moving from yahoo.com to another page. 

This is verified.
Status: RESOLVED → VERIFIED
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstance::Transition(mozilla::plugins::PPluginInstance::State, mozilla::ipc::Trigger, mozilla::plugins::PPluginInstance::State*) ]
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.