649271 - Plugin using X toolkit (Xt) API for event handling crashes on XtWindowToWidget call

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Kouichiro Morinaka]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0) Gecko/20100101 Firefox/4.0

IBM Lotus iNotes has a plugin which uses X toolkit (Xt) API to handle events.
Through some debugging turned out that the crash point was in NPP_SetWindow, when calling XtWindowToWidget before adding an event handler (XtAddEventHandler).

The crash can be reproduced using a sample plugin code in the Mozilla source tree so I suspect that information passed to NPP_SetWindow is invalid.


Reproducible: Always

Steps to Reproduce:
1. Build the test case plugin. (I will attach it later)
2. Create "plugins" directory in Firefox's application directory and copy the plugin in it.
3. Open test HTML included in the test case.

Actual Results:  
Plugin crashes. If you opened Firefox from terminal, error massage like below is shown:

Error: Couldn't find per display information

Expected Results:  
Plugin should work without crash.

The plugin contained in the test case is based on:

modules/plugin/sdk/samples/npruntime

gotten from http://releases.mozilla.org/pub/mozilla.org/firefox/releases/4.0/source/

I intended to demonstrate the crash in working code other than ours so the changes I added did nothing for the original plugin logic of the sample.

I found the code similar to our plugin in the unixprinting sample, but it didn't work (probably should be converted to npruntime plugin) so I used npruntime.

To build the sample I also needed to change npapi.h, because NPP_Initialize and NPP_Shutdown were no longer declared in it (where they've gone?).

Please refer diff.txt contained in the test case for the all changes I made to the original sample code.

Comment 1

[Boris Zbarsky [:bzbarsky]]

What does your XtWindowToWidget call look like?

> Please refer diff.txt contained in the test case

Did you forget to attach this?

Comment 2

[Kouichiro Morinaka]

Attachment: Test case

The archive contains:

npruntime (directory): test case based on the nuntime sample.
diff.txt: list of changes I made to create the test case.

Comment 3

[Kouichiro Morinaka]

(In reply to comment #1)
Sorry, took some time to attach the test case.
Please look that.

Comment 4

[Boris Zbarsky [:bzbarsky]]

So I assume the relevant code is:

>   NPSetWindowCallbackStruct *ws_info;
>   ws_info = (NPSetWindowCallbackStruct *)pNPWindow->ws_info;
> 
>   fprintf(stderr, "Before calling XtWindowToWidget\n");
>   Widget xt_w = XtWindowToWidget(ws_info->display, (Window)pNPWindow->window);

Is ws_info or ws_info->display ending up null?  What about pNPWindow->window?

Comment 5

[Kouichiro Morinaka]

It looks that ws_info, ws_info->display and pNPWindow->window are not null.

I added code like below:
(I needed to define XLIB_ILLEGAL_ACCESS to compile without error about Display)

  Display *dpy = ws_info->display;
  Window wnd = (Window)pNPWindow->window;

  fprintf(stderr, "Value of Window: %x\n", wnd);
  fprintf(stderr, "Value of Display*: %x\n", dpy);
  fprintf(stderr, "Display name: %s\n", dpy->display_name);

and got the results like below:

  Value of Window: 4400001
  Value of Display*: b7668000
  Display name: :0.0

Comment 6

[William Bardwell]

We are seeing a similar crash on Linux from similar code.  If we turn off plugin-container (by setting dom.ipc.plugins.enabled to false in about:config) then it works fine.

Comment 7

[William Bardwell]

This might be a duplicate of [Bug 544088] which is a pretty bad issue.