70280 - crash in ns4xPluginInstance::HandleEvent

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[shrirang khanzode]

filing this bug from the top talkback traces for 6.01 
Am still trying to get reproducible steps for this bug...

Stack Trace: 

         ns4xPluginInstance::HandleEvent        
[d:\builds\6.01\mozilla\modules\plugin\nglsrc\ns4xPluginInstance.cpp  line 723] 
         nsPluginInstanceOwner::ProcessEvent    
[d:\builds\6.01\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 2617] 
         nsPluginInstanceOwner::DispatchKeyToPlugin     
[d:\builds\6.01\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 2569] 
         nsPluginInstanceOwner::MouseUp 
[d:\builds\6.01\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 2535] 
         nsEventListenerManager::HandleEvent    
[d:\builds\6.01\mozilla\layout\events\src\nsEventListenerManager.cpp  line 866] 
         nsGenericElement::HandleDOMEvent       
[d:\builds\6.01\mozilla\layout\base\src\nsGenericElement.cpp  line 1405] 
         nsHTMLHtmlElement::HandleDOMEvent      
[d:\builds\6.01\mozilla\layout\html\content\src\nsHTMLHtmlElement.cpp  line 186] 
         PresShell::HandleEventInternal 
[d:\builds\6.01\mozilla\layout\html\base\src\nsPresShell.cpp  line 4918] 
         PresShell::HandleEventWithTarget       
[d:\builds\6.01\mozilla\layout\html\base\src\nsPresShell.cpp  line 4898] 
         nsEventStateManager::CheckForAndDispatchClick  
[d:\builds\6.01\mozilla\layout\events\src\nsEventStateManager.cpp  line 1864] 
         nsEventStateManager::PostHandleEvent   
[d:\builds\6.01\mozilla\layout\events\src\nsEventStateManager.cpp  line 931] 
         PresShell::HandleEventInternal 
[d:\builds\6.01\mozilla\layout\html\base\src\nsPresShell.cpp  line 4939] 
         PresShell::HandleEvent 
[d:\builds\6.01\mozilla\layout\html\base\src\nsPresShell.cpp  line 4853] 
         nsView::HandleEvent    [d:\builds\6.01\mozilla\view\src\nsView.cpp  
line 379] 
         nsView::HandleEvent    [d:\builds\6.01\mozilla\view\src\nsView.cpp  
line 352] 
         nsView::HandleEvent    [d:\builds\6.01\mozilla\view\src\nsView.cpp  
line 352] 
         nsView::HandleEvent    [d:\builds\6.01\mozilla\view\src\nsView.cpp  
line 352] 
         nsViewManager2::DispatchEvent  
[d:\builds\6.01\mozilla\view\src\nsViewManager2.cpp  line 1439] 
         HandleEvent    [d:\builds\6.01\mozilla\view\src\nsView.cpp  line 68] 
         nsWindow::DispatchEvent        
[d:\builds\6.01\mozilla\widget\src\windows\nsWindow.cpp  line 686] 
         nsWindow::DispatchWindowEvent  
[d:\builds\6.01\mozilla\widget\src\windows\nsWindow.cpp  line 703] 
         nsWindow::DispatchMouseEvent   
[d:\builds\6.01\mozilla\widget\src\windows\nsWindow.cpp  line 3914] 
         ChildWindow::DispatchMouseEvent        
[d:\builds\6.01\mozilla\widget\src\windows\nsWindow.cpp  line 4122] 
         nsWindow::ProcessMessage       
[d:\builds\6.01\mozilla\widget\src\windows\nsWindow.cpp  line 2998] 
         nsWindow::WindowProc   
[d:\builds\6.01\mozilla\widget\src\windows\nsWindow.cpp  line 959] 
         NPSWF32.DLL + 0xbb7a (0x10aabb7a)  
         NPSWF32.DLL + 0xae46 (0x10aaae46)  
         KERNEL32.DLL + 0x248f7 (0xbff848f7)  
         0x00658b5e  
         0x00058f64

Comment 1

[av (gone)]

Futuring this till we have reproduceable steps and/or a testcase.

Comment 2

[Peter Lubczynski]

I thought I was only seeing this in debug builds, but I guess now. You can 
trigger it by clicking on Quicktime content. I think Event or NPP->pdata is bad. 
A simple check will work. I think there is a patch in another bug.

Comment 3

[av (gone)]

Yes, and I just checked it in. But I still see the crash in HandleEvent which 
can be cured by checking if(mStarted).

Comment 4

[Peter Lubczynski]

Just checked, the mStarted check is there. Marking FIXED.

Comment 5

[shrirang khanzode]

rubberstamp verified