Closed Bug 723291 Opened 8 years ago Closed 8 years ago

Crash @ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstanceParent::OnChannelClose with abort message "###!!! ABORT: `OnClose' called on non-toplevel actor"

Categories

(Core :: Plug-ins, defect, critical)

13 Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 723473

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

It's currently #6 top crasher in the first build of 13.0a1.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3f26b7bee352&tochange=e18c7bc2c28e
It's likely caused by bug 90268.

Signature 	mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstanceParent::OnChannelClose() More Reports Search
UUID	bb09ea28-2255-40fd-a9ea-8653e2120201
Date Processed	2012-02-01 20:30:53
Uptime	927
Last Crash	15.5 minutes before submission
Install Age	1.3 hours since version was first installed.
Install Time	2012-02-01 19:08:00
Product	Firefox
Version	13.0a1
Build ID	20120201031146
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 6 stepping 5
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0xac195f
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9598, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.911.0.0
D3D10 Layers? D3D10 Layers-
D3D9 Layers? D3D9 Layers+
xpcom_runtime_abort(###!!! ABORT: `OnClose' called on non-toplevel actor: file e:/builds/moz2_slave/m-cen-w32-ntly/build/obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp, line 2376)
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:79
1 	xul.dll 	NS_DebugBreak_P 	xpcom/base/nsDebugImpl.cpp:375
2 	xul.dll 	mozilla::plugins::PPluginInstanceParent::OnChannelClose 	obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp:2376
3 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	obj-firefox/xpcom/build/nsCOMPtr.cpp:88
4 	xul.dll 	nsPluginStreamListenerPeer::InitializeEmbedded 	dom/plugins/base/nsPluginStreamListenerPeer.cpp:405
5 	xul.dll 	nsPluginHost::NewEmbeddedPluginStreamListener 	dom/plugins/base/nsPluginHost.cpp:3323
6 	xul.dll 	nsPluginHost::NewEmbeddedPluginStream 	dom/plugins/base/nsPluginHost.cpp:3342
7 	xul.dll 	nsPluginHost::InstantiateEmbeddedPlugin 	dom/plugins/base/nsPluginHost.cpp:1107
8 	xul.dll 	nsObjectLoadingContent::InstantiatePluginInstance 	content/base/src/nsObjectLoadingContent.cpp:637

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char%20const*%20const%29%20|%20NS_DebugBreak_P%20|%20mozilla%3A%3Aplugins%3A%3APPluginInstanceParent%3A%3AOnChannelClose%28%29
Benjamin, any chance you can look into this? I'm working on another regression, hoping to fix these quickly to avoid a backout.
Assignee: nobody → benjamin
I'm assuming nobody has STR?
Status: NEW → ASSIGNED
The real call stack appears to be:

eventloop ->
nsAsyncInstantiateEvent::Run ->
nsObjectLoadingContent::SyncStartPluginInstance ->
nsObjectLoadingContent::InstantiatePluginInstance ->
nsPluginHost::InstantiateEmbeddedPlugin ->
nsPluginHost::NewEmbeddedPluginStream ->
nsPluginHost::NewEmbeddedPluginStreamListener ->
nsPluginStreamListenerPeer::InitializeEmbedded

By the time we get here, however, the nsNPAPIPluginInstance appears to be dead memory. I wonder if there's a refcounting error somewhere? That might also explain bug 723473, which also looks like we're operating on dead memory.
This seems like it is gone.
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Assignee: benjamin → nobody
Resolution: FIXED → DUPLICATE
Duplicate of bug: 723473
You need to log in before you can comment on or make changes to this bug.