723291 - Crash @ mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstanceParent::OnChannelClose with abort message "###!!! ABORT: `OnClose' called on non-toplevel actor"

Status: RESOLVED DUPLICATE of bug 723473

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It's currently #6 top crasher in the first build of 13.0a1.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3f26b7bee352&tochange=e18c7bc2c28e
It's likely caused by bug 90268.

Signature 	mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstanceParent::OnChannelClose() More Reports Search
UUID	bb09ea28-2255-40fd-a9ea-8653e2120201
Date Processed	2012-02-01 20:30:53
Uptime	927
Last Crash	15.5 minutes before submission
Install Age	1.3 hours since version was first installed.
Install Time	2012-02-01 19:08:00
Product	Firefox
Version	13.0a1
Build ID	20120201031146
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 6 stepping 5
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0xac195f
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9598, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.911.0.0
D3D10 Layers? D3D10 Layers-
D3D9 Layers? D3D9 Layers+
xpcom_runtime_abort(###!!! ABORT: `OnClose' called on non-toplevel actor: file e:/builds/moz2_slave/m-cen-w32-ntly/build/obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp, line 2376)
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:79
1 	xul.dll 	NS_DebugBreak_P 	xpcom/base/nsDebugImpl.cpp:375
2 	xul.dll 	mozilla::plugins::PPluginInstanceParent::OnChannelClose 	obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp:2376
3 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	obj-firefox/xpcom/build/nsCOMPtr.cpp:88
4 	xul.dll 	nsPluginStreamListenerPeer::InitializeEmbedded 	dom/plugins/base/nsPluginStreamListenerPeer.cpp:405
5 	xul.dll 	nsPluginHost::NewEmbeddedPluginStreamListener 	dom/plugins/base/nsPluginHost.cpp:3323
6 	xul.dll 	nsPluginHost::NewEmbeddedPluginStream 	dom/plugins/base/nsPluginHost.cpp:3342
7 	xul.dll 	nsPluginHost::InstantiateEmbeddedPlugin 	dom/plugins/base/nsPluginHost.cpp:1107
8 	xul.dll 	nsObjectLoadingContent::InstantiatePluginInstance 	content/base/src/nsObjectLoadingContent.cpp:637

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char%20const*%20const%29%20|%20NS_DebugBreak_P%20|%20mozilla%3A%3Aplugins%3A%3APPluginInstanceParent%3A%3AOnChannelClose%28%29

Comment 1

[Josh Aas]

Benjamin, any chance you can look into this? I'm working on another regression, hoping to fix these quickly to avoid a backout.

Comment 2

[Benjamin Smedberg]

I'm assuming nobody has STR?

Comment 3

[Benjamin Smedberg]

The real call stack appears to be:

eventloop ->
nsAsyncInstantiateEvent::Run ->
nsObjectLoadingContent::SyncStartPluginInstance ->
nsObjectLoadingContent::InstantiatePluginInstance ->
nsPluginHost::InstantiateEmbeddedPlugin ->
nsPluginHost::NewEmbeddedPluginStream ->
nsPluginHost::NewEmbeddedPluginStreamListener ->
nsPluginStreamListenerPeer::InitializeEmbedded

By the time we get here, however, the nsNPAPIPluginInstance appears to be dead memory. I wonder if there's a refcounting error somewhere? That might also explain bug 723473, which also looks like we're operating on dead memory.

Comment 4

[Josh Aas]

This seems like it is gone.