Closed Bug 752422 Opened 8 years ago Closed 7 years ago

crash in nsPluginHost::OnPluginInstanceDestroyed

Categories

(Core :: Plug-ins, defect, critical)

13 Branch
x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla21
Tracking Status
firefox18 --- wontfix
firefox19 --- wontfix
firefox20 --- wontfix
firefox-esr17 --- wontfix

People

(Reporter: scoobidiver, Assigned: gfritzsche)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

It's #58 top crasher in 13.0b2 and first appeared in 13.0a1/20120216.
It occurs mainly on Windows XP.

Signature 	nsPluginHost::OnPluginInstanceDestroyed(nsPluginTag*) More Reports Search
UUID	43c33492-9865-48a2-89df-ccf802120506
Date Processed	2012-05-06 08:50:48
Uptime	43
Last Crash	6.8 weeks before submission
Install Age	43 seconds since version was first installed.
Install Time	2012-05-06 08:49:19
Product	Firefox
Version	13.0
Build ID	20120501201020
Release Channel	beta
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 107 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x70
User Comments	сообщение об ошибке
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0640, AdapterSubsysID: 059910de, AdapterDriverVersion: 6.14.11.9562
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True	
Total Virtual Memory	2147352576
Available Virtual Memory	1858097152
System Memory Use Percentage	59
Available Page File	1461821440
Available Physical Memory	434446336

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsPluginHost::OnPluginInstanceDestroyed 	dom/plugins/base/nsPluginHost.cpp:907
1 	xul.dll 	nsPluginHost::StopPluginInstance 	dom/plugins/base/nsPluginHost.cpp:3308
2 	xul.dll 	nsObjectLoadingContent::DoStopPlugin 	content/base/src/nsObjectLoadingContent.cpp:2043
3 	xul.dll 	nsObjectLoadingContent::StopPluginInstance 	content/base/src/nsObjectLoadingContent.cpp:2079
4 	xul.dll 	nsObjectLoadingContent::NotifyOwnerDocumentActivityChanged 	content/base/src/nsObjectLoadingContent.cpp:684
5 	xul.dll 	NotifyActivityChanged 	content/base/src/nsDocument.cpp:3792
6 	xul.dll 	EnumerateFreezables 	content/base/src/nsDocument.cpp:8025
7 	xul.dll 	nsTHashtable<nsPtrHashKey<nsObjectFrame> >::s_EnumStub 	obj-firefox/dist/include/nsTHashtable.h:497
8 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.cpp:751
9 	xul.dll 	nsTHashtable<nsPtrHashKey<nsIContent> >::EnumerateEntries 	obj-firefox/dist/include/nsTHashtable.h:251
10 	xul.dll 	nsDocument::RemovedFromDocShell 	content/base/src/nsDocument.cpp:7078
11 	xul.dll 	DocumentViewerImpl::Close 	layout/base/nsDocumentViewer.cpp:1465
12 	xul.dll 	nsDocShell::SetupNewViewer 	docshell/base/nsDocShell.cpp:7690
13 	xul.dll 	nsDocShell::Embed 	docshell/base/nsDocShell.cpp:5820
14 	xul.dll 	nsDocShell::CreateContentViewer 	docshell/base/nsDocShell.cpp:7501
15 	xul.dll 	nsDSURIContentListener::DoContent 	docshell/base/nsDSURIContentListener.cpp:164
16 	xul.dll 	nsDocumentOpenInfo::TryContentListener 	uriloader/base/nsURILoader.cpp:709
17 	xul.dll 	nsDocumentOpenInfo::DispatchContent 	uriloader/base/nsURILoader.cpp:406
18 	xul.dll 	nsDocumentOpenInfo::OnStartRequest 	uriloader/base/nsURILoader.cpp:294
19 	xul.dll 	nsHttpChannel::CallOnStartRequest 	netwerk/protocol/http/nsHttpChannel.cpp:764
20 	xul.dll 	nsHttpChannel::ContinueOnStartRequest2 	netwerk/protocol/http/nsHttpChannel.cpp:4236
21 	xul.dll 	xul.dll@0x228a5f 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsPluginHost%3A%3AOnPluginInstanceDestroyed%28nsPluginTag*%29
It's #45 top browser crasher in 13.0b7 and #78 in 14.0a2.
It's #27 top browser crasher in 18.0.2, #22 in 19.0b5, and #49 in 20.0a2.

Many comments talks about Facebook or Pogo. It's a low correlation to Java:
     18% (50/277) vs.   1% (1063/130050) java.dll
Apparently the plugin tag passed to OnPluginInstanceDestroyed() is 0.
I'm not entirely sure which scenario could lead to this here, but a 
null check shouldn't hurt.
Attachment #712387 - Flags: review?(benjamin)
The tag being null is an assertion in debug builds: http://hg.mozilla.org/releases/mozilla-beta/annotate/168f3814b32e/dom/plugins/base/nsPluginHost.cpp#l1209

As a bandaid, this is perhaps acceptable but we really should spend some additional time figuring out why we have an active plugin/instance which isn't in the taglist.
Comment on attachment 712387 [details] [diff] [review]
Null-check for plugin tag

Please add TODO comments to remove this check once we're figured out the state problem.
Attachment #712387 - Flags: review?(benjamin) → review+
Probably mark this one FIXED and file a followup?
Blocks: 840606
https://hg.mozilla.org/mozilla-central/rev/74e6960db18c
Assignee: nobody → georg.fritzsche
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
It's #10 browser crasher in 17.0.6esr.
It's now #19 browser crasher in 17.0.7esr.
You need to log in before you can comment on or make changes to this bug.