Closed Bug 752422 Opened 13 years ago Closed 12 years ago

crash in nsPluginHost::OnPluginInstanceDestroyed

Categories

(Core Graveyard :: Plug-ins, defect)

Product:
Core Graveyard
Component:
Plug-ins
Version:
13 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(firefox18 wontfix, firefox19 wontfix, firefox20 wontfix, firefox-esr17 wontfix)

Status:
RESOLVED FIXED
Milestone:
mozilla21
Tracking Flags:
Tracking Status
firefox18 --- wontfix
firefox19 --- wontfix
firefox20 --- wontfix
firefox-esr17 --- wontfix

People

(Reporter: scoobidiver, Assigned: gfritzsche)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Null-check for plugin tag
1.58 KB, patch
benjamin
: review+
Details | Diff | Splinter Review
It's #58 top crasher in 13.0b2 and first appeared in 13.0a1/20120216. It occurs mainly on Windows XP. Signature nsPluginHost::OnPluginInstanceDestroyed(nsPluginTag*) More Reports Search UUID 43c33492-9865-48a2-89df-ccf802120506 Date Processed 2012-05-06 08:50:48 Uptime 43 Last Crash 6.8 weeks before submission Install Age 43 seconds since version was first installed. Install Time 2012-05-06 08:49:19 Product Firefox Version 13.0 Build ID 20120501201020 Release Channel beta OS Windows NT OS Version 5.1.2600 Service Pack 3 Build Architecture x86 Build Architecture Info AuthenticAMD family 15 model 107 stepping 2 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x70 User Comments сообщение об ошибке App Notes AdapterVendorID: 0x10de, AdapterDeviceID: 0x0640, AdapterSubsysID: 059910de, AdapterDriverVersion: 6.14.11.9562 D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- EMCheckCompatibility True Total Virtual Memory 2147352576 Available Virtual Memory 1858097152 System Memory Use Percentage 59 Available Page File 1461821440 Available Physical Memory 434446336 Frame Module Signature Source 0 xul.dll nsPluginHost::OnPluginInstanceDestroyed dom/plugins/base/nsPluginHost.cpp:907 1 xul.dll nsPluginHost::StopPluginInstance dom/plugins/base/nsPluginHost.cpp:3308 2 xul.dll nsObjectLoadingContent::DoStopPlugin content/base/src/nsObjectLoadingContent.cpp:2043 3 xul.dll nsObjectLoadingContent::StopPluginInstance content/base/src/nsObjectLoadingContent.cpp:2079 4 xul.dll nsObjectLoadingContent::NotifyOwnerDocumentActivityChanged content/base/src/nsObjectLoadingContent.cpp:684 5 xul.dll NotifyActivityChanged content/base/src/nsDocument.cpp:3792 6 xul.dll EnumerateFreezables content/base/src/nsDocument.cpp:8025 7 xul.dll nsTHashtable<nsPtrHashKey<nsObjectFrame> >::s_EnumStub obj-firefox/dist/include/nsTHashtable.h:497 8 xul.dll PL_DHashTableEnumerate obj-firefox/xpcom/build/pldhash.cpp:751 9 xul.dll nsTHashtable<nsPtrHashKey<nsIContent> >::EnumerateEntries obj-firefox/dist/include/nsTHashtable.h:251 10 xul.dll nsDocument::RemovedFromDocShell content/base/src/nsDocument.cpp:7078 11 xul.dll DocumentViewerImpl::Close layout/base/nsDocumentViewer.cpp:1465 12 xul.dll nsDocShell::SetupNewViewer docshell/base/nsDocShell.cpp:7690 13 xul.dll nsDocShell::Embed docshell/base/nsDocShell.cpp:5820 14 xul.dll nsDocShell::CreateContentViewer docshell/base/nsDocShell.cpp:7501 15 xul.dll nsDSURIContentListener::DoContent docshell/base/nsDSURIContentListener.cpp:164 16 xul.dll nsDocumentOpenInfo::TryContentListener uriloader/base/nsURILoader.cpp:709 17 xul.dll nsDocumentOpenInfo::DispatchContent uriloader/base/nsURILoader.cpp:406 18 xul.dll nsDocumentOpenInfo::OnStartRequest uriloader/base/nsURILoader.cpp:294 19 xul.dll nsHttpChannel::CallOnStartRequest netwerk/protocol/http/nsHttpChannel.cpp:764 20 xul.dll nsHttpChannel::ContinueOnStartRequest2 netwerk/protocol/http/nsHttpChannel.cpp:4236 21 xul.dll xul.dll@0x228a5f More reports at: https://crash-stats.mozilla.com/report/list?signature=nsPluginHost%3A%3AOnPluginInstanceDestroyed%28nsPluginTag*%29
It's #45 top browser crasher in 13.0b7 and #78 in 14.0a2.
It's #27 top browser crasher in 18.0.2, #22 in 19.0b5, and #49 in 20.0a2. Many comments talks about Facebook or Pogo. It's a low correlation to Java: 18% (50/277) vs. 1% (1063/130050) java.dll
Apparently the plugin tag passed to OnPluginInstanceDestroyed() is 0. I'm not entirely sure which scenario could lead to this here, but a null check shouldn't hurt.
Attachment #712387 - Flags: review?(benjamin)
The tag being null is an assertion in debug builds: http://hg.mozilla.org/releases/mozilla-beta/annotate/168f3814b32e/dom/plugins/base/nsPluginHost.cpp#l1209 As a bandaid, this is perhaps acceptable but we really should spend some additional time figuring out why we have an active plugin/instance which isn't in the taglist.
Comment on attachment 712387 [details] [diff] [review] Null-check for plugin tag Please add TODO comments to remove this check once we're figured out the state problem.
Attachment #712387 - Flags: review?(benjamin) → review+
Probably mark this one FIXED and file a followup?
Blocks: 840606
https://hg.mozilla.org/mozilla-central/rev/74e6960db18c
Assignee: nobody → georg.fritzsche
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
It's #10 browser crasher in 17.0.6esr.
status-firefox-esr17: --- → affected
tracking-firefox-esr17: --- → ?
It's now #19 browser crasher in 17.0.7esr.
tracking-firefox-esr17: ? → ---
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: