777460 - crash in nsNPAPIPluginInstance::CreateSharedHandle on Honeycomb and above

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It has been hit by one user in 17.0a1/20120721041038 and 17.0a1/20120725030556, each time after bug 687267 landed on m-c.

Signature 	nsNPAPIPluginInstance::CreateSharedHandle More Reports Search
UUID	678911b3-3080-4481-982e-63a2d2120725
Date Processed	2012-07-25 19:06:20
Uptime	41
Last Crash	48 seconds before submission
Install Age	7.5 minutes since version was first installed.
Install Time	2012-07-25 18:58:06
Product	FennecAndroid
Version	17.0a1
Build ID	20120725030556
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 2.6.36.3 #1 SMP PREEMPT Fri Dec 9 16:44:21 KST 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x24
App Notes 	
AdapterDescription: 'NVIDIA Corporation -- NVIDIA Tegra -- OpenGL ES 2.0 -- Model: GT-P7510, Product: GT-P7510, Manufacturer: samsung, Hardware: p3'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ 
samsung GT-P7510
samsung/GT-P7510/GT-P7510:3.2/HTJ85B/UEKMP:user/release-keys
EMCheckCompatibility	True
Adapter Vendor ID	NVIDIA Corporation
Adapter Device ID	NVIDIA Tegra

Frame 	Module 	Signature 	Source
0 	libxul.so 	nsNPAPIPluginInstance::CreateSharedHandle 	xpcom/base/nsAutoPtr.h:1003
1 	libxul.so 	nsPluginInstanceOwner::GetImageContainer 	dom/plugins/base/nsPluginInstanceOwner.cpp:185
2 	libxul.so 	nsObjectFrame::BuildLayer 	layout/generic/nsObjectFrame.cpp:1607
3 	libxul.so 	nsDisplayPlugin::BuildLayer 	layout/generic/nsObjectFrame.h:297
4 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1768
5 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1713
6 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1713
7 	libxul.so 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:2332
8 	libxul.so 	nsDisplayScrollLayer::BuildLayer 	layout/base/nsDisplayList.cpp:2198
9 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1768
10 	libxul.so 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:2332
11 	libxul.so 	nsDisplayOwnLayer::BuildLayer 	layout/base/nsDisplayList.cpp:2069
12 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1768
13 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1713
14 	libxul.so 	mozilla::::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1713
15 	libxul.so 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:2332
16 	libxul.so 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:615
17 	libxul.so 	nsDisplayList::PaintRoot 	layout/base/nsDisplayList.cpp:551
18 	libxul.so 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1786
19 	libxul.so 	PresShell::Paint 	layout/base/nsPresShell.cpp:5290
20 	libxul.so 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:339
21 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:763
22 	libxul.so 	HandleEvent 	view/src/nsView.cpp:127
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsNPAPIPluginInstance%3A%3ACreateSharedHandle

Comment 1

[Robert Kaiser]

Now that we have solved the CM10 crash stuff, this is the #1 top crasher on (Aurora) 17 for Android.

Comment 2

[Scoobidiver (away)]

(In reply to Robert Kaiser (:[e-mail]) from comment #1)
> this is the #1 top crasher on (Aurora) 17 for Android.
... with many dupes.

Comment 3

[Alex Keybl [:akeybl]]

(In reply to Scoobidiver from comment #2)
> (In reply to Robert Kaiser (:[e-mail]) from comment #1)
> > this is the #1 top crasher on (Aurora) 17 for Android.
> ... with many dupes.

Before tracking, I'd like to make sure that more than one user is seeing this issue. Thanks for clarifying Scoobidiver.

Comment 4

[Scoobidiver (away)]

From 19.0a1/20121009, every crash signatures on Linux have a Windows look.
For this bug, more reports at: https://crash-stats.mozilla.com/report/list?signature=nsNPAPIPluginInstance%3A%3ACreateSharedHandle%28%29

Comment 5

[Scoobidiver (away)]

It's #1 top crasher on 17.0b1 with some dupes.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Not sure if this has to do with the outage right now, but I don't see any crashes here (in fact, only 9 total) so let's see if that's still true post-outage

https://crash-stats.mozilla.com/topcrasher/byversion/FennecAndroid/17.0b1/14/browser

Comment 7

[Scoobidiver (away)]

(In reply to Lukas Blakk [:lsblakk] from comment #6)
> https://crash-stats.mozilla.com/topcrasher/byversion/FennecAndroid/17.0b1/14/
> browser
This view is updated once a day while https://crash-stats.mozilla.com/query/query?product=FennecAndroid&version=FennecAndroid%3A17.0b1&do_query=1 is updated continuously.

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

It's the # topcrasher right now, lots of duplicate crash reports make me think this is a very reproducible bug.  Passing this on to James for now since it looks to be a regression from bug 687267 flash support.

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

#3 topcrasher - sent email to Brad and James to find out where we're at with this.

Comment 10

[James Willcox (:snorp) ([e-mail]) (he/him)]

Attachment: Guard against null plugin instance on Android

Comment 11

[James Willcox (:snorp) ([e-mail]) (he/him)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e5ac0909f057

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e5ac0909f057

Comment 13

[Lukas Blakk [:lsblakk] use ?needinfo]

Is this a safe enough fix to nominate for branch uplift?  We can still take a speculative fix for tomorrow's Beta 4.

Comment 14

[James Willcox (:snorp) ([e-mail]) (he/him)]

Comment on attachment 675144 [details] [diff] [review]
Guard against null plugin instance on Android

[Approval Request Comment]
Low risk patch, fixes a top crasher

Comment 15

[James Willcox (:snorp) ([e-mail]) (he/him)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/1ea0c1cf9d2a
https://hg.mozilla.org/releases/mozilla-beta/rev/5c16cf77238e