788107 - crash in nsPluginStreamListenerPeer::OnStartRequest

Status: RESOLVED DUPLICATE of bug 787778

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

The crash signature moves with each build. It first appeared in 17.0a1/20120810. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3199bc043da4&tochange=4e150530c925

Signature 	nsRefPtr<mozilla::WebGLShader>::assign_assuming_AddRef(mozilla::WebGLShader*) | nsRefPtr<ID3D10InputLayout>::StartAssignment() | nsPluginStreamListenerPeer::OnStartRequest(nsIRequest*, nsISupports*) More Reports Search
UUID	7c96aced-4524-4eba-be43-d37802120904
Date Processed	2012-09-04 07:32:59
Uptime	2589
Install Age	11.6 hours since version was first installed.
Install Time	2012-09-03 19:56:13
Product	Firefox
Version	18.0a1
Build ID	20120903030551
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xffffffffffffff85
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0046, AdapterSubsysID: 1668103c, AdapterDriverVersion: 8.15.10.2401
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0046
Total Virtual Memory	2147352576
Available Virtual Memory	1307246592
System Memory Use Percentage	45
Available Page File	3516760064
Available Physical Memory	1411170304

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsRefPtr<mozilla::WebGLShader>::assign_assuming_AddRef 	obj-firefox/dist/include/nsAutoPtr.h:862
1 	xul.dll 	nsRefPtr<ID3D10InputLayout>::StartAssignment 	obj-firefox/dist/include/nsAutoPtr.h:1069
2 	xul.dll 	nsPluginStreamListenerPeer::OnStartRequest 	dom/plugins/base/nsPluginStreamListenerPeer.cpp:606
3 	xul.dll 	nsObjectLoadingContent::LoadObject 	content/base/src/nsObjectLoadingContent.cpp:1739
4 	xul.dll 	nsObjectLoadingContent::OnStartRequest 	content/base/src/nsObjectLoadingContent.cpp:853
5 	xul.dll 	mozilla::net::nsHttpChannel::CallOnStartRequest 	netwerk/protocol/http/nsHttpChannel.cpp:969
6 	xul.dll 	mozilla::net::nsHttpChannel::ContinueOnStartRequest2 	netwerk/protocol/http/nsHttpChannel.cpp:4840
7 	xul.dll 	mozilla::net::nsHttpChannel::OnStartRequest 	netwerk/protocol/http/nsHttpChannel.cpp:4813
8 	xul.dll 	nsInputStreamPump::OnStateStart 	netwerk/base/src/nsInputStreamPump.cpp:417
9 	xul.dll 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:368
10 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:82
11 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
12 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
13 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
14 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
15 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
16 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
17 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:273
18 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3835
19 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3912
20 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3988
21 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:100
22 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
23 	kernel32.dll 	BaseThreadInitThunk 	
24 	ntdll.dll 	__RtlUserThreadStart 	
25 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/query/query?product=Firefox&query_search=signature&query_type=contains&query=nsPluginStreamListenerPeer%3A%3AOnStartRequest&do_query=1

Comment 1

[Scoobidiver (away)]

With combined signatures, it's #25 top browser crasher in 17.0a2 and #49 in 18.0a1.

Comment 2

[John Schoenick [:johns]]

Given the range, most likely a regression from bug 745030

Comment 3

[Scoobidiver (away)]

With combined signatures, it's #20 top browser crasher in 17.0a2 and #40 in 18.0a1.

Comment 4

[Marcia Knous [:marcia]]

I would say songpop might be a good place to start based on these URLs:

3 	http://apps.facebook.com/songpop/?fb_source=bookmark_apps&ref=bookmarks&count=0&
2 	http://apps.facebook.com/songpop/?fb_source=notification&request_ids=28075830869
1 	http://apps.facebook.com/songpop/?fb_source=bookmark_apps&ref=bookmarks&count=14
1 	https://wam-mobile.appspot.com/facebook/canvas/?fb_source=notification&ref=notif
1 	http://promo.chocam.com/pdv/chocam/pdv24.php
1 	http://apps.facebook.com/songpop/?fb_source=notification&request_ids=28278154848
1 	http://www.youtube.com/watch?v=8XRpJdpmYRE&feature=related
1 	http://eng.cartoonnetworkla.com/ads.do?section=game&bannerType=550x320&hash=new%
1       http://mycabinet.directcall.at/scripts/shiftplan?1
1       https://www.google.com.mx/

Comment 5

[John Schoenick [:johns]]

I've figured out whats going on here, working on a fix

Comment 6

[Alex Keybl [:akeybl]]

(In reply to John Schoenick [:johns] from comment #5)
> I've figured out whats going on here, working on a fix

Any updates here?

Comment 7

[Robert Kaiser]

This is topcrash #22 in 17.0b1 right now.

Comment 8

[John Schoenick [:johns]]

This signature should be fixed by bug 787778 on all branches.

Comment 9

[u279076]

I'm not seeing any instances of this signature on crash-stats. Can we call this verified, or is there some regression testing required around this issue? Please advise.

Comment 10

[John Schoenick [:johns]]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #9)
> I'm not seeing any instances of this signature on crash-stats. Can we call
> this verified, or is there some regression testing required around this
> issue? Please advise.

This actually should've been marked a duplicate of 787778, so it doesn't need to be verified independently