798760 - crash in PresShell::DidPaint @ nsRootPresContext::UpdatePluginGeometry

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #39 top browser crasher w/o hangs in 17.0a2 and #70 in 18.0a1 with other crashes that share the same signature.

Signature 	nsRootPresContext::UpdatePluginGeometry() More Reports Search
UUID	f61426dd-230d-482f-b064-894a12121006
Date Processed	2012-10-06 04:45:37
Uptime	30
Last Crash	31 seconds before submission
Install Age	13.8 hours since version was first installed.
Install Time	2012-10-05 14:55:56
Product	Firefox
Version	18.0a1
Build ID	20121005030609
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x68f9, AdapterSubsysID: 30321682, AdapterDriverVersion: 8.980.0.0
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x68f9
Total Virtual Memory	2147352576
Available Virtual Memory	1779564544
System Memory Use Percentage	36
Available Page File	4021387264
Available Physical Memory	2218328064

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsRootPresContext::UpdatePluginGeometry 	layout/base/nsPresContext.cpp:2711
1 	xul.dll 	PresShell::DidPaint 	layout/base/nsPresShell.cpp:7034
2 	xul.dll 	nsViewManager::CallDidPaintOnObserver 	view/src/nsViewManager.cpp:1264
3 	xul.dll 	nsViewManager::ProcessPendingUpdates 	view/src/nsViewManager.cpp:1211
4 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:431
5 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:476
6 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:612
7 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
8 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
9 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
10 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
11 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
12 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:290
13 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3782
14 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3848
15 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3923
16 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105
17 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
18 	kernel32.dll 	BaseProcessStart 

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsRootPresContext%3A%3AUpdatePluginGeometry%28%29

Comment 1

[Scott Johnson (:jwir3)]

Looks like this is happening here:

>  nsIWidget* widget = f->GetNearestWidget();

I think (from the crash reports) it's happening mostly on plugins that are classified as malware (e.g. incredibar or babylon toolbar).

Probably what's happening is that the plugin doesn't have a parent window at all, and there is an assertion one line lower, but that (IIRC) is only for debug builds. We could make this an abort on failure, but that won't fix the crash. Perhaps we should refuse to attempt to draw plugins that don't have a root window?

Comment 2

[Mats Palmgren (inactive)]

There ~248 crash reports for this signature in the past 28 days,
all are for Firefox 17.0.1 or older.  I can't find a method named
UpdatePluginGeometry in trunk so it seems it was removed/renamed.