Closed Bug 804368 Opened 7 years ago Closed 3 years ago

nsPluginStreamListener re-entry in NPP_Destroy -> Event loop -> OnDataAvailable (ABORT: Corrupted plugin stream data.)

Categories

(Core :: Plug-ins, defect, major)

defect
Not set
major

Tracking

()

RESOLVED INCOMPLETE

People

(Reporter: johns, Assigned: johns)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-fc835e88-deed-4584-9ced-c525e2121022 .
============================================================= 

Plugins can spin the event loop upon teardown, enter into their own OnDataAvailable, and die with |ABORT: Corrupted plugin stream data.|
Assignee: nobody → jschoenick
The streams are all supposed to be dead before we call NPP_Destroy, from this code:

http://hg.mozilla.org/mozilla-central/annotate/1c3e4cb1f754/dom/plugins/base/nsNPAPIPluginInstance.cpp#l284

So either a stream is being created during NPP_Destroy, which is supposed to be stopped by "mRunning = DESTROYING", or a stream listener is not in the mStreamListeners array.
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | nsCOMPtr<nsIX509Cert>::nsCOMPtr<nsIX509Cert>(nsIX509Cert*) | mozilla::plugins::PluginModuleParent::StreamCast(_NPP*, _NPStream*)] → [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | nsCOMPtr<nsIX509Cert>::nsCOMPtr<nsIX509Cert>(nsIX509Cert*) | mozilla::plugins::PluginModuleParent::StreamCast(_NPP*, _NPStream*)] [@ mozalloc_abort | NS_DebugBreak_P | nsCOMPtr<T>::nsCOMPtr<T> | mo…
Resolving old bugs which are likely not relevant any more, since NPAPI plugins are deprecated.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.