817391 - crash in gfxTeeSurface::`.* deleting destructor'

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It's #129 top crasher in 18.0b1, #53 in 18.0b2, and #24 in 19.0a2 with many dupes.
It first showed up in 18.0a1/20120907 but it's discontinuous across builds.

Signature 	moz_abort | je_free | gfxTeeSurface::`scalar deleting destructor''(unsigned int) More Reports Search
UUID	2bbe4c3b-48a6-4d1a-9a12-6b00a2121201
Date Processed	2012-12-01 21:42:17
Process Type	plugin Version: Filename: NPSWF32_11_5_502_110.dll
Uptime	200
Install Age	9.2 hours since version was first installed.
Install Time	2012-12-01 10:32:01
Product	Firefox
Version	19.0a2
Build ID	20121130042014
Release Channel	aurora
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 2 stepping 3
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x6bd41788
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0640, AdapterSubsysID: 040110b0, AdapterDriverVersion: 9.18.13.697
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x0640

Frame 	Module 	Signature 	Source
0 	mozglue.dll 	moz_abort 	memory/mozjemalloc/jemalloc.c:1562
1 	mozglue.dll 	je_free 	memory/mozjemalloc/jemalloc.c:6577
2 	xul.dll 	gfxTeeSurface::`scalar deleting destructor' 	
3 	xul.dll 	gfxASurface::SurfaceDestroyFunc 	gfx/thebes/gfxASurface.cpp:107
4 	gkmedias.dll 	_cairo_user_data_array_fini 	gfx/cairo/cairo/src/cairo-array.c:415
5 	gkmedias.dll 	_moz_cairo_destroy 	gfx/cairo/cairo/src/cairo.c:456
6 	gkmedias.dll 	gkmedias.dll@0x1c8ff 	
7 	mozalloc.dll 	mozalloc.dll@0x109f 	
8 	xul.dll 	gfxContext::~gfxContext 	gfx/thebes/gfxContext.cpp:112
9 	xul.dll 	gfxContext::`scalar deleting destructor' 	
10 	xul.dll 	nsRefPtr<gfxContext>::~nsRefPtr<gfxContext> 	obj-firefox/dist/include/nsAutoPtr.h:876
11 	xul.dll 	mozilla::plugins::PluginInstanceChild::PaintRectWithAlphaExtraction 	dom/plugins/ipc/PluginInstanceChild.cpp:3407
12 	nspr4.dll 	PR_GetHostByAddr 	nsprpub/pr/src/misc/prnetdb.c:1139

More reports at:
https://crash-stats.mozilla.com/report/list?signature=moz_abort+|+je_free+|+gfxTeeSurface%3A%3A%60scalar+deleting+destructor%27%27%28unsigned+int%29
https://crash-stats.mozilla.com/report/list?signature=moz_abort+|+je_free+|+gfxTeeSurface%3A%3A%60vector+deleting+destructor%27%27%28unsigned+int%29

Comment 1

[Mats Palmgren (inactive)]

I think signatures with "arena_dalloc_small | je_free | gfxTeeSurface" are the
same problem.  For example:
bp-5523e845-e9ec-4226-a01c-99ea12121209
bp-f0c98ef3-8d8d-409c-9f2a-9aed02121206

They all have in common that it's destroying the local gfxContext in
mozilla::plugins::PluginInstanceChild::PaintRectWithAlphaExtraction here:
http://hg.mozilla.org/releases/mozilla-aurora/annotate/dd7507d7423c/dom/plugins/ipc/PluginInstanceChild.cpp#l3407

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year).