834459 - CustomElf refCnt assert when loading Flash plugin on Android

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Plugins, defect)

Description

[Chris Peterson [:cpeterson]]

Attachment: stacktrace.txt

When using an optimized debug build and a clean profile directory, almost any website with Flash is crashing.

STR:
1. Ensure Firefox's "Plugins" setting is "Tap to play" or "Enabled".
2. Load https://addons.mozilla.org/en-US/android/ or https://support.mozilla.org/en-US/products/mobile

RESULT:
CRASH!

CustomElf's refCnt is -57005 (0xffff2153)?!


E/GeckoLinker( 2799): /data/app-lib/com.adobe.flashplayer-1/libflashplayer.so: Text relocations are not supported
F/MOZ_Assert( 2799): Assertion failure: refCnt >= 0, at ../../dist/include/mozilla/RefPtr.h:54
F/libc    ( 2799): Fatal signal 11 (SIGSEGV) at 0x00000000 (code=1), thread 2817 (Gecko)

Comment 1

[Chris Peterson [:cpeterson]]

I tested an unoptimized debug build. The crash's stack trace and refCnt were the same.

Comment 2

[Mike Hommey [:glandium]]

Remote debugging through irc confirmed to be a regression from bug 830295.

Comment 3

[Mike Hommey [:glandium]]

Attachment: Specialize RefCounted template for LibHandle to better allow refcounting during destructor execution.

Comment 4

[Mike Hommey [:glandium]]

Comment on attachment 706992 [details] [diff] [review]
Specialize RefCounted template for LibHandle to better allow refcounting during destructor execution.

Chris, can you double check this works for you? (it's different from the one I had you test last week)

Comment 5

[Nathan Froyd [:froydnj]]

Comment on attachment 706992 [details] [diff] [review]
Specialize RefCounted template for LibHandle to better allow refcounting during destructor execution.

Review of attachment 706992 [details] [diff] [review]:
-----------------------------------------------------------------

::: mozglue/linker/CustomElf.cpp
@@ +227,5 @@
>  CustomElf::~CustomElf()
>  {
>    /* While running the destructors, on-demand decompression may get new
>     * references on this object, and releasing these references would call
>     * the destructor again. Avoid this by always having the refcount > 0 */

This comment is unnecessary now.

Comment 6

[Chris Peterson [:cpeterson]]

Comment on attachment 706992 [details] [diff] [review]
Specialize RefCounted template for LibHandle to better allow refcounting during destructor execution.

Review of attachment 706992 [details] [diff] [review]:
-----------------------------------------------------------------

I tested this patch with Flash and it works for me.

Comment 7

[Mike Hommey [:glandium]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4631eeae9ff4

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4631eeae9ff4