crash in nsPluginHost::ReadPluginInfo

RESOLVED FIXED in Firefox 22

Status

()

P1
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: scoobidiver, Assigned: gfritzsche)

Tracking

({crash, regression, topcrash})

22 Branch
mozilla22
crash, regression, topcrash
Points:
---

Firefox Tracking Flags

(firefox21 unaffected, firefox22+ fixed)

Details

(Whiteboard: [startupcrash], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
It first showed up in 22.0a1/20130322. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a73a2b5c423b&tochange=0e9badd3cf39
It's likely a regression from bug 830267.

Signature 	nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo() More Reports Search
UUID	9e747112-a520-446d-83db-fe9232130322
Date Processed	2013-03-22 16:38:27
Uptime	6
Last Crash	29 seconds before submission
Install Age	4.0 minutes since version was first installed.
Install Time	2013-03-22 16:34:30
Product	Firefox
Version	22.0a1
Build ID	20130322031028
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x30
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0641, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.16.11.9107
D3D10 Layers? D3D10 Layers- 
Processor Notes 	sp-processor08.phx1.mozilla.com_14835:2008
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x0641
Total Virtual Memory	2147352576
Available Virtual Memory	1888141312
System Memory Use Percentage	52
Available Page File	2246787072
Available Physical Memory	1011781632

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsCOMPtr_base::assign_assuming_AddRef 	obj-firefox/dist/include/nsCOMPtr.h:437
1 	xul.dll 	nsPluginHost::ReadPluginInfo 	dom/plugins/base/nsPluginHost.cpp:2610
2 	xul.dll 	nsPluginHost::UpdatePluginInfo 	dom/plugins/base/nsPluginHost.cpp:2361
3 	xul.dll 	nsPluginTag::SetEnabled 	dom/plugins/base/nsPluginTags.cpp:347
4 	xul.dll 	nsPluginTag::SetDisabled 	dom/plugins/base/nsPluginTags.cpp:360
5 	xul.dll 	nsPluginHost::ScanPluginsDirectory 	dom/plugins/base/nsPluginHost.cpp:2041
6 	xul.dll 	nsPluginHost::ScanPluginsDirectoryList 	dom/plugins/base/nsPluginHost.cpp:2147
7 	xul.dll 	nsPluginHost::FindPlugins 	dom/plugins/base/nsPluginHost.cpp:2255
8 	xul.dll 	nsPluginHost::LoadPlugins 	dom/plugins/base/nsPluginHost.cpp:2175
9 	xul.dll 	nsPluginHost::GetPluginTags 	dom/plugins/base/nsPluginHost.cpp:1345
10 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
11 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1417
12 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:384
13 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2396
14 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:333
15 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:398
16 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:431
17 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5769
18 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1433
19 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:578
20 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:85
21 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
22 	xul.dll 	nsObserverService::NotifyObservers 	xpcom/ds/nsObserverService.cpp:161

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsCOMPtr_base%3A%3Aassign_assuming_AddRef%28nsISupports*%29+|+nsPluginHost%3A%3AReadPluginInfo%28%29
https://crash-stats.mozilla.com/report/list?signature=nsCOMPtr_base%3A%3Aassign_assuming_AddRef%28nsISupports*%29+|+nsCOMPtr%3CnsIScriptRuntime%3E%3A%3AStartAssignment%28%29+|+nsPluginHost%3A%3AReadPluginInfo%28%29
(Reporter)

Updated

6 years ago
Summary: crash in nsPluginTag::SetEnabled @ nsPluginHost::ReadPluginInfo → crash in nsPluginHost::ReadPluginInfo

Comment 1

6 years ago
I can get this to reproduce reliably under OS X with the Adobe PDF plugin installed. In particular, the crash arises when trying to deal with AdobePDFViewerNPAPI.plugin

Comment 2

6 years ago
I can also confirm that the problem does not arise on mozilla-incoming rev 125721, and does happen for mozilla-incoming rev 125722, which confirms the theory that the problem is caused by the patch for bug 830267.

Comment 3

6 years ago
mPluginHost is null here: http://hg.mozilla.org/mozilla-central/annotate/0e9badd3cf39/dom/plugins/base/nsPluginTags.cpp#l347

Why do we even bother with mPluginHost instead of just using nsPluginHost::GetInst ?

Updated

6 years ago
Assignee: nobody → georg.fritzsche
(Reporter)

Updated

6 years ago
Crash Signature: [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] → [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as…
OS: Windows 7 → All
(Reporter)

Updated

6 years ago
Duplicate of this bug: 854080
(Reporter)

Comment 5

6 years ago
It's #2 top crasher in 22.0a1/20130322.
Crash Signature: [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as… → [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as…
tracking-firefox22: --- → ?
Keywords: topcrash
(Assignee)

Updated

6 years ago
Priority: -- → P1
(Assignee)

Comment 6

6 years ago
Created attachment 728635 [details] [diff] [review]
Fix nsPluginHost usage

Good question regarding nsPluginTag::mPluginHost, i don't see any reason to keep it over nsPluginHost::GetInst().

https://tbpl.mozilla.org/?tree=Try&rev=48da68e17899
Attachment #728635 - Flags: review?(benjamin)
I get this crash consistently in XP with no Adobe Reader; Foxit Reader is installed, but plugin disabled in favor of pdf.js. Also crashes in Safe Mode, or with a new, clean profile.

However, with a clean test profile I already had on hand there's no crash. In this profile, the Foxit Reader plugin is enabled. 

Don't know if this helps, but it's certainly interesting. Here's a couple crash reports, in case they might be helpful:

https://crash-stats.mozilla.com/report/index/bp-e016e4ef-8ff2-45be-a559-fde372130323

https://crash-stats.mozilla.com/report/index/bp-ce72a43e-df3e-4d8e-b572-37dbb2130323

Comment 8

6 years ago
On the most recent nightly, I crash immediately every time visiting https://blog.mozilla.org/luke.

Comment 9

6 years ago
More generally, on OSX, Nightly randomly on many different pages, about:addons, on every quit, etc, making Nightly completely unusable.  This problem just started in one of the last one or two nightlies; is there something we can back out?
(Reporter)

Updated

6 years ago
Crash Signature: [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as… → [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as…
(Reporter)

Updated

6 years ago
Crash Signature: [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as… → [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as…
RE #7 - Tried enabling Foxit Reader plugin and setting option to use foxit plugin for PDFs in my regular Nightly profile. Didn't help, still crashed.
(Assignee)

Comment 11

6 years ago
(In reply to Luke Wagner [:luke] from comment #9)
> This
> problem just started in one of the last one or two nightlies; is there
> something we can back out?

This is due to bug 830267, but the patch here should take care of it.
(Assignee)

Comment 12

6 years ago
I'm mostly knocked out by a viral infection, so i'd appreciate a check-in in case of r+.

Updated

6 years ago
Attachment #728635 - Flags: review?(benjamin) → review+
https://hg.mozilla.org/mozilla-central/rev/8d55f019795c
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
status-firefox22: affected → fixed
(Reporter)

Updated

6 years ago
Crash Signature: [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as… → [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginHost::ReadPluginInfo()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCOMPtr<nsIScriptRuntime>::StartAssignment() | nsPluginHost::ReadPluginInfo() ] [@ nsCOMPtr_base::begin_as…

Updated

6 years ago
tracking-firefox22: ? → +
You need to log in before you can comment on or make changes to this bug.