861140 - crash in nsPluginInstanceOwner::SetFrame @ nsObjectFrame::UnregisterPluginForGeometryUpdates

Status: RESOLVED DUPLICATE of bug 854082

(Core Graveyard :: Plug-ins, defect, P2)

Description

[Scoobidiver (away)]

It's #87 browser crasher in 22.0a2 and #36 in 23.0a1.
It first showed up in 22.0a1/20130321090706. The regression range might be (some builds are skipped):
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8156df33b757&tochange=a73a2b5c423b
Based on the stack trace, it might be a regression from bug 843671.
But oddly while the fix of bug 843671 was uplifted to 21.0, that version is not affected.

Signature 	PL_DHashTableOperate | nsObjectFrame::UnregisterPluginForGeometryUpdates() More Reports Search
UUID	ebd79774-86a2-495f-a381-19e512130412
Date Processed	2013-04-12 01:26:56
Uptime	4727
Last Crash	1.2 weeks before submission
Install Age	22.9 hours since version was first installed.
Install Time	2013-04-11 02:29:15
Product	Firefox
Version	23.0a1
Build ID	20130410065939
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 6 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xe0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2772, AdapterSubsysID: 00000000, AdapterDriverVersion: 6.14.10.4926
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
Processor Notes 	sp-processor10.phx1.mozilla.com_13032:2012; exploitability tool failed: 127
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x2772
Total Virtual Memory	2147352576
Available Virtual Memory	1690079232
System Memory Use Percentage	78
Available Page File	1699598336
Available Physical Memory	227135488

Frame 	Module 	Signature 	Source
0 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.cpp:576
1 	xul.dll 	nsObjectFrame::UnregisterPluginForGeometryUpdates 	layout/generic/nsObjectFrame.cpp:772
2 	xul.dll 	nsObjectFrame::SetInstanceOwner 	layout/generic/nsObjectFrame.cpp:783
3 	xul.dll 	nsPluginInstanceOwner::SetFrame 	dom/plugins/base/nsPluginInstanceOwner.cpp:3401
4 	xul.dll 	nsCOMPtr<nsIScriptContext>::operator= 	obj-firefox/dist/include/nsCOMPtr.h:638
5 	xul.dll 	nsObjectLoadingContent::StopPluginInstance 	content/base/src/nsObjectLoadingContent.cpp:2576
6 	xul.dll 	nsObjectLoadingContent::UnloadObject 	content/base/src/nsObjectLoadingContent.cpp:2168
7 	xul.dll 	CheckPluginStopEvent::Run 	content/base/src/nsObjectLoadingContent.cpp:176
8 	xul.dll 	nsBaseAppShell::RunSyncSectionsInternal 	widget/xpwidgets/nsBaseAppShell.cpp:352
9 	nss3.dll 	nss3.dll@0x59e50 	
10 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:640
11 	xul.dll 	nsTArray_Impl<nsTimerImpl*,nsTArrayInfallibleAllocator>::IndexOf<nsTimerImpl*,ns 	obj-firefox/dist/include/nsTArray.h:811
12 	xul.dll 	mozilla::Mutex::Unlock 	obj-firefox/dist/include/mozilla/Mutex.h:83
13 	xul.dll 	TimerThread::RemoveTimer 	xpcom/threads/TimerThread.cpp:348
14 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:117
15 	xul.dll 	_SEH_epilog4 	
16 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:183
17 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
18 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:113
19 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:288
20 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3881
21 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3948
22 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4164
23 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:273
24 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105
25 	msvcr100.dll 	_initterm 	f:\dd\vctools\crt_bld\self_x86\crt\src\crt0dat.c:872
26 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
27 	firefox.exe 	_SEH_epilog4 	
28 	kernel32.dll 	BaseProcessStart 	
29 	kernel32.dll 	GetCodePageFileInfo 	
30 	kernel32.dll 	BaseProcessStart 	
31 	firefox.exe 	pre_c_init 	crtexe.c:261 

More reports at:
https://crash-stats.mozilla.com/report/list?signature=PL_DHashTableOperate+|+nsObjectFrame%3A%3AUnregisterPluginForGeometryUpdates%28%29

Comment 1

[Lukas Blakk [:lsblakk] use ?needinfo]

Tracking in case this is fallout from the plugin UI crash comment entry.

Comment 2

[Tracy Walker [:tracy]]

It has dropped down to #150 browser crasher in 22.0a2 and #127 in 23.0a1.

Comment 3

[Tracy Walker [:tracy]]

combined signatures put this in top 30

Comment 4

[John Schoenick [:johns]]

This looks like it may have been caused by bug 784131, in which case it should also be fixed by bug 854082.

Comment 5

[Scoobidiver (away)]

There have been no crashes since 22.0a2/20130425.