92443 - Crash opening site with Real Player plugin - Trunk [@ PresShell::UnsuppressAndInvalidate]

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Tracy Walker [:tracy]]

seen on commercial trunk builds:

windows 2001-07-26-06-trunk
mac 2001-07-26-04-trunk

- go to the above link.

the app crashes...not 100% of the time, but nearly all the time.

talkback server must be down....those reports are stuck in local queue.  will 
attache an stdlog from the mac crash.

Comment 1

[Tracy Walker [:tracy]]

Attachment: log for crash on Mac

Comment 2

[Peter Lubczynski]

Tracy,

Did this just start happening today? Is this a dup of another bug? The stack
seems to point to PresShell::UnsuppressPainting()?

Comment 3

[Doug Turner (:dougt)]

for what it is worth, I can not reproduce this from a trunk build from two days
ago on w2k.  I would update to the tip, but cvs is down...

Comment 4

[Tracy Walker [:tracy]]

I saw it yesterday on both platforms but could not reproduce it after the first 
crash.  today, though it seems to be more reproducable.  it was not present on 
Wednesday

Comment 5

[Tracy Walker [:tracy]]

check that...it was not present on TUESDAY.    it was there yesterday, which was 
Wednesday.  duh, sorry

Comment 6

[Vikas Bhargava]

Attachment: Log for crash on NT

Comment 7

[Peter Lubczynski]

cc:ing dbaron as he's on the hook for when this happened and hyatt for the paint
suppression stuff.

I'll keep diggin' in plugin land.

Comment 8

[Brian Nesse (gone)]

I crash at this site with the branch build as well. Though the stack looks
entirely different.

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  3D5E3EC0  
  0EA8F950    PPC  3D5D430C  
  0EA8F8F0    PPC  3D5D3958  
  0EA8F5C0    PPC  3E1E0168  NSGetModule+01820
  0EA8F580    PPC  3D40D448  nsMacMessageSink::IsRaptorWindow(GrafPort*)+0141C
  0EA8F530    PPC  3D40DAC0  nsMacMessageSink::IsRaptorWindow(GrafPort*)+01A94
  0EA8F4E0    PPC  3D40DFA0  nsMacMessageSink::IsRaptorWindow(GrafPort*)+01F74
  0EA8F490    PPC  3D40E104  nsMacMessageSink::IsRaptorWindow(GrafPort*)+020D8
  0EA8F430    PPC  3D40ECD0  nsMacMessageSink::IsRaptorWindow(GrafPort*)+02CA4
  0EA8F3E0    PPC  3D40BE7C 
nsMacMessageSink::DispatchOSEvent(EventRecord&,GrafPort*)+00038
  0EA8F3A0    PPC  3D407C6C  NSGetFactory+06F78
  0EA8F360    PPC  3D408750  NSGetFactory+07A5C
  0EA8F310    PPC  3D4096BC  NSGetFactory+089C8
  0EA8F2D0    PPC  3D3FC994  
  0EA8F190    PPC  3D3FC68C  
  0EA8F100    PPC  3D3FCE2C  
  0EA8F030    PPC  3D3FCE2C  
  0EA8EF60    PPC  3D3FCE2C  
  0EA8EE90    PPC  3D3FCE2C  
  0EA8EDC0    PPC  3D3FCE2C  
  0EA8ECF0    PPC  3D3FCE2C  
  0EA8EC20    PPC  3D3FCE2C  
  0EA8EB50    PPC  3D3FCE2C  
  0EA8EA80    PPC  3D3FCD14  
  0EA8E9B0    PPC  3D3FDA08  
  0EA8E970    PPC  3D3FD944  
  0EA8E920    PPC  3CB97CA0  NSGetModule+0009C
  0EA8E8D0    PPC  3CBA5650  NSGetModule+0DA4C
  0EA8E7A0    PPC  3CBA2C24  NSGetModule+0B020
  0EA8E690    PPC  3CBA3E50  NSGetModule+0C24C
  0EA8E560    PPC  3CBA405C  NSGetModule+0C458
  0EA8E490    PPC  3CB9830C  NSGetModule+00708
  0EA8E420    PPC  3CD16550  NS_NewPresShell(nsIPresShell**)+0AD88
  0EA8E3C0    PPC  3CD4B37C  NS_NewFrameImageLoader(nsIFrameImageLoader**)+05C40
  0EA8E330    PPC  3CD502E8  NS_NewFrameImageLoader(nsIFrameImageLoader**)+0ABAC
  0EA8E2B0    PPC  3CA288AC  
  0EA8E270    PPC  3C311BE0  Private_HandleEvent(_NPP*, void*)+0000C
  0EA8E230    PPC  3C308E74  NPP_HandleEvent+000DC
  0EA8E1B0    PPC  3BCA4380  RMAShutdown+042F0
  0EA8E130    PPC  FFD13FB8  SetClip+00018
  0EA8E0F0    PPC  3F82E1B8  NQDSetClip+00064
  0EA8E0B0    PPC  FFD14978  CopyRgn+0001C
 Closing log

Comment 9

[shrirang khanzode]

not cribbing..but..worked fine on my NT 0725 branch build windows

Comment 10

[Brian Nesse (gone)]

Could be my Real Player install. It may be incomplete or bits of multiple
versions... happens when you download and install stuff for debugging. :)

Comment 11

[Brian Nesse (gone)]

So it's crashing in PresShell::UnsupressPainting() because |mFrameManager|
either wasn't created, or was disposed (0xEFEFEFEF I don't recall which that
represents offhand... most likely wasn't created.)

Comment 12

[Peter Lubczynski]

Talking with Don Cone this morning who had a blocker as well, and this may be
related to bug 80203.

I'm still updating my trees for a closer look.

Comment 13

[av (gone)]

I have all recent plugin changes and cannot reproduce it. Updating the tree.

Comment 14

[kinmoz]

dbaron just backed out his fix for bug #80203. Should we pick up those changes 
and do a respin to see if it makes this problem go away?

Comment 15

[Brian Nesse (gone)]

After digging into this some more... I believe it is the entire presShell object
that was deleted, not the mFrameManager member. The call back is happening after
the nsPresShell has been deleted.

Comment 16

[Brian Nesse (gone)]

Yes, it is quite possible that backing out those changes will solve the problem.
They are certainly in the right area(s).

Comment 17

[Brian Nesse (gone)]

Verified. Backing out Bug 80203 fixes this.

Comment 18

[Peter Lubczynski]

marking FIXED.

Comment 19

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 92388 has been marked as a duplicate of this bug. ***

Comment 20

[Tracy Walker [:tracy]]

verified fixed on commercial builds:

windows 2001-07-27-06-trunk
mac 2001-07-27-04-trunk

Comment 21

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So, I have a new patch for bug 80203 that I think should fix this.  However, I'm
not sure whether I fixed it.  I successfully loaded the page 5 times without
hitting the assertion that I was expecting to hit.  Any ideas how to be sure?

Comment 22

[Jay Patel [:jay]]

Adding topcrash keyword and Trunk [@ PresShell::UnsuppressAndInvalidate] for
future ref, this *was* a topcrasher on the MozillaTrunk.