938796 - navigator.plugins.refresh(true) in plugin destruction triggers mozilla::ipc::RPCChannel::DebugAbort "mismatched CxxStackFrame ctor/dtors"

Status: RESOLVED INVALID

(Core Graveyard :: Plug-ins, defect)

Description

[John Schoenick [:johns]]

Split out from bug 864112, this specific testcase is triggering this failure when calling navigator.plugins.refresh(true) inside plugin destruction. This call refreshes the page, as well as our list of plugins.

However, at:
http://dxr.mozilla.org/mozilla-central/source/dom/base/nsPluginArray.cpp#125

We should only be refreshing the page if plugins actually changed, so that may be broken as well...

Comment 1

[John Schoenick [:johns]]

Attachment: Testcase - requires nptest plugin enabled

Comment 2

[John Schoenick [:johns]]

So the issue here is that IsRunningPlugin returns false for code running inside NPP_Destroy, allowing RefreshPlugins to try to unload the plugin inside a plugin call:

http://dxr.mozilla.org/mozilla-central/source/dom/plugins/base/nsPluginHost.cpp#353

Other instances of pluginTag->TryUnloadPlugin (which doesn't "try", but rather unconditionally does) in this file don't look to be carefully re-entrance checked either.

Comment 3

[Anne (:annevk)]

navigator.plugins is now always empty.