724812 - Crash @ nsCOMPtr_base::assign_assuming_AddRef | nsPluginInstanceOwner::CreateWidget

Status: RESOLVED DUPLICATE of bug 723523

(Core Graveyard :: Plug-ins, defect)

Description

[Scoobidiver (away)]

It first appeared in 13.0a1/20120201.
The regression window is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3f26b7bee352&tochange=e18c7bc2c28e
It's likely caused by bug 90268.

Signature 	nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsPluginInstanceOwner::CreateWidget() More Reports Search
UUID	eae2d8d5-7620-419d-909f-722c72120206
Date Processed	2012-02-06 17:05:37
Uptime	706
Last Crash	11.8 minutes before submission
Install Age	1.5 hours since version was first installed.
Install Time	2012-02-06 15:35:49
Product	Firefox
Version	13.0a1
Build ID	20120206031148
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 10 stepping 0
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xfffffffff0de7fff
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x68b8, AdapterSubsysID: 22881787, AdapterDriverVersion: 8.710.0.0
D3D10 Layers? D3D10 Layers-
D3D9 Layers? D3D9 Layers-
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsCOMPtr_base::assign_assuming_AddRef 	obj-firefox/dist/include/nsCOMPtr.h:469
1 	xul.dll 	nsPluginInstanceOwner::CreateWidget 	dom/plugins/base/nsPluginInstanceOwner.cpp:3352
2 	xul.dll 	nsCOMPtr_base::assign_from_gs_contractid 	obj-firefox/xpcom/build/nsCOMPtr.cpp:132
3 	xul.dll 	nsCOMPtr_base::assign_from_gs_contractid 	obj-firefox/xpcom/build/nsCOMPtr.cpp:134
4 	xul.dll 	ns_if_addref<nsIDOMGeoPositionAddress*> 	obj-firefox/dist/include/nsISupportsUtils.h:94
5 	xul.dll 	nsPluginInstanceOwner::GetInstance 	dom/plugins/base/nsPluginInstanceOwner.cpp:495
6 	xul.dll 	nsPluginHost::InstantiateEmbeddedPlugin 	dom/plugins/base/nsPluginHost.cpp:1096

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsCOMPtr_base%3A%3Aassign_assuming_AddRef%28nsISupports*%29%20|%20nsPluginInstanceOwner%3A%3ACreateWidget%28%29

Comment 1

[Marcia Knous [:marcia]]

I can reproduce this crash using Mozilla/5.0 (Windows NT 5.1; rv:13.0a1) Gecko/20120214 Firefox/13.0a1 by loading:

http://wetter.msn.com/averages.aspx?lat=50.1021053&lon=8.7645146

https://crash-stats.mozilla.com/report/index/bp-d1630a09-e8ec-4482-bf5f-e63d62120214

Comment 2

[Josh Aas]

I can't reproduce this on Windows 7 with the latest Firefox nightly and Flash 11.1. Perhaps this fixed it:

http://hg.mozilla.org/mozilla-central/rev/167b8460ef0d

Marcia - can you still repro?

Comment 3

[Marcia Knous [:marcia]]

I just crashed again on Win XP using the latest nightly:

https://crash-stats.mozilla.com/report/index/bp-05f5921d-a3a1-4923-9e83-f29102120215

Sometimes that site crashes 2-3 times and then I cannot get it to crash again. I will try on Windows 7 as well but it I can reproduce it fairly reliably on Windows XP.

Comment 4

[Sheila Mooney]

Josh, do you have someone we can assign this to since it's reproducible?

Comment 5

[Josh Aas]

I can't reproduce this, maybe Jim Mathies can?

Comment 6

[Sheila Mooney]

Marcia can reproduce this. Is there something she could get you that would be helpful? Any sort of diagnostics?

Comment 7

[Jim Mathies [:jimm]]

(In reply to Josh Aas (Mozilla Corporation) from comment #5)
> I can't reproduce this, maybe Jim Mathies can?

I tried the msn site yesterday, multiple reloads, didn't get a crash. This was on Win7 w/ a nightly.

Comment 8

[Marcia Knous [:marcia]]

Sometimes I have to shift-reload the page on Win XP 4-5 times before I can generate the crash. I am running with the latest version of Flash from Adobe.com that was released yesterday.

I will try on Windows 7 next to see if I can generate a crash there but on XP it is fairly easy.

Comment 9

[Marcia Knous [:marcia]]

I tried the Win 7 machine in the lab using the latest nightly and I have not been able to reproduce it yet either.

Comment 10

[Marcia Knous [:marcia]]

Another site that crashed for me today is http://starlounge.de.msn.com/bilder.aspx?cp-documentid=160612643#image=2. So far I only got it to crash once. This crash was in a Win 7 VM: https://crash-stats.mozilla.com/report/index/bp-5332760f-c677-412d-9910-8a6c12120227.

Comment 11

[Marcia Knous [:marcia]]

Today I crashed on another MSN site after updating. http://local.msn.com/ten-day.aspx?q=Middletown-CT&eid=21225&zip=06457 the URL I was on when the crash occurred.

https://crash-stats.mozilla.com/report/index/bp-54838c8d-b17d-4945-be42-a1da42120229

Comment 12

[Jim Mathies [:jimm]]

What are the STR on these msn sites - multiple reloads then crash, crash on first load, or..?

Comment 13

[Jim Mathies [:jimm]]

Also, Marcia, you might take the try builds in Bug 724781 for a spin. Different crash but the bug there could manifest in a lot of weird ways.

Comment 14

[Marcia Knous [:marcia]]

Jim: This time I loaded the weather site and kept changing my location. I didn't get a crash right away, but it crashed after I updated and tried to open a new tab.

When I was testing previously, I was reloading multiple times before getting a crash.

I will try the build in Comment 13.

(In reply to Jim Mathies [:jimm] from comment #12)
> What are the STR on these msn sites - multiple reloads then crash, crash on
> first load, or..?

Comment 15

[Marcia Knous [:marcia]]

Jim: see Bug 723523 Comment 8 for some STR that generate this signature. It is reproducible for me pretty regularly.

Comment 16

[Josh Aas]

I can't reproduce this and the crash volume is so low it doesn't even show up in the top 100. Care to take a look, Jim?