Bug 16822 - segmentation fault in mozilla plugin
Summary: segmentation fault in mozilla plugin
Alias: None
Product: swfdec
Classification: Unclassified
Component: plugin (show other bugs)
Version: git
Hardware: Other All
: medium blocker
Assignee: swfdec ml
QA Contact: swfdec ml
Depends on:
Reported: 2008-07-23 15:47 UTC by Riccardo Magliocchetti
Modified: 2008-08-27 02:57 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Note You need to log in before you can comment on or make changes to this bug.
Description Riccardo Magliocchetti 2008-07-23 15:47:39 UTC
How to reproduce:

- Open the properties dialog of swfmoz
- Close the associated tab in firefox
- Boom!

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7c3e6c0 (LWP 27014)]
0xb7793c59 in nsQueryInterface::operator() (this=<value optimized out>, 
    aIID=@0xb7921ed4, answer=0xbfa023f0) at nsCOMPtr.cpp:47
47	nsCOMPtr.cpp: No such file or directory.
	in nsCOMPtr.cpp
(gdb) bt full
#0  0xb7793c59 in nsQueryInterface::operator() (this=<value optimized out>, 
    aIID=@0xb7921ed4, answer=0xbfa023f0) at nsCOMPtr.cpp:47
	status = <value optimized out>
#1  0xb7793d11 in nsCOMPtr_base::assign_from_qi (this=0xbfa02438, qi=
      {mRawPtr = 0x10001000}, iid=@0x10001000) at nsCOMPtr.cpp:96
	newRawPtr = <value optimized out>
#2  0xb76545f2 in _destroystream (npp=0xae87a6d8, pstream=0xae6195a0, reason=0)
    at ../../../../dist/include/xpcom/nsCOMPtr.h:645
	guard = {<PRCListStr> = {next = 0xb7a1b378, prev = 0xb7a1b378}, 
  mInstance = {<nsCOMPtr_base> = {mRawPtr = 0xb7bbdfe8}, <No data fields>}, 
  mDelayedDestroy = 0, static sListHead = {next = 0xbfa02428, 
    prev = 0xbfa02428}}
	listener = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}
#3  0xb281aef0 in plugin_destroy_stream (instance=0xae87a6d8, 
    stream=0xae6195a0) at plugin.c:79
No locals.
#4  0xb281db43 in swfmoz_loader_close (stream=0xadfcb408) at swfmoz_loader.c:88
No locals.
#5  0xafda319e in swfdec_stream_ensure_closed (stream=0xadfcb408)
    at swfdec_stream.c:267
	priv = (SwfdecStreamPrivate *) 0xadfcb438
	__PRETTY_FUNCTION__ = "swfdec_stream_ensure_closed"
#6  0xafd816c5 in swfdec_net_stream_set_loader (stream=0xae684520, loader=0x0)
---Type <return> to continue, or q <return> to quit---
    at swfdec_net_stream.c:650
	__PRETTY_FUNCTION__ = "swfdec_net_stream_set_loader"
#7  0xafd821cc in swfdec_net_stream_dispose (object=0xae684520)
    at swfdec_net_stream.c:471
	stream = (SwfdecNetStream *) 0xae684520
	__PRETTY_FUNCTION__ = "swfdec_net_stream_dispose"
#8  0xb6afa9e8 in IA__g_object_unref (_object=0xae684520)
    at /tmp/buildd/glib2.0-2.16.4/gobject/gobject.c:1765
	object = (GObject *) 0xae684520
	__PRETTY_FUNCTION__ = "IA__g_object_unref"
#9  0xafd510de in swfdec_as_object_collect (object=0xae684520)
    at swfdec_as_object.c:828
	__PRETTY_FUNCTION__ = "swfdec_as_object_collect"
#10 0xafd3fe62 in swfdec_as_context_remove_objects (key=0xae684520, 
    value=0xae684520, debugger=0x0) at swfdec_as_context.c:297
	__PRETTY_FUNCTION__ = "swfdec_as_context_remove_objects"
#11 0xb6a64bd5 in g_hash_table_foreach_remove_or_steal (hash_table=0xb2dcfa78, 
    func=0xafd3fd60 <swfdec_as_context_remove_objects>, user_data=0x0, 
    notify=1) at /tmp/buildd/glib2.0-2.16.4/glib/ghash.c:975
	node = (GHashNode *) 0xae081d20
	node_ptr = (GHashNode **) 0xacd1f290
	deleted = 11633
	i = 12452
Comment 1 Riccardo Magliocchetti 2008-08-16 12:31:53 UTC
The exact steps are these:

- open the properties dialog
- close the tab from where the menu has been opened
- close the properties dialog
Comment 2 Benjamin Otte 2008-08-27 02:57:31 UTC
fixed in git.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.