Bugzilla@Mozilla – Bug 584512
nsPluginArray - memory corruption
Last modified: 2010-09-27 18:19:14 PDT
Summon comment box
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.14 Safari/534.3 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 Looks like it's a use-after-free issue. I think the testcase is self-explaining although it's quite weak - it takes a lot of time to trigger the crash. Reproducible: Always http://crash-stats.mozilla.com/report/index/4b3b731c-511c-484c-a13f-ff27b2100804 Also crashes 4.0b2.
Created attachment 462935 [details] testcase
mrbkap thinks he has a patch
Created attachment 462981 [details] [review] Proposed fix This should do it -- we need to ensure that we notify our weak references about stuff going away. I'll file a followup bug after this lands on getting rid of the manual refcounting.
Comment on attachment 462981 [details] [review] Proposed fix >+ if (mMimeTypeArray) >+ mMimeTypeArray->Invalidate(); s/mMimeTypeArray/mMimeTypes/g
Created attachment 463008 [details] [review] Oops, yes
Let's get this into the branches.
Pushed to mozilla-central. http://hg.mozilla.org/mozilla-central/rev/fe1b3c35fa9d
Comment on attachment 463008 [details] [review] Oops, yes a=LegNeato for 1.9.2.9. This needs to be landed as soon as possible. Does the same apply to 1.9.1?
Comment on attachment 463008 [details] [review] Oops, yes Note: this patch applies cleanly after s|dom/base|dom/src/base|g
Comment on attachment 463008 [details] [review] Oops, yes a=LegNeato for 1.9.1.12
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/a962fcafdd3e
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/addd2db5f27d
Verified with attached testcase in 1.9.1 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.12pre) Gecko/20100817 Shiretoko/3.5.12pre ( .NET CLR 3.5.30729) and in 1.9.2 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.9pre) Gecko/20100817 Namoroka/3.6.9pre ( .NET CLR 3.5.30729).