Plugin crashes after closing the window

GoogleCodeExporter commented 8 years ago

10.6.2 64b, changesets 290

1. Build FBTestPlugin.plugin
2. Open test.html in Safari
3. Close the window
4. Crash!!!

Console:

11/02/2010 21:02:32 com.apple.WebKit.PluginAgent[50944] 
WebKitPluginHost(53038,0xa04bc500) malloc: *** error for object 0x1206a0: 
pointer being freed 
was not allocated
11/02/2010 21:02:32 com.apple.WebKit.PluginAgent[50944] *** set a breakpoint in 
malloc_error_break to debug
11/02/2010 21:02:42 com.apple.WebKit.PluginAgent[50944] 
WebKitPluginHost(53038,0xa04bc500) malloc: *** error for object 0x303574: 
incorrect 
checksum for freed object - object was probably modified after being freed.
11/02/2010 21:02:42 com.apple.WebKit.PluginAgent[50944] *** set a breakpoint in 
malloc_error_break to debug
11/02/2010 21:02:53 ReportCrash[53040]  Saved crash report for 
WebKitPluginHost[53038] 
version 6531.21 (6531.21.1) to 
/Users/janekp/Library/Logs/DiagnosticReports/WebKitPluginHost_2010-02-11-
210253_IW0005-MAC.crash

Original issue reported on code.google.com by janek.pr...@gmail.com on 11 Feb 2010 at 7:07

Merged into: #69

Attachments:

GoogleCodeExporter commented 8 years ago

PS! We have the same problem with our custom plugin

Original comment by janek.pr...@gmail.com on 11 Feb 2010 at 7:09

GoogleCodeExporter commented 8 years ago

Another crash report. Looks different.

Original comment by janek.pr...@gmail.com on 11 Feb 2010 at 7:17

Attachments:

WebKitPluginHost_2010-02-11-211618_IW0005-MAC.crash

GoogleCodeExporter commented 8 years ago

I believe this to be related to issue 24; could you try editing
src/NpapiPlugin/NPObjectAPI.cpp and adding a second Retain in the constructor?  
Don't
release twice, just retain twice.  See if that makes the issue go away.  (yes, 
I know
this is a hack, but let's see if we can confirm what the problem is)

Original comment by taxilian on 11 Feb 2010 at 8:02

Changed state: Accepted

GoogleCodeExporter commented 8 years ago

Tested. Still crashes. The crash log is different every time. For example:

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000005
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.FBDevTeam.FBTestPlugin      0x00616ed7 NP_Shutdown + 25 
(np_macmain.cpp:69)
1   com.apple.WebKit.PluginHost     0x00005b77 0x1000 + 19319
2   com.apple.WebKit.PluginHost     0x00003fd3 0x1000 + 12243
3   com.apple.WebKit.PluginHost     0x0000d6bf 0x1000 + 50879
4   com.apple.WebKit.PluginHost     0x000071e5 0x1000 + 25061
5   com.apple.CoreFoundation        0x93515e31 __CFRunLoopDoBlocks + 353
6   com.apple.CoreFoundation        0x934c6de3 __CFRunLoopRun + 3715
7   com.apple.CoreFoundation        0x934c5864 CFRunLoopRunSpecific + 452
8   com.apple.CoreFoundation        0x934c5691 CFRunLoopRunInMode + 97
9   com.apple.HIToolbox             0x97a66f0c RunCurrentEventLoopInMode + 392
10  com.apple.HIToolbox             0x97a66cc3 ReceiveNextEventCommon + 354
11  com.apple.HIToolbox             0x97a66b48 
BlockUntilNextEventMatchingListInMode + 81
12  com.apple.AppKit                0x957b1ac5 _DPSNextEvent + 847
13  com.apple.AppKit                0x957b1306 -[NSApplication 
nextEventMatchingMask:untilDate:inMode:dequeue:] + 156
14  com.apple.AppKit                0x9577349f -[NSApplication run] + 821
15  com.apple.WebKit.PluginHost     0x0000625f 0x1000 + 21087
16  com.apple.WebKit.PluginHost     0x00002035 0x1000 + 4149

***

I also managed to crashed the plugin on initialization!

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000028
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.HIToolbox             0x97a534a0 IsHandlerOverridden + 67
1   com.apple.HIToolbox             0x97a53415 
HIView::IsOurHandlerOverridden(unsigned long, unsigned long, 
unsigned long, bool) + 125
2   com.apple.HIToolbox             0x97a5412b 
HIView::SendOwningWindowChanged(unsigned long, 
OpaqueWindowPtr*, OpaqueWindowPtr*) + 51
3   com.apple.HIToolbox             0x97a540be 
HIView::NotifySubtreeWindowChanged(OpaqueWindowPtr*, 
OpaqueWindowPtr*, unsigned char) + 90
4   com.apple.HIToolbox             0x97a53ec1 
HIView::SetWindowRef(OpaqueWindowPtr*) + 107
5   com.apple.HIToolbox             0x97a51664 
WindowData::FinishConstruction(unsigned long, unsigned long 
long, unsigned long, Rect const*, unsigned char*, unsigned int, 
OpaqueWindowPtr*, OpaqueControlRef*) + 
1642
6   com.apple.HIToolbox             0x97a50fb5 
WindowData::Initialize(OpaqueEventRef*) + 555
7   com.apple.HIToolbox             0x97a50d49 
AppleWindowDef::Initialize(OpaqueEventRef*) + 33
8   com.apple.HIToolbox             0x97a3a515 
HIObject::HandleClassHIObjectEvent(OpaqueEventHandlerCallRef*, OpaqueEventRef*, 
void*) + 229
9   com.apple.HIToolbox             0x97a3a3ad 
HIObject::EventHook(OpaqueEventHandlerCallRef*, 
OpaqueEventRef*, void*) + 55
10  com.apple.HIToolbox             0x97a39e29 
DispatchEventToHandlers(EventTargetRec*, 
OpaqueEventRef*, HandlerCallRec*) + 1567
11  com.apple.HIToolbox             0x97a390f0 
SendEventToEventTargetInternal(OpaqueEventRef*, 
OpaqueEventTargetRef*, HandlerCallRec*) + 411
12  com.apple.HIToolbox             0x97a38f4f SendEventToEventTargetWithOptions 
+ 58
13  com.apple.HIToolbox             0x97a349dd HIObject::Create(__CFString 
const*, OpaqueEventRef*, 
HIObject**) + 311
14  com.apple.HIToolbox             0x97a34883 HIObjectCreate + 76
15  com.apple.HIToolbox             0x97a4bf01 NewWindowCommon(WindowData**, 
unsigned long, 
unsigned long long, WindowDefSpec const*, Rect const*, unsigned char const*, 
unsigned char, 
OpaqueWindowPtr*, long, unsigned int, unsigned short*, bool) + 1481
16  com.apple.HIToolbox             0x97a96af6 
CreateNewWindowInternal(WindowDefSpec const*, unsigned 
long, unsigned long long, Rect const*, OpaqueWindowPtr**) + 328
17  com.apple.WebKit.PluginHost     0x0000e0e9 0x1000 + 53481
18  com.apple.WebKit.PluginHost     0x00004145 0x1000 + 12613
19  com.apple.WebKit.PluginHost     0x000070e8 0x1000 + 24808

Original comment by janek.pr...@gmail.com on 12 Feb 2010 at 5:29

GoogleCodeExporter commented 8 years ago

If safari is running in 64 bit, and the plugin is being built only in 32 bit, 
it'll likely not 
work right.  right-click on safari icon in applications, a checkbox off in 
"open in 32-bit 
mode" tells you if safari is in 64 or 32 bit.  if it's in 64 bit, the plugins 
will need to built 
for, or include 64 bit code.  flipping safari to open in 32 bit will probably 
tell you if 
that's the issue.

j.h.

Original comment by sleeples...@gmail.com on 17 Feb 2010 at 6:57

GoogleCodeExporter commented 8 years ago

The custom plugin is now compiled as:

32 - i386, ppc and SDK 10.4
64 - x86_64 and SDK 10.5

I don't see crashes in 32 bit mode anymore, but see in 64 bit mode. One tester 
is also confirming it (claims 
10.6.2 and 32b).

Initially I used SDK 10.6

Original comment by janek.pr...@gmail.com on 17 Feb 2010 at 10:13

GoogleCodeExporter commented 8 years ago

Re: claims 10.6.2 and 32b

Was incorrect I think. Crash report contains:

Code Type:       X86-64 (Native)
Parent Process:  WebKitPluginAgent [2612]
Date/Time:       2010-02-17 12:06:11.587 +0200
OS Version:      Mac OS X 10.6.2 (10C540)

Could the problem be base SDK related?

Original comment by janek.pr...@gmail.com on 17 Feb 2010 at 10:18

GoogleCodeExporter commented 8 years ago

Original comment by georg.fritzsche on 24 Mar 2010 at 1:07

Added labels: OpSys-OSX

GoogleCodeExporter commented 8 years ago

Original comment by taxilian on 9 Sep 2010 at 2:00

GoogleCodeExporter commented 8 years ago

I can't reproduce this anymore; I think it may have been fixed in 1.2 by the 
shared_ptr changed, as this could be related to some weird AutoPtr edge cases.

Can someone confirm whether or not this is gone?

Original comment by taxilian on 16 Sep 2010 at 5:29

Changed state: Recheck

GoogleCodeExporter commented 8 years ago

Unfortunately the bug still exists after the shared_ptr change. Same process of 
steps to reproduce, though it doesn't seem to be consistent.

Original comment by amack...@gmail.com on 20 Sep 2010 at 3:40

GoogleCodeExporter commented 8 years ago

Original comment by taxilian on 20 Sep 2010 at 3:49

Changed state: Duplicate

divyang4481 / firebreath

Plugin crashes after closing the window #26