See http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1289405080.1289406163.19151.gz&fulltext=1 The plugin is crashing and then we're painting the layer. Setting up the plugin-crashed UI doesn't happen for a couple of event loop cycles after the plugin actually crashes. We need to clear out the layer when the plugin crashes, because we only hold the X display alive as long as the PluginModuleParent. ###!!! [Parent][RPCChannel] Error: Channel error: cannot send/recv WARNING: Failed to send message!: file /builds/slave/mozilla-central-linux-debug/build/dom/plugins/PluginScriptableObjectParent.cpp, line 219 JavaScript error: file:///home/cltbld/talos-slave/mozilla-central_fedora-debug_test-reftest/build/reftest/tests/modules/plugin/test/reftest/pluginproblemui-direction-2-ref.html, line 22: Error calling method on NPObject! ###!!! ABORT: RenderComposite: RenderBadPicture (invalid Picture parameter); 70 requests ago; id=0x40248a7 Re-running with MOZ_X_SYNC=1 in the environment may give a more helpful backtrace.: file /builds/slave/mozilla-central-linux-debug/build/toolkit/xre/nsX11ErrorHandler.cpp, line 190 X11Error [toolkit/xre/nsX11ErrorHandler.cpp:191] libbonoboui-2.so.0 + 0x20946 libX11.so.6 + 0x3c121 libX11.so.6 + 0x428e7 libX11.so.6 + 0x43327 libX11.so.6 + 0x2b978 libgdk-x11-2.0.so.0 + 0x56469 libgdk-x11-2.0.so.0 + 0x565e9 libglib-2.0.so.0 + 0x3a2b0 libglib-2.0.so.0 + 0x3a669 libglib-2.0.so.0 + 0x3ab74 nsAppShell::ProcessNextNativeEvent [widget/src/gtk2/nsAppShell.cpp:145] nsBaseAppShell::DoProcessNextNativeEvent [widget/src/xpwidgets/nsBaseAppShell.cpp:162] nsBaseAppShell::OnProcessNextEvent [widget/src/xpwidgets/nsBaseAppShell.cpp:303] nsThread::ProcessNextEvent [xpcom/threads/nsThread.cpp:578] NS_ProcessNextEvent_P [nsThreadUtils.cpp:250] mozilla::ipc::MessagePump::Run [ipc/glue/MessagePump.cpp:110] MessageLoop::RunInternal [ipc/chromium/src/base/message_loop.cc:220] MessageLoop::RunHandler [ipc/chromium/src/base/message_loop.cc:203] MessageLoop::Run [ipc/chromium/src/base/message_loop.cc:176] nsBaseAppShell::Run [widget/src/xpwidgets/nsBaseAppShell.cpp:187] nsAppStartup::Run [toolkit/components/startup/src/nsAppStartup.cpp:191] XRE_main [toolkit/xre/nsAppRunner.cpp:3682] main [browser/app/nsBrowserApp.cpp:158] libc.so.6 + 0x16bb6

The hypothesis so far is that a plugin's surface is outliving its PluginModuleParent, which isn't something bug 598862 fixed. If that's so, then this crash is incredibly "lucky". I'm not sure offhand how to write a test for it, will scratch my head for a bit.

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1289411705.1289412212.14876.gz Rev3 Fedora 12x64 mozilla-central opt test reftest [testfailed] REFTEST TEST-START | file:///home/cltbld/talos-slave/mozilla-central_fedora64_test-reftest/build/reftest/tests/modules/plugin/test/reftest/pluginproblemui-direction-2.html ###!!! [Parent][RPCChannel] Error: Channel error: cannot send/recv ^G###!!! ABORT: RenderComposite: RenderBadPicture (invalid Picture parameter); 70 requests ago: file /builds/slave/mozilla-central-linux64/build/toolkit/xre/nsX11ErrorHandler.cpp, line 190

I don't know of a good way to test this, so let's just try the untested version.

Comment on attachment 489574 [details] [diff] [review] Clear the surface when the plugin is dying, rev. 1 This part looks good to me, though a comment explaining why InvalidateRect([0,0,0,0]) is being called would help. Does nsPluginInstanceOwner::SetCurrentImage() also need to clear the current image of aContainer? http://hg.mozilla.org/mozilla-central/annotate/6eef4ea21123/layout/generic/nsObjectFrame.cpp#l1697

It would be better to XSync in PluginModuleParent::ActorDestroy instead of each instance, but I'm not sure it matters too much for this case.

karl, like this?