1089561 - crash in imgStatusTracker::SyncNotifyState(nsTObserverArray<mozilla::WeakPtr<imgRequestProxy> >&, bool, unsigned int, nsIntRect&, bool)

Status: RESOLVED WONTFIX

(Core :: Graphics: ImageLib, defect)

Description

[Andrei Eftimie]

This bug was filed from the Socorro interface and is 
report bp-78431f04-15ff-4f87-b257-811d32141027.
=============================================================

First 10 stack frames:
> 0 libxul.so imgStatusTracker::SyncNotifyState(nsTObserverArray<mozilla::WeakPtr<imgRequestProxy> >&, bool, unsigned int, nsIntRect&, bool)  xpcom/base/nsAutoPtr.h
> 1 libxul.so imgStatusTracker::SyncNotifyDifference(mozilla::image::ImageStatusDiff const&)  image/src/imgStatusTracker.cpp
> 2 libxul.so mozilla::image::RasterImage::FinishedSomeDecoding(mozilla::image::RasterImage::eShutdownIntent, mozilla::image::RasterImage::DecodeRequest*)  image/src/RasterImage.cpp
> 3 libxul.so mozilla::image::RasterImage::OnImageDataComplete(nsIRequest*, nsISupports*, tag_nsresult, bool) image/src/RasterImage.cpp
> 4 libxul.so imgRequest::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult)  image/src/imgRequest.cpp
> 5 libxul.so nsBaseChannel::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) netwerk/base/src/nsBaseChannel.cpp
> 6 libxul.so nsInputStreamPump::OnStateStop()  netwerk/base/src/nsInputStreamPump.cpp
> 7 libxul.so nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) netwerk/base/src/nsInputStreamPump.cpp
> 8 libxul.so nsInputStreamReadyEvent::Run()  xpcom/io/nsStreamUtils.cpp
> 9 libxul.so nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp
> 10  libxul.so NS_InvokeByIndex  xpcom/reflect/xptcall/md/unix/xptcinvoke_x86_64_unix.cpp


Nothing suspicious in the testrun log:
> 20:09:51 TEST-END | testSecurity/testSSLDisabledErrorPage.js | finished in 1486ms
> 20:09:52 TEST-START | testSecurity/testSafeBrowsingNotificationBar.js | setupModule
> 20:09:52 TEST-START | testSecurity/testSafeBrowsingNotificationBar.js | testNotificationBar
> 20:10:07 
> 20:10:07 ###!!! [Child][MessageChannel::SendAndWait] Error: Channel error: cannot send/recv
> 20:10:08 mozcrash INFO | Saved minidump as /home/mozauto/.mozilla/firefox/Crash Reports/pending/6ce0c0d1-44ad-dc70-7d27c2c3-1c30e894.dmp
> 20:10:08 mozcrash INFO | Saved app info as /home/mozauto/.mozilla/firefox/Crash Reports/pending/6ce0c0d1-44ad-dc70-7d27c2c3-1c30e894.extra
> 20:10:09 PROCESS-CRASH | /home/mozauto/jenkins/workspace/release-mozilla-beta_remote/data/mozmill-tests/firefox/tests/remote/testSecurity/testSafeBrowsingNotificationBar.js | application crashed [unknown top frame]
> 20:10:09 Crash dump filename: /home/mozauto/jenkins/workspace/release-mozilla-beta_remote/data/profile/minidumps/6ce0c0d1-44ad-dc70-7d27c2c3-1c30e894.dmp
> 20:10:09 No symbols path given, can't process dump.
> 20:10:09 MINIDUMP_STACKWALK not set, can't process dump.
> 20:10:09 
> 20:10:09 (process:4124): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size == 0' failed
> 20:10:12 TEST-START | testSecurity/testSafeBrowsingWarningPages.js | setupModule

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Most crashes actually happen on Windows:

Windows XP 	48.00 %	12
Windows 7 	36.00 %	9
Windows 8.1 	12.00 %	3
Linux 	4.00 %	1 

Whereby there is a slightly different call stack for older builds of the 33 release:

0 	xul.dll 	imgStatusTracker::SyncNotifyState(nsTObserverArray<mozilla::WeakPtr<imgRequestProxy> >&, bool, unsigned int, nsIntRect&, bool) 	image/src/imgStatusTracker.cpp
1 	xul.dll 	imgStatusTracker::SyncNotifyDifference(mozilla::image::ImageStatusDiff const&) 	image/src/imgStatusTracker.cpp
2 	xul.dll 	mozilla::image::RasterImage::FinishedSomeDecoding(mozilla::image::RasterImage::eShutdownIntent, mozilla::image::RasterImage::DecodeRequest*) 	image/src/RasterImage.cpp
3 	xul.dll 	mozilla::image::RasterImage::RequestDecodeCore(mozilla::image::RasterImage::RequestDecodeType) 	image/src/RasterImage.cpp
4 	xul.dll 	mozilla::image::RasterImage::StartDecoding() 	image/src/RasterImage.cpp
5 	xul.dll 	imgRequest::StartDecoding() 	image/src/imgRequest.cpp
6 	xul.dll 	imgRequestProxy::StartDecoding() 	image/src/imgRequestProxy.cpp
7 	xul.dll 	nsDocument::AddImage(imgIRequest*) 	content/base/src/nsDocument.cpp
8 	xul.dll 	nsImageLoadingContent::TrackImage(imgIRequest*) 	content/base/src/nsImageLoadingContent.cpp
9 	xul.dll 	nsImageLoadingContent::IncrementVisibleCount() 	content/base/src/nsImageLoadingContent.cpp
10 	xul.dll 	PresShell::MarkImagesInSubtreeVisible(nsIFrame*, nsRect const&) 	layout/base/nsPresShell.cpp

Looks like that only 33.0 and 34.0 releases are affected.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.