305215 - Crash going back while loading an image [@ ImageListener::OnStopRequest]

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Frank Wein [:mcsmurf]]

To reproduce this fetch a current nightly build, then do this:

1. Go to http://uc.relog.ch/bygw/
2. Click on any picture
3. Click the back button while the image is still loading

Result:
Crash

Stacktrace:
ImageListener::OnStopRequest(ImageListener * const 0x00000000, nsIRequest *
0x03a68b74, nsISupports * 0x00000000, unsigned int 2152398850) line 233 + 11 bytes
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x03b5ef38,
nsIRequest * 0x03a68b74, nsISupports * 0x00000000, unsigned int 2152398850) line 390
nsStreamListenerTee::OnStopRequest(nsStreamListenerTee * const 0x03a68b74,
nsIRequest * 0x03a68b7c, nsISupports * 0x012fe982, unsigned int 63985264) line
65 + 21 bytes
XPCOM_CORE! @ILT+2225(?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z)
address 0x100018b6
nsInputStreamPump::OnStateStop(nsInputStreamPump * const 0x00000000) line 507
nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x03cd62dc,
nsIAsyncInputStream * 0x03a11478) line 344
nsInputStreamReadyEvent::EventHandler(PLEvent * 0x03d0a1a4) line 120
PL_HandleEvent(PLEvent * 0x03d0a1a4) line 689
PL_ProcessPendingEvents(PLEventQueue * 0x10033bc2) line 623 + 6 bytes
_md_EventReceiverProc(HWND__ * 0x01a3cca5, unsigned int 1, unsigned int 1244908,
long 27080919) line 1409
0012ffb0()

Almost certainly fallout from Bug 292503.

Comment 1

[Ruediger Lahl]

(In reply to comment #0)

> To reproduce this fetch a current nightly build, then do this:
> 
> 1. Go to http://uc.relog.ch/bygw/
> 2. Click on any picture
> 3. Click the back button while the image is still loading
> 
> Result:
> Crash

Sorry Frank. I cant reproduce that. All pictures loading correctly and the
back-buttom works fine(eaven while loading the pictures).

Testet with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1)
Gecko/20050819 SeaMonkey/1.0a Build 2005081907

Comment 2

[Tobias Fischer]

I can confirm this with CREATURE-Builds 2005081906 and 2005081909; TB8529643H

Comment 3

[Frank Wein [:mcsmurf]]

BTW: Another way to reproduce this is opening a picture in a new tab and closing
that tab during load.
To prevent any more debugging on this ;), the problem is imgDoc->mImageContent
being null (probably because ::Destroy is called async which sets mImageContent
to null).

Comment 4

[Frank Wein [:mcsmurf]]

Attachment: Patch

Also fixed the review comments from the other bug

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 193207 [details] [diff] [review]
Patch

I'd add a comment describing why mImageContent can be null (namely, because the
document is already destroyed at this point)

Comment 6

[Mats Palmgren (inactive)]

*** Bug 305299 has been marked as a duplicate of this bug. ***

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 193207 [details] [diff] [review]
Patch

sr=jst

Comment 8

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Comment on attachment 193207 [details] [diff] [review]
Patch

Regression fix for another patch I'd like to land on branch.

Comment 9

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Checked in on trunk.

Comment 10

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Landed along with bug 292503 on branch.

Comment 11

[Tracy Walker [:tracy]]

Verified on Deer Park branch with: Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8b4) Gecko/20050901 Firefox/1.0+