10789 - moving off a view-image page crashes in SetDocumentChannel()

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[pnunn]

I see a crash when I do a view image (any image, any type)
and unload the page. I'd be happy to work on this, but I don't
understand how the LoadGroups and Channels work yet.

Before the crash I hit an assert in nsLoadGroup::RemoveChannel()
at line 405 in nsLoadGroup.cpp.

NS_ASSERTION(mForegroundCount > 0, "mForegroundCount messed up");

Here is the call stack:

nsDocLoaderImpl::SetDocumentChannel(nsIChannel * 0x1865e750) line 1376 + 24
bytes
nsDocumentBindInfo::Bind(nsIURI * 0x1865ec40, nsIStreamListener * 0x00000000)
line 1660
nsDocumentBindInfo::Bind(const nsString & {...}, nsIPostData * 0x00000000,
nsIStreamListener * 0x00000000) line 1598 + 16 bytes
nsDocLoaderImpl::LoadDocument(nsDocLoaderImpl * const 0x00c66660, const nsString
& {...}, const char * 0x00fe7fd4, nsIContentViewerContainer * 0x00c652d0,
nsIPostData * 0x00000000, nsISupports * 0x00000000, nsIStreamObserver *
0x00c642a4, unsigned int 0, const unsigned int 0) line 671 + 21 bytes
nsWebShell::DoLoadURL(const nsString & {...}, const char * 0x00fe7fd4,
nsIPostData * 0x00000000, unsigned int 0, const unsigned int 0) line 1942
nsWebShell::GoTo(nsWebShell * const 0x00c652d0, int 0) line 2248 + 23 bytes
nsWebShell::Back(nsWebShell * const 0x00c652d0) line 2199
nsBrowserWindow::Back() line 697
HandleBackEvent(nsGUIEvent * 0x0012fccc) line 367
nsWindow::DispatchEvent(nsWindow * const 0x00c67e74, nsGUIEvent * 0x0012fccc,
nsEventStatus & nsEventStatus_eIgnore) line 490 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fccc) line 515
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3257 +
15 bytes
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 983064, long *
0x0012fee4) line 2525 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00290482, unsigned int 514, unsigned int 0, long
983064) line 563 + 27 bytes
USER32! 77e71268()

Comment 1

[Warren Harris]

Can you try this again. SetDocumentChannel went away tonight. Thanks.

Comment 2

[pnunn]

Just retried it and I still get a crash when I do
a view-image. Now it crashes _before_ it gets to the
view-image not after.

The call stack is different. Should I open a new
bug on it, or keep it here on 10789?

Here the new callstack:
nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x00c664a4, nsIDocumentLoader *
0x00c67840, nsIChannel * 0x1876f960, int 0, nsIDocumentLoaderObserver *
0x00c664a4) line 2958 + 36 bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsIDocumentLoader * 0x00c67840,
nsIChannel * 0x1876f960, int 0) line 1101
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x00c67844, nsIChannel *
0x1876f960, nsISupports * 0x00000000, unsigned int 0, const unsigned short *
0x00000000) line 1023
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x18754fc0) line
274
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x18754fc4) line 149 + 12 bytes
PL_HandleEvent(PLEvent * 0x18754fc4) line 509 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00c1fe10) line 470 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x074e028a, unsigned int 49438, unsigned int 0,
long 12713488) line 932 + 9 bytes
USER32! 77e71268()
00c1fe10()

Comment 3

[leger]

Clearing INVADID resolution due to Re-open.

Comment 4

[Warren Harris]

More doc loader stuff for Rick to verify with his forthcoming changes.

Comment 5

[rpotts (gone)]

I've fixed this on the M9 branch...
It turned out to be an extra NS_RELEASE in the nsImageDocument :-(

I'll close it out when i merge the changes back into the tip.
-- rick

Comment 6

[rpotts (gone)]

I've landed the M9 branch...

Comment 7

[Paul MacQuiddy]

eli, do you want to verify this? seems up your alley...

Comment 8

[Eli Goldberg]

I'd much rather reassign it back to paulmac, since it looks like an engineering
issue, and I'm not qualified to verify it. ;)

Comment 9

[pnunn]

Hi Gang.
This has been fixed. I filed the bug.
After updating my tree yesterday, I do not
see the bug.
To verify, simply view a single image (no html) of any image type (gif,
jpeg,etc).
Go to another page. Any other page.
If your browser did not crash, then you just verified that
the bug is fixed.
-pn

Comment 10

[Paul MacQuiddy]

thanks pam

Comment 11

[leger]

Bulk move of all Necko (to be deleted component) bugs to new Networking

component.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d8236fb55218
[fenix] Migrate some SessionManager usage to BrowserStore (https://github.com/mozilla-mobile/fenix/pull/10789)