1133133 - crash in mozilla::image::imgFrame::ImageUpdated(nsIntRect const&)

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-887f5293-4a8c-4908-99bc-f34492150212.
=============================================================

This signature has relatively high volume since v36:

Product	Version	Percentage	Number Of Crashes
Firefox 	36.0b6 	44.56 %	381
Firefox 	36.0b8 	12.63 %	108
Firefox 	37.0a2 	6.08 %	52
Firefox 	36.0b7 	2.81 %	24
Firefox 	38.0a1 	2.22 %	19
Firefox 	36.0b1 	0.94 %	8
Firefox 	36.0b5 	0.94 %	8
Firefox 	36.0b3 	0.47 %	4
Firefox 	36.0b4 	0.47 %	4
Firefox 	36.0b2 	0.23 %	2
Firefox 	35.0.1 	0.12 %	1


mozilla::image::imgFrame::ImageUpdated(nsIntRect const&)
mozilla::image::Decoder::PostInvalidation(nsIntRect&)
mozilla::image::nsBMPDecoder::WriteInternal(char const*, unsigned int)
mozilla::image::Decoder::Write(char const*, unsigned int)
mozilla::image::nsICODecoder::WriteToContainedDecoder(char const*, unsigned int)
mozilla::image::nsICODecoder::WriteInternal(char const*, unsigned int)
mozilla::image::Decoder::Write(char const*, unsigned int)
mozilla::image::RasterImage::WriteToDecoder(char const*, unsigned int)
mozilla::image::RasterImage::DecodeSomeData(unsigned int)
mozilla::image::DecodePool::DecodeSomeOfImage(mozilla::image::RasterImage*, mozilla::image::DecodeUntil, unsigned int)
mozilla::image::DecodeWorker::Run()
nsThreadPool::Run()
nsThread::ProcessNextEvent(bool, bool*)
NS_ProcessNextEvent(nsIThread*, bool)
mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)

Comment 1

[u480271]

Seth, any ideas?

Comment 2

[Matthew]

Having not seen (yay!) or reported any real Firefox bugs before I'm a bit new to this.. but I've just been getting this problem.

I have submitted a bug report at https://bugzilla.mozilla.org/show_bug.cgi?id=1155722 detailing how I have discovered it. It's 100% reproducible so I am happy to do any further testing you require.

Comment 3

[Mike Hommey [:glandium]]

Isn't this just the same as bug 1155722, which is fixed? Note that I received a crash report for what looks like the same backtrace on Debian for ESR38.

Comment 5

[Tyson Smith [:tsmith]]

Is bug 1238558 a dup? It looks similar and has a test case.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

Quite possible; we certainly don't seem to be having any more reports with this signature.