1573055 - Crash in [@ objc_msgLookup_fpret]

Status: RESOLVED DUPLICATE of bug 1568862

(Core :: Graphics: ImageLib, defect)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

This bug is for crash report bp-0f0d293c-025b-4259-a895-e20df0190730.

Top 10 frames of crashing thread:

0 libobjc.A.dylib objc_msgLookup_fpret 
1 XUL imgRequestProxy::Notify image/imgRequestProxy.cpp:1018
2 XUL void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*> image/ProgressTracker.cpp:333
3 XUL mozilla::image::ProgressTracker::SyncNotifyProgress image/ProgressTracker.cpp:370
4 XUL mozilla::image::RasterImage::NotifyProgress image/RasterImage.cpp:1622
5 XUL mozilla::image::RasterImage::NotifyDecodeComplete image/RasterImage.cpp:1656
6 XUL mozilla::detail::RunnableFunction<mozilla::image::IDecodingTask::NotifyDecodeComplete image/IDecodingTask.cpp:123
7 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
8 XUL NS_ProcessPendingEvents xpcom/threads/nsThreadUtils.cpp:434
9 XUL nsBaseAppShell::NativeEventCallback widget/nsBaseAppShell.cpp:87

There's a number of crashes under this signature most of which are useless, but this particular stack comes up rather often in recent version and it looks like an UAF.

Comment 1

[Timothy Nikkel (:tnikkel)]

We recently fixed a bug that looks just like this, bug 1568862. Perhaps it is a dupe?

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Agreed with tnikkel, this is most certainly a duplicate. First appeared in 20190724220024 and last appeared in 20190729095501. This maps to the introduced of the regression and the landing of the fix almost perfectly.