1694011 - Crash in [@ nsTreeImageListener::Invalidate] use after free

Status: RESOLVED INCOMPLETE

(Thunderbird :: General, defect)

Description

[Wayne Mery (:wsmwk)]

No version 68 crashes. regression?

Crash report: https://crash-stats.mozilla.org/report/index/2b599ed3-f943-4011-a71d-9fff90210220

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll nsTreeImageListener::Invalidate layout/xul/tree/nsTreeImageListener.cpp:85
1 xul.dll nsTreeImageListener::Notify layout/xul/tree/nsTreeImageListener.cpp:51
2 xul.dll imgRequestProxy::Notify image/imgRequestProxy.cpp:1008
3 xul.dll mozilla::image::ImageObserverNotifier<const mozilla::image::ObserverTable*>::operator image/ProgressTracker.cpp:281
4 xul.dll mozilla::image::SyncNotifyInternal<const mozilla::image::ObserverTable*> image/ProgressTracker.cpp:325
5 xul.dll mozilla::image::ProgressTracker::SyncNotifyProgress image/ProgressTracker.cpp:368
6 xul.dll mozilla::image::VectorImage::OnSVGDocumentLoaded image/VectorImage.cpp:1443
7 xul.dll mozilla::image::SVGLoadEventListener::HandleEvent image/VectorImage.cpp:212
8 xul.dll mozilla::EventListenerManager::HandleEventSubType dom/events/EventListenerManager.cpp:1087
9 xul.dll mozilla::EventListenerManager::HandleEventInternal dom/events/EventListenerManager.cpp:1279

bp-b9434a20-3d41-4054-8212-db42e0210220
bp-3ac96054-cdf0-4d34-8609-106e40210219

Comment 1

[Magnus Melin [:mkmelin]]

Don't know why this would be crashing. https://searchfox.org/mozilla-central/rev/7bb1cc6abf6634b2a20f71935e1e519e73402b63/layout/xul/tree/nsTreeImageListener.cpp#85
But I don't know either why the tree is got for every iteration in the loop. Maybe it's just an insane amount of loops? (wild guess)

Comment 2

[Wayne Mery (:wsmwk)]

Earliest crash on crash-stats is build 20200729211652 bp-c1235f29-5b6c-4a07-912e-fcf080201205. 78.1.0

Comment 3

[Wayne Mery (:wsmwk)]

much rarer for version 91. to the point of not worth keeping.
bp-f5e07898-92b2-4e0e-a7e9-5c34d0211029 91.2.1