1735484 - Crash in [@ nsRefreshDriver::RemoveImageRequest]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/cdbdae7c-3abe-4b43-8971-0b7ae0211013

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll nsRefreshDriver::RemoveImageRequest layout/base/nsRefreshDriver.cpp:1397
1 xul.dll static nsLayoutUtils::DeregisterImageRequest layout/base/nsLayoutUtils.cpp:7774
2 xul.dll nsImageLoadingContent::FrameDestroyed dom/base/nsImageLoadingContent.cpp:855
3 xul.dll nsImageFrame::DestroyFrom layout/generic/nsImageFrame.cpp:385
4 xul.dll nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:469
5 xul.dll nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:469
6 xul.dll nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:469
7 xul.dll nsContainerFrame::DestroyFrom layout/generic/nsContainerFrame.cpp:227
8 xul.dll nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:469
9 xul.dll mozilla::DetailsFrame::DestroyFrom layout/generic/DetailsFrame.cpp:81

Found this during nightly crash triage. Low volume but increasing over time. This is a NULL pointer access to something when setting the profiler marker. Given there's multiple accesses in the expression it's hard to tell which one is NULL. NI?ing myself to crack open a minidump and figure out what's going on.

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Seems like Florian added these markers in bug 1723181. aPresContext likely needs a null-check here.

Comment 2

[Gabriele Svelto [:gsvelto]]

Cracked open a minidump and indeed this->mPresContext is null.

Comment 3

[Release mgmt bot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1723181

Comment 4

[Florian Quèze [:florian]]

Attachment: Bug 1735484 - avoid crashing in nsRefreshDriver::RemoveImageRequest when mPresContext is null, r=emilio.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e463a4894dbb
avoid crashing in nsRefreshDriver::RemoveImageRequest when mPresContext is null, r=emilio.

Comment 6

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/e463a4894dbb