1944122 - multipart/x-mixed-replace image crashes tab at PreloaderBase::NotifyStop

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[наб]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0

Steps to reproduce:

Go to https://web.archive.org/web/20250107094709/https://cohost.org/dcoles/post/2151489-multipart-x-mixed-re

Actual results:

Loads for a bit, then "Gah. Your tab just crashed.". Crash submitted @
https://crash-stats.mozilla.org/report/index/70a4543a-aaa5-4cc4-b450-584c70250127
https://crash-stats.mozilla.org/report/index/2649d211-a033-4a6e-a9cf-95e8d0250127
https://crash-stats.mozilla.org/report/index/47156629-e022-4a23-b50e-caa960250127
https://crash-stats.mozilla.org/report/index/a0f58c8f-1aed-4e40-afe5-cbd500250127

The context appears consistent between them all.

I repro this on 128.6.0esr (64-bit), 87.0b9 (64-bit), Android 129.0, and others.

On Android:
https://crash-stats.mozilla.org/report/index/bp-ff2e5bd9-dd5c-4bb5-9ae6-fdf920250127
https://crash-stats.mozilla.org/report/index/bp-24cbff45-23f3-408d-89a8-3e65e0250127
this is also the same.

Expected results:

Page loads, and animates. This is the case on Chromium (well, "Browser" on my phone).

Comment 1

[Alice0775 White]

Crash on Windows11 : bp-74395af9-1391-4787-ba01-8c9ae0250127

Comment 2

[Alice0775 White]

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=515f4054b1ccaa49b1f25f70f4e3a6f610184690&tochange=944ce5e286edeeedf0b54e0b50d4cc48ff63f12f

Tentatively, mark bug 1618295 as “Regressed by”.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

:edgar, since you are the author of the regressor, bug 1618295, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Timothy Nikkel (:tnikkel)]

Probably this is more of an imagelib problem and will fall in my court.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1618295

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1944122 - Don't trigger fake load complete notification from RemoveObserver(). r=tnikkel

RemoveObserver will usually fake the image has loaded. For a multipart
image it might trigger a last part notification incorrectly.

Not sure how to best construct a test-case for this, help there would be
appreciated.

Comment 7

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1944122. Make sure the first (vector) part of a multipart images gets load complete. r?emilio

In bug 1862059 we ensured that every (vector) part of a multipart image got load complete before it was made the current part. This missed the first part because it was never the next part, it just become the current part immediately. This was good enough to fix all cases except where the multipart image reached a finite end point (which would then send the final part load complete and hit the same duplicate final part load complete bug).

Comment 8

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

(Looks like Emilio's actively working on this, so I am clearing the pending needinfo which doesn't look needed, in order to remove this from the bugbot reminder email.)

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c8627e99f5fc
Make sure the first (vector) part of a multipart images gets load complete. r=emilio

Comment 10

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/c8627e99f5fc

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:tnikkel, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox138 to wontfix.

For more information, please visit BugBot documentation.

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.