1953294 - Assertion failure: mOnStopStatus.isNothing(), at /builds/worker/checkouts/gecko/uriloader/preload/PreloaderBase.cpp:252

Status: NEW

(Core :: Graphics: ImageLib, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20250308-871252f625a6 (--enable-debug --enable-fuzzing)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting http://web.archive.org/web/20250107094709/https://cohost.org/dcoles/post/2151489-multipart-x-mixed-re.

Assertion failure: mOnStopStatus.isNothing(), at /builds/worker/checkouts/gecko/uriloader/preload/PreloaderBase.cpp:252

#0 0x7ffe958b28e0 in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:55
#1 0x7ffe958b28e0 in mozilla::PreloaderBase::NotifyStop(enum nsresult) /builds/worker/checkouts/gecko/uriloader/preload/PreloaderBase.cpp:252
#2 0x7ffe974f9fee in imgRequestProxy::OnLoadComplete(bool) /builds/worker/checkouts/gecko/image/imgRequestProxy.cpp:1032
#3 0x7ffe974bc7e8 in mozilla::image::SyncNotifyInternal<const mozilla::image::ObserverTable *>::<lambda_7>::operator() /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:354
#4 0x7ffe974bc7e8 in mozilla::image::ImageObserverNotifier<class mozilla::image::ObserverTable const *>::operator()<class `void __cdecl mozilla::image::SyncNotifyInternal<class mozilla::image::ObserverTable const *>(class mozilla::image::ObserverTable const *const &, bool, unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &)'::`1'::<lambda_7>>(class `void __cdecl mozilla::image::SyncNotifyInternal<class mozilla::image::ObserverTable const *>(class mozilla::image::ObserverTable const *const &, bool, unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &)'::`1'::<lambda_7>) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:284
#5 0x7ffe974badce in mozilla::image::SyncNotifyInternal<class mozilla::image::ObserverTable const *>(class mozilla::image::ObserverTable const *const &, bool, unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:353
#6 0x7ffe9745c125 in mozilla::image::ProgressTracker::SyncNotifyProgress::<lambda_2>::operator() /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:372
#7 0x7ffe9745c125 in mozilla::image::CopyOnWrite<mozilla::image::ObserverTable>::Read /builds/worker/checkouts/gecko/image/CopyOnWrite.h:155
#8 0x7ffe9745c125 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:371
#9 0x7ffe9745bd0b in mozilla::image::MultipartImage::FinishTransition(void) /builds/worker/checkouts/gecko/image/MultipartImage.cpp:263
#10 0x7ffe97498c26 in mozilla::image::NextPartObserver::FinishObserving /builds/worker/checkouts/gecko/image/MultipartImage.cpp:169
#11 0x7ffe97498c26 in mozilla::image::NextPartObserver::Notify(int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const *) /builds/worker/checkouts/gecko/image/MultipartImage.cpp:116
#12 0x7ffe974bb8ac in mozilla::image::SyncNotifyInternal<const mozilla::image::ObserverTable *>::<lambda_3>::operator() /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:334
#13 0x7ffe974bb8ac in mozilla::image::ImageObserverNotifier<class mozilla::image::ObserverTable const *>::operator()<class `void __cdecl mozilla::image::SyncNotifyInternal<class mozilla::image::ObserverTable const *>(class mozilla::image::ObserverTable const *const &, bool, unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &)'::`1'::<lambda_3>>(class `void __cdecl mozilla::image::SyncNotifyInternal<class mozilla::image::ObserverTable const *>(class mozilla::image::ObserverTable const *const &, bool, unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &)'::`1'::<lambda_3>) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:284
#14 0x7ffe974badef in mozilla::image::SyncNotifyInternal<class mozilla::image::ObserverTable const *>(class mozilla::image::ObserverTable const *const &, bool, unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:334
#15 0x7ffe9745c125 in mozilla::image::ProgressTracker::SyncNotifyProgress::<lambda_2>::operator() /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:372
#16 0x7ffe9745c125 in mozilla::image::CopyOnWrite<mozilla::image::ObserverTable>::Read /builds/worker/checkouts/gecko/image/CopyOnWrite.h:155
#17 0x7ffe9745c125 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:371
#18 0x7ffe97495af0 in mozilla::image::VectorImage::OnSVGDocumentLoaded(void) /builds/worker/checkouts/gecko/image/VectorImage.cpp:1501
#19 0x7ffe974ab3ce in mozilla::image::SVGLoadEventListener::HandleEvent(class mozilla::dom::Event *) /builds/worker/checkouts/gecko/image/VectorImage.cpp:212
#20 0x7ffe9a871c83 in mozilla::EventListenerManager::HandleEventSingleListener(struct mozilla::EventListenerManager::Listener *, class nsAtom *, class mozilla::WidgetEvent *, class mozilla::dom::Event *, class mozilla::dom::EventTarget *, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1361
#21 0x7ffe9a87438f in mozilla::EventListenerManager::HandleEventWithListenerArray(struct mozilla::EventListenerManager::ListenerArray *, class nsAtom *, enum mozilla::EventMessage, class nsPresContext *, class mozilla::WidgetEvent *, class mozilla::dom::Event **, class mozilla::dom::EventTarget *, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1679
#22 0x7ffe9a872f1d in mozilla::EventListenerManager::HandleEventInternal(class nsPresContext *, class mozilla::WidgetEvent *, class mozilla::dom::Event **, class mozilla::dom::EventTarget *, enum nsEventStatus *, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1576
#23 0x7ffe9a85a7eb in mozilla::EventListenerManager::HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:466
#24 0x7ffe9a85a7eb in mozilla::EventTargetChainItem::HandleEvent(class mozilla::EventChainPostVisitor &, class mozilla::ELMCreationDetector &) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:365
#25 0x7ffe9a858c81 in mozilla::EventTargetChainItem::HandleEventTargetChain(class nsTArray<class mozilla::EventTargetChainItem> &, class mozilla::EventChainPostVisitor &, class mozilla::EventDispatchingCallback *, class mozilla::ELMCreationDetector &) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:599
#26 0x7ffe9a85e9e4 in mozilla::EventDispatcher::Dispatch(class mozilla::dom::EventTarget *, class nsPresContext *, class mozilla::WidgetEvent *, class mozilla::dom::Event *, enum nsEventStatus *, class mozilla::EventDispatchingCallback *, class nsTArray<class mozilla::dom::EventTarget *> *) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1221
#27 0x7ffe9a8667e9 in mozilla::EventDispatcher::DispatchDOMEvent(class mozilla::dom::EventTarget *, class mozilla::WidgetEvent *, class mozilla::dom::Event *, class nsPresContext *, enum nsEventStatus *) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1363
#28 0x7ffe97db4045 in nsINode::DispatchEvent(class mozilla::dom::Event &, enum mozilla::dom::CallerType, class mozilla::ErrorResult &) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1495
#29 0x7ffe9a8828eb in mozilla::dom::EventTarget::DispatchEvent(class mozilla::dom::Event &) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:214
#30 0x7ffe9a7c67db in mozilla::AsyncEventDispatcher::DispatchEventOnTarget /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:89
#31 0x7ffe9a7c67db in mozilla::AsyncEventDispatcher::DispatchEventOnTarget(class mozilla::dom::EventTarget *, class nsTSubstring<char16_t> const &, enum mozilla::CanBubble, enum mozilla::ChromeOnlyDispatch, enum mozilla::Composed) /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:75
#32 0x7ffe9a7c6201 in mozilla::AsyncEventDispatcher::Run(void) /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:62
#33 0x7ffe93d99ffe in mozilla::RunnableTask::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703
#34 0x7ffe93d78fc9 in mozilla::TaskController::RunTask(class mozilla::Task *) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:196
#35 0x7ffe93d83c13 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1250
#36 0x7ffe93d7fdea in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1073
#37 0x7ffe93da4e8a in mozilla::TaskController::ProcessPendingMTTask /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639
#38 0x7ffe93da4e8a in mozilla::TaskController::TaskController::<lambda_5>::operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333
#39 0x7ffe93da4e8a in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:7'>::Run /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548
#40 0x7ffe93dcb7bd in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159
#41 0x7ffe93dda710 in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480
#42 0x7ffe95349064 in mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85
#43 0x7ffe95262b93 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369
#44 0x7ffe95262b93 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362
#45 0x7ffe952629a3 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344
#46 0x7ffe9e56058c in nsBaseAppShell::Run(void) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148
#47 0x7ffe9e7744e5 in nsAppShell::Run(void) /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:688
#48 0x7ffea0797e28 in XRE_RunAppShell(void) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:646
#49 0x7ffe95262b93 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369
#50 0x7ffe95262b93 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362
#51 0x7ffe952629a3 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344
#52 0x7ffea07961c8 in XRE_InitChildProcess(int, char **const, struct XREChildData const *) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:584
#53 0x7ff6602e2a4c in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397
#54 0x7ff6602e1436 in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:151
#55 0x7ff6603bb887 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/Vv9N1XRQJYsD_Gw_i4cfWA/index.html

Comment 2

[Mayank Bansal]

I get a crash on the page with latest Nightlly: https://crash-stats.mozilla.org/report/index/fd0e3f26-444e-46e9-8177-a224e0250312
Bug 1808676 has the same crash signature. ni? :tnikkel .

Comment 3

[Mayank Bansal]

This is probably a dupe of bug 1944122