236268 - imgRequest::OnStopDecode assertion: nsVoidArray::ElementAt(index past end array)

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect, P5)

Description

[timeless]

Encountered by another engineer here, cvs tree is from just before 1.7a. I
thought there was a report about this somewhere but I couldn't find it. We
believe the site is yahoo.com (root page), although it doesn't happen every time
(it happened say 3 in 5 visits to a sequence of 5 pages, so it theoretically
could have been one of the other 4 sites, but we're pretty sure it was yahoo).

#1  0x4085356f in nsDebugImpl::Assertion(char const*, char const*, char const*, 
int) (this=0x813b670, 
    aStr=0x41ec7fc0 "nsVoidArray::ElementAt(index past end array) - note on bug 
96108", aExpr=0x41ec7f9b "aIndex < Count()", 
    aFile=0x41ec7f20 "../../../dist/include/xpcom/nsVoidArray.h", aLine=72)
    at nsDebugImpl.cpp:271
#2  0x0808b3cf in nsDebug::Assertion(char const*, char const*, char const*, int)  (
    aStr=0x41ec7fc0 "nsVoidArray::ElementAt(index past end array) - note on bug 
96108", aExpr=0x41ec7f9b "aIndex < Count()", 
    aFile=0x41ec7f20 "../../../dist/include/xpcom/nsVoidArray.h", aLine=72)
    at nsDebug.cpp:108
#3  0x41e9a507 in nsVoidArray::ElementAt(int) const (this=0x8c84984, aIndex=1)
    at nsVoidArray.h:72
#4  0x41e9a2c5 in nsVoidArray::operator[](int) const (this=0x8c84984, aIndex=1)
    at nsVoidArray.h:93
#5  0x41e9801d in imgRequest::OnStopDecode(imgIRequest*, unsigned, unsigned shor
t const*) (this=0x8c84958, aRequest=0x0, aStatus=0, aStatusArg=0x0)
    at imgRequest.cpp:527
#6  0x41ea04e8 in nsGIFDecoder2::EndGIF(void*, int) (aClientData=0x88eb698, 
    aAnimationLoopCount=0) at nsGIFDecoder2.cpp:269
#7  0x41e9f2c3 in gif_write(gif_struct*, unsigned char const*, unsigned) (    
gs=0x8f0e328, buf=0x82d3714 "GIF89a\001", len=43) at GIF2.cpp:986 #8  0x41ea0254
in nsGIFDecoder2::ProcessData(unsigned char*, unsigned, unsigned*
) (this=0x88eb698, data=0x82d3714 "GIF89a\001", count=43, _retval=0xbfffd944)
    at nsGIFDecoder2.cpp:197
#9  0x41e9ffac in ReadDataOut (in=0x8f3cdc4, closure=0x88eb698, 
    fromRawSegment=0x82d3714 "GIF89a\001", toOffset=0, count=43, 
    writeCount=0xbfffd944) at nsGIFDecoder2.cpp:139
#10 0x40810a57 in nsInputStreamTee::WriteSegmentFun(nsIInputStream*, void*, char
 const*, unsigned, unsigned, unsigned*) (in=0x8f3cdc4, closure=0x8e3f670, 
    fromSegment=0x82d3714 "GIF89a\001", offset=0, count=43, 
    writeCount=0xbfffd944) at nsInputStreamTee.cpp:102
#11 0x408161d5 in nsPipeInputStream::ReadSegments(unsigned (*)(nsIInputStream*, 
void*, char const*, unsigned, unsigned, unsigned*), void*, unsigned, unsigned*)
    (this=0x8f3cdc4, 
    writer=0x40810a1e <nsInputStreamTee::WriteSegmentFun(nsIInputStream*, void*,
 char const*, unsigned, unsigned, unsigned*)>, closure=0x8e3f670, count=43, 
    readCount=0xbfffda0c) at nsPipe3.cpp:761

The code of interest is probably:
525   PRInt32 count = mObservers.Count();
526   for (PRInt32 i = 0; i < count; i++) {
527     imgRequestProxy *proxy = NS_STATIC_CAST(imgRequestProxy*, mObservers[i]);
528     if (proxy) proxy->OnStopDecode(GetResultFromImageStatus(mImageStatus),
aStatusArg);
529 
530     // If this assertion fires, it means that imgRequest notifications could
531     // be dropped!
532     NS_ASSERTION(count == mObservers.Count(), 
533                  "The observer list changed while being iterated over!");
534   }