414854 - Firefox crashs on http://www.tvblogger.de/ [@ row_callback]

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P1)

Description

[Robert [minotaur 11]]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; de; rv:1.8.1.10) Gecko/20071115 Iceweasel/2.0.0.10 (Debian-2.0.0.10-0etch1)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b3pre) Gecko/2008013007 Minefield/3.0b3pre

Firefox crashs while loading http://www.tvblogger.de/

Reproducible: Always

Steps to Reproduce:
1. Load http://www.tvblogger.de/




Regression range:
20080129_2220_firefox-3.0b3pre.en-US.linux-i686.tar.bz2 works
20080129_2232_firefox-3.0b3pre.en-US.linux-i686.tar.bz2 crashs

http://hourly-archive.localgho.st/linux/20080129_2232_checkins.html


The crash doesn't always trigger Breakpad.

Crash reports:
Debian Etch:
http://crash-stats.mozilla.com/report/index/0ab4dda1-cf0e-11dc-8f66-001a4bd43ef6
http://crash-stats.mozilla.com/report/index/a094225c-cf47-11dc-8492-001a4bd43ed6

Windows XP:
http://crash-stats.mozilla.com/report/index/bf9aaa61-cf1f-11dc-9b13-001a4bd43ed6

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

Attachment: Like so?

The first loop may take three iterations to become aligned; if the
width is less than that we will do "idx--" when idx is zero.

Comment 3

[Mats Palmgren (inactive)]

Attachment: Like so?

Fixing typo

Comment 4

[Mats Palmgren (inactive)]

Attachment: Testcase (crashes on load)

Comment 5

[jag (Peter Annema)]

Comment on attachment 300388 [details] [diff] [review]
Like so?

Doh! Good find.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 300388 [details] [diff] [review]
Like so?

a=beltzner for beta 3

Comment 9

[Mike Beltzner [:beltzner, not reading bugmail]]

I'd like to get this in for tomorrow's nightlies, so if someone can land and shepherd it, that'd be great.

Comment 10

[Mats Palmgren (inactive)]

mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp 	1.98
mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp 	1.91
mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp 	1.79 

-> FIXED

Comment 11

[Mats Palmgren (inactive)]

I'm not sure where to land the crashtest, we only have:
   modules/libpr0n/test/reftest/
   modules/libpr0n/test/unit/

should I start a new directory for it?
   modules/libpr0n/test/crashtests/
or perhaps
   modules/libpr0n/crashtests/

Comment 13

[Jeff Walden [:Waldo]]

(In reply to comment #11)
> I'm not sure where to land the crashtest, we only have:
>    modules/libpr0n/test/reftest/
>    modules/libpr0n/test/unit/
> 
> should I start a new directory for it?
>    modules/libpr0n/test/crashtests/

I'd say this one, for greatest consistency.

Comment 14

[juan becerra [:juanb]]

Verified on Fxb3rc2:  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3

This does not crash on testcase.

Comment 15

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3 ID:2008020514, no crash on testcase

-> Verified fixed