Closed
Bug 457496
Opened 16 years ago
Closed 16 years ago
crash [@ imgRequest::NotifyProxyListener(imgRequestProxy*)]
Categories
(Core :: Graphics: ImageLib, defect)
Tracking
()
VERIFIED
FIXED
mozilla1.9.1b2
People
(Reporter: wsmwk, Unassigned)
References
Details
(Keywords: crash, topcrash, Whiteboard: [Fixed by bug 460767])
Crash Data
Attachments
(1 file)
218.69 KB,
image/png
|
Details |
Thunderbird 3.0b1pre 20080917030604 came back after 1hr away. clicked 3pane, started losing folder widgets (screen attached) crash [@ imgRequest::NotifyProxyListener(imgRequestProxy*)] xref bug 441563 - but stacks are different bp-bb30bd59-85ba-11dd-8606-001cc45a2ce4 0 thunderbird.exe imgRequest::NotifyProxyListener 1 thunderbird.exe imgRequestProxy::Clone 2 thunderbird.exe nsImageBoxFrame::UpdateImage 3 thunderbird.exe nsImageBoxFrame::DidSetStyleContext 4 thunderbird.exe nsIFrame::SetStyleContext 5 thunderbird.exe nsFrameManager::ReResolveStyleContext 6 thunderbird.exe nsFrameManager::ReResolveStyleContext 7 thunderbird.exe nsFrameManager::ReResolveStyleContext 8 thunderbird.exe nsFrameManager::ComputeStyleChangeFor 9 thunderbird.exe nsCSSFrameConstructor::RestyleElement 10 thunderbird.exe nsCSSFrameConstructor::ProcessOneRestyle 11 thunderbird.exe nsCSSFrameConstructor::ProcessPendingRestyles 12 thunderbird.exe PresShell::DoFlushPendingNotifications 13 thunderbird.exe PresShell::FlushPendingNotifications 14 thunderbird.exe nsCSSFrameConstructor::RestyleEvent::Run 15 xpcom_core.dll nsThread::ProcessNextEvent 16 xpcom_core.dll NS_ProcessNextEvent_P 17 thunderbird.exe nsBaseAppShell::Run 18 thunderbird.exe nsAppStartup::Run 19 thunderbird.exe XRE_main
Comment 1•16 years ago
|
||
Wayne, is it somehow reproducible?
Reporter | ||
Comment 2•16 years ago
|
||
No, and I have not seen it again. However, and I'm not sure it is relevant, for unrelated reasons I have turned off aero display. Have you seen other things like this?
I just got this today: http://crash-stats.mozilla.com/report/index/a886a0b9-4538-49af-84dc-038220081117 I was on http://www.gasbuddy.com/GB_Map_Gas_Prices.aspx scrolling around the map and it leaked memory and crashed after a few minutes
I'm low on memory. (this is another browser instance and the session restore gave me out of memory warnings, as did each tab) i hit this crash: FAULTING_IP: xul!imgRequest::NotifyProxyListener+fa 10092934 8b08 mov ecx,dword ptr [eax] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 10092934 (xul!imgRequest::NotifyProxyListener+0x000000fa) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000000 Attempt to read from address 00000000 FAULTING_THREAD: 00001ebc DEFAULT_BUCKET_ID: NULL_POINTER_READ PROCESS_NAME: firefox.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memo ry at "0x%08lx". The memory could not be "%s". READ_ADDRESS: 00000000 NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 PRIMARY_PROBLEM_CLASS: NULL_POINTER_READ BUGCHECK_STR: APPLICATION_FAULT_NULL_POINTER_READ LAST_CONTROL_TRANSFER: from 1007007e to 10092934 STACK_TEXT: 0012a484 .. xul!imgRequest::NotifyProxyListener+0xfa 0012a494 .. xul!imgRequestProxy::Clone+0x64 0012a5b4 .. xul!nsImageBoxFrame::UpdateImage+0xd7 0012a5c8 .. xul!nsImageBoxFrame::Init+0x96 0012a5f0 .. xul!nsCSSFrameConstructor::InitAndRestoreFrame+0x2c ... 0012bd88 .. xul!nsHTMLInputElement::SetValueInternal+0x65 0012c354 .. xul!nsJSContext::CallEventHandler+0x158 0012c76c .. xul!nsIDOMEventTarget_DispatchEvent+0x8e 0012d914 .. xul!nsJSContext::CallEventHandler+0x158 0012e05c .. xul!nsPromptService::Alert+0x31 0012e070 .. xul!nsPrompt::Alert+0x19 0012e1f0 .. xul!nsJSContext::DOMOperationCallback+0x17b 0012e1f8 .. js3250!js_ResetOperationCount+0x1b 0012f7dc .. xul!nsXPCWrappedJSClass::CallMethod +0x5de 0012f8f4 .. xul!nsEventListenerManager::HandleEventSubType+0x76 0012f908 .. xul!nsAutoPopupStatePusherInternal::nsAutoPopupStatePusherInternal+0x9 0012f954 .. xul!nsCycleCollectingAutoRefCnt::decr+0x112 0012fb84 .. xul!nsXMLHttpRequest::ChangeState+0x6b 0012fbbc .. xul!nsXMLHttpRequest::RequestCompleted+0x39 0012fbe0 .. xul!nsXMLHttpRequest::OnStopRequest+0xeb 0012fbf4 .. xul!nsCrossSiteListenerProxy::OnStopRequest+0x190 FOLLOWUP_IP: xul!imgRequest::NotifyProxyListener+fa 10092934 8b08 mov ecx,dword ptr [eax] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: xul!imgRequest::NotifyProxyListener+fa FOLLOWUP_NAME: MachineOwner MODULE_NAME: xul IMAGE_NAME: xul.dll DEBUG_FLR_IMAGE_TIMESTAMP: 49201a6a STACK_COMMAND: ~0s ; kb FAILURE_BUCKET_ID: NULL_POINTER_READ_c0000005_xul.dll!imgRequest::NotifyProxyLi stener BUCKET_ID: APPLICATION_FAULT_NULL_POINTER_READ_xul!imgRequest::NotifyProxyListe ner+fa There's an optimizer at work. this is stored in @edi: 0:000> dt @edi imgRequest mURI.mRawPtr xul!imgRequest +0x01c mURI : +0x000 mRawPtr : 0x02003cc0 nsISupports 0:000> dt 0x02003cc0 nsStandardURL mSpec.mData xul!nsStandardURL +0x014 mSpec : +0x000 mData : 0x02059568 "chrome://global/skin/icons/close.png" 0:000> dt 0x01d3f6a0 imgContainer mNumFrames xul!imgContainer +0x01c mNumFrames : 0 0:000> dt -v 0x01fc8400 nsVoidArray::Impl xul!nsVoidArray::Impl struct nsVoidArray::Impl, 3 elements, 0xc bytes +0x000 mBits : 0x80000008 +0x004 mCount : 0 +0x008 mArray : [1] 0x096e7a00 So yes, there are really 0 frames. however, i'm having an awful time trying to find a path where they actually get nulled.
Comment 7•16 years ago
|
||
Carrying over blocking request from bug 463926 - note that bug also has a patch which should be reviewed as it might fix this!
Flags: blocking1.9.1?
Where's the patch? I don't see one in the bug you linked (which is marked as resolved). This crash only happens when I run out of memory, but I don't know what causes it to leak memory in the first place except that website I linked in comment 3.
Comment 9•16 years ago
|
||
I think he meant to link to bug 460767, and attachment 343913 [details] [diff] [review]
This is pretty near the top of the topcrash list for Firefox 3.1b2pre (and all the crashes above it are fixed).
Keywords: topcrash
Reporter | ||
Comment 11•16 years ago
|
||
imgRequest::NotifyProxyListener is also now a topcrash thunderbird 3.01b1pre, eg. http://crash-stats.mozilla.com/report/index/02644f44-40ff-4f58-8f76-f1b6d2081121 If they are the same beast, it would be nice to get this for Thunderbird Beta 1. But stacks are not all the same. ... expected for OOM? FF http://crash-stats.mozilla.com/report/index/339a4d15-b239-4c40-a246-822fa2081121
Comment 12•16 years ago
|
||
as long as the line matches up and the crash address is 0x0.
Comment 13•16 years ago
|
||
attachment 343913 [details] [diff] [review] has been reviewed and can land Monday when the the tree opens
Comment 14•16 years ago
|
||
Since attachment 343913 [details] [diff] [review] has landed on trunk the crashes are gone. Here the latest days with crashes: Firefox 3.1b2pre: 2008112400 13 Firefox 3.1b2: none Looks like we can safely close this bug as fixed by bug 460767.
Flags: blocking1.9.1?
Whiteboard: [Fixed by bug 460767]
Target Milestone: --- → mozilla1.9.1b2
Updated•16 years ago
|
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 15•16 years ago
|
||
looking forward to this getting into thunderbird beta 1. gone also from thunderbird crashstats starting with 20081125 build
Comment 16•16 years ago
|
||
Thanks Wayne. Looks like we can mark it verified.
Status: RESOLVED → VERIFIED
Assignee | ||
Updated•13 years ago
|
Crash Signature: [@ imgRequest::NotifyProxyListener(imgRequestProxy*)]
You need to log in
before you can comment on or make changes to this bug.
Description
•