457496 - crash [@ imgRequest::NotifyProxyListener(imgRequestProxy*)]

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Wayne Mery (:wsmwk)]

Attachment: missing widgets in thunderbird folder pane

Thunderbird 3.0b1pre 20080917030604
came back after 1hr away. clicked 3pane, started losing folder widgets (screen attached)
crash [@ imgRequest::NotifyProxyListener(imgRequestProxy*)]

xref bug 441563 - but stacks are different

bp-bb30bd59-85ba-11dd-8606-001cc45a2ce4
0	thunderbird.exe	imgRequest::NotifyProxyListener
1	thunderbird.exe	imgRequestProxy::Clone
2	thunderbird.exe	nsImageBoxFrame::UpdateImage
3	thunderbird.exe	nsImageBoxFrame::DidSetStyleContext
4	thunderbird.exe	nsIFrame::SetStyleContext
5	thunderbird.exe	nsFrameManager::ReResolveStyleContext
6	thunderbird.exe	nsFrameManager::ReResolveStyleContext
7	thunderbird.exe	nsFrameManager::ReResolveStyleContext
8	thunderbird.exe	nsFrameManager::ComputeStyleChangeFor
9	thunderbird.exe	nsCSSFrameConstructor::RestyleElement
10	thunderbird.exe	nsCSSFrameConstructor::ProcessOneRestyle
11	thunderbird.exe	nsCSSFrameConstructor::ProcessPendingRestyles
12	thunderbird.exe	PresShell::DoFlushPendingNotifications
13	thunderbird.exe	PresShell::FlushPendingNotifications
14	thunderbird.exe	nsCSSFrameConstructor::RestyleEvent::Run
15	xpcom_core.dll	nsThread::ProcessNextEvent
16	xpcom_core.dll	NS_ProcessNextEvent_P
17	thunderbird.exe	nsBaseAppShell::Run
18	thunderbird.exe	nsAppStartup::Run
19	thunderbird.exe	XRE_main

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Wayne, is it somehow reproducible?

Comment 2

[Wayne Mery (:wsmwk)]

No, and I have not seen it again. However, and I'm not sure it is relevant, for unrelated reasons I have turned off aero display.

Have you seen other things like this?

Comment 3

[John]

I just got this today: http://crash-stats.mozilla.com/report/index/a886a0b9-4538-49af-84dc-038220081117

I was on http://www.gasbuddy.com/GB_Map_Gas_Prices.aspx scrolling around the map and it leaked memory and crashed after a few minutes

Comment 5

[timeless]

I'm low on memory. (this is another browser instance and the session restore gave me out of memory warnings, as did each tab)

i hit this crash:
FAULTING_IP:
xul!imgRequest::NotifyProxyListener+fa
10092934 8b08            mov     ecx,dword ptr [eax]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 10092934 (xul!imgRequest::NotifyProxyListener+0x000000fa)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000000
Attempt to read from address 00000000

FAULTING_THREAD:  00001ebc

DEFAULT_BUCKET_ID:  NULL_POINTER_READ

PROCESS_NAME:  firefox.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memo
ry at "0x%08lx". The memory could not be "%s".

READ_ADDRESS:  00000000

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ

BUGCHECK_STR:  APPLICATION_FAULT_NULL_POINTER_READ

LAST_CONTROL_TRANSFER:  from 1007007e to 10092934

STACK_TEXT:
0012a484 .. xul!imgRequest::NotifyProxyListener+0xfa
0012a494 .. xul!imgRequestProxy::Clone+0x64
0012a5b4 .. xul!nsImageBoxFrame::UpdateImage+0xd7
0012a5c8 .. xul!nsImageBoxFrame::Init+0x96
0012a5f0 .. xul!nsCSSFrameConstructor::InitAndRestoreFrame+0x2c
...
0012bd88 .. xul!nsHTMLInputElement::SetValueInternal+0x65
0012c354 .. xul!nsJSContext::CallEventHandler+0x158
0012c76c .. xul!nsIDOMEventTarget_DispatchEvent+0x8e
0012d914 .. xul!nsJSContext::CallEventHandler+0x158
0012e05c .. xul!nsPromptService::Alert+0x31
0012e070 .. xul!nsPrompt::Alert+0x19
0012e1f0 .. xul!nsJSContext::DOMOperationCallback+0x17b
0012e1f8 .. js3250!js_ResetOperationCount+0x1b
0012f7dc .. xul!nsXPCWrappedJSClass::CallMethod
+0x5de
0012f8f4 .. xul!nsEventListenerManager::HandleEventSubType+0x76
0012f908 .. xul!nsAutoPopupStatePusherInternal::nsAutoPopupStatePusherInternal+0x9
0012f954 .. xul!nsCycleCollectingAutoRefCnt::decr+0x112
0012fb84 .. xul!nsXMLHttpRequest::ChangeState+0x6b
0012fbbc .. xul!nsXMLHttpRequest::RequestCompleted+0x39
0012fbe0 .. xul!nsXMLHttpRequest::OnStopRequest+0xeb
0012fbf4 .. xul!nsCrossSiteListenerProxy::OnStopRequest+0x190

FOLLOWUP_IP:
xul!imgRequest::NotifyProxyListener+fa
10092934 8b08            mov     ecx,dword ptr [eax]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  xul!imgRequest::NotifyProxyListener+fa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: xul

IMAGE_NAME:  xul.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  49201a6a

STACK_COMMAND:  ~0s ; kb

FAILURE_BUCKET_ID:  NULL_POINTER_READ_c0000005_xul.dll!imgRequest::NotifyProxyLi
stener

BUCKET_ID:  APPLICATION_FAULT_NULL_POINTER_READ_xul!imgRequest::NotifyProxyListe
ner+fa

There's an optimizer at work. this is stored in @edi:

0:000> dt @edi imgRequest mURI.mRawPtr
xul!imgRequest
   +0x01c mURI         : 
      +0x000 mRawPtr      : 0x02003cc0 nsISupports
0:000> dt 0x02003cc0 nsStandardURL mSpec.mData
xul!nsStandardURL
   +0x014 mSpec       : 
      +0x000 mData       : 0x02059568  "chrome://global/skin/icons/close.png"
0:000> dt 0x01d3f6a0 imgContainer mNumFrames
xul!imgContainer
   +0x01c mNumFrames : 0
0:000> dt -v 0x01fc8400 nsVoidArray::Impl
xul!nsVoidArray::Impl
struct nsVoidArray::Impl, 3 elements, 0xc bytes
   +0x000 mBits            : 0x80000008
   +0x004 mCount           : 0
   +0x008 mArray           : [1] 0x096e7a00 

So yes, there are really 0 frames.

however, i'm having an awful time trying to find a path where they actually get nulled.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Carrying over blocking request from bug 463926 - note that bug also has a patch which should be reviewed as it might fix this!

Comment 8

[John]

Where's the patch? I don't see one in the bug you linked (which is marked as resolved).  This crash only happens when I run out of memory, but I don't know what causes it to leak memory in the first place except that website I linked in comment 3.

Comment 9

[Brad Lassey [:blassey] (use needinfo?)]

I think he meant to link to bug 460767, and attachment 343913 [details] [diff] [review]

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This is pretty near the top of the topcrash list for Firefox 3.1b2pre (and all the crashes above it are fixed).

Comment 11

[Wayne Mery (:wsmwk)]

imgRequest::NotifyProxyListener is also now a topcrash thunderbird 3.01b1pre, eg.  http://crash-stats.mozilla.com/report/index/02644f44-40ff-4f58-8f76-f1b6d2081121 

If they are the same beast, it would be nice to get this for Thunderbird Beta 1.


But stacks are not all the same. ... expected for OOM?
FF http://crash-stats.mozilla.com/report/index/339a4d15-b239-4c40-a246-822fa2081121

Comment 12

[timeless]

as long as the line matches up and the crash address is 0x0.

Comment 13

[Brad Lassey [:blassey] (use needinfo?)]

attachment 343913 [details] [diff] [review] has been reviewed and can land Monday when the the tree opens

Comment 14

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Since attachment 343913 [details] [diff] [review] has landed on trunk the crashes are gone. Here the latest days with crashes:

Firefox 3.1b2pre: 2008112400 13
Firefox 3.1b2:    none

Looks like we can safely close this bug as fixed by bug 460767.

Comment 15

[Wayne Mery (:wsmwk)]

looking forward to this getting into thunderbird beta 1.
gone also from thunderbird crashstats starting with 20081125 build

Comment 16

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Thanks Wayne. Looks like we can mark it verified.