471968 - Crash [@ nsIconChannel::MakeInputStream] when saving a file

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect, P1)

Description

[timeless]

Mozilla Crash Reports
  
Signature	nsIconChannel::MakeInputStream(nsIInputStream**, int)
UUID	f22deabe-ab14-441e-9244-eedb92090102
Time	2009-01-02 08:54:34-08
Uptime	2063
Last Crash	2103 seconds before submission
Product	Firefox
Version	3.0.5
Build ID	2008120121
Branch	1.9
OS	Mac OS X
OS Version	10.5.6 9G55
CPU	x86
CPU Info	GenuineIntel family 6 model 14 stepping 8
Crash Reason	EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash Address	0x14028fa

0	XUL	nsIconChannel::MakeInputStream	mozilla/modules/libpr0n/decoders/icon/mac/nsIconChannelCocoa.mm:152
1	XUL	nsIconChannel::AsyncOpen	mozilla/modules/libpr0n/decoders/icon/mac/nsIconChannelCocoa.mm:218
2	XUL	imgLoader::LoadImage	mozilla/modules/libpr0n/src/imgLoader.cpp:512
3	XUL	nsContentUtils::LoadImage	mozilla/content/base/src/nsContentUtils.cpp:2329
4	XUL	nsImageBoxFrame::UpdateImage	mozilla/layout/xul/base/src/nsImageBoxFrame.cpp:272
5	XUL	nsImageBoxFrame::Init	mozilla/layout/xul/base/src/nsImageBoxFrame.cpp:238
6	XUL	nsCSSFrameConstructor::InitAndRestoreFrame	mozilla/layout/base/nsCSSFrameConstructor.cpp:6786

Comment 1

[Steven Michaud [:smichaud] (Retired)]

Though this crash is in Cocoa code, it's not a Cocoa widgets bug.

And there's no STR ... which doesn't make it terribly useful.

Comment 2

[Tony Chung [:tchung]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090225 Minefield/3.2a1pre

i crashed on this opening a pdf file today.  unfortunately, i dont have a repro yet.   Working on it.

App notes:
Obj-C Exception data:

NSInternalInconsistencyException: Error (1000) creating CGSWindow

Obj-C Exception data:

NSInternalInconsistencyException: Error (1000) creating CGSWindow

http://crash-stats.mozilla.com/report/index/dff20316-24cc-4415-8f53-7b67a2090225

Comment 3

[Tony Chung [:tchung]]

Found a consistent STR.

1) launch 1.9.1 branch or trunk nightly builds on OSX 10.5.6
2) create a new profile
3) close the Know your rights toolbar
4) visit http://www.irs.gov
5) in upper left corner, click "Form W-9"
6) when save dialog appears, click "save file" and OK
7) Verify crash @ nsIconChannel::MakeInputStream(nsIInputStream**, int)

A few stack traces:
3.1b3pre - http://crash-stats.mozilla.com/report/index/33ab3891-da4f-4736-a840-13fc82090225
3.2a1pre - http://crash-stats.mozilla.com/report/index/e448e64f-f14b-45a8-a4e0-99f3b2090225

Comment 4

[Steven Michaud [:smichaud] (Retired)]

I can't reproduce your STR (testing with an opt build with debug symbols that I made yesterday, from yesterday's mozilla-central code).

Could others try it?

Comment 5

[Marcia Knous [:marcia]]

Unable to reproduce with STR from Comment 3 using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090226 Minefield/3.2a1pre. I tried both saving the file and save as PDF.

Comment 6

[Tony Chung [:tchung]]

I noticed its not always happening on the first try.  If it's downloading the file just fine for you, try restarting the nightly again, and doing the same steps in comment 3.  (dont need to recreate a new profile though).   Eventually, it will crash.

This is not just a pdf file only, but really saving a file in general.   (I could repro this when trying to download a older nightly from ftp.m.o.  Working on a regression range.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Tony, if you can reproduce this, can you just poke at it with a debugger?  Finding out where the bad pointer is coming from (I'm assuming a non-null mListener given that line #) would be helpful, since this is basically indicating memory corruption earlier on.

A valgrind run would probably pinpoint this trivially.

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Tony, if you can reproduce it, can you do a valgrind run?  I haven't been able to reproduce it here either.

Comment 9

[Tony Chung [:tchung]]

(In reply to comment #8)
> Tony, if you can reproduce it, can you do a valgrind run?  I haven't been able
> to reproduce it here either.

Ugh.  Since my machine reboot on 3/4, i havent been able to hit this crash again.  I also dont have a valgrind environment setup right now, but will get to this if i can reproduce this again.

Comment 10

[Josh Aas]

This is difficult to reproduce and not a topcrash as far as I can tell. We should figure this out but I don't think we need to block.

Comment 11

[Tony Chung [:tchung]]

(In reply to comment #10)
> This is difficult to reproduce and not a topcrash as far as I can tell. We
> should figure this out but I don't think we need to block.

this is back and happening again for me on today's 1.9.1 nightly.  i can repro this easily using comment 3 str.   I have a dirty profile with extensions though.  working on narrowing this down.

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b5pre) Gecko/20090506 Shiretoko/3.5b5pre

Latest stack traces: http://crash-stats.mozilla.com/report/index/a2224f66-ac7a-4258-8d59-85ec02090506
http://crash-stats.mozilla.com/report/index/7ec13f09-8324-4bdc-a4c7-dade42090506
http://crash-stats.mozilla.com/report/index/a90793ee-3100-4dae-84e4-02f0f2090506

Comment 12

[Tony Chung [:tchung]]

I have not seen this crash in awhile now.  been using nightlies.  marking wfm.