513544 - Crash [@ nsImageFrame::DisplayAltFeedback(nsIRenderingContext&, nsRect const&, imgIRequest*, nsPoint)]

Status: VERIFIED FIXED

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Oleg Romashin (:romaxa)]

If nsImageFrame::LoadIcons fails to load (missing resource://gre/res/broken-image.png or just lowmem), then it crashes with next stack.

#0  nsImageFrame::DisplayAltFeedback (this=0x89c28c, aRenderingContext=@0x80ffa8, aDirtyRect=@0xbecf0840, aRequest=0x0, aPt=@0xbecf04e8)
    at microb-engine-20090829-1.9.2-31493/layout/generic/nsImageFrame.cpp:1044
#1  0x40c70a08 in PaintAltFeedback (aFrame=0x89c28c, aCtx=0x80ffa8, aDirtyRect=@0xbecf0840, aPt=@0xbecf0510)
    at microb-engine-20090829-1.9.2-31493/layout/generic/nsImageFrame.cpp:1103
#2  0x40c4c7b8 in nsDisplayGeneric::Paint (this=<value optimized out>, aBuilder=<value optimized out>, aCtx=0x80ffa8, aDirtyRect=@0xbecf0840)
    at microb-engine-20090829-1.9.2-31493/layout/xul/base/src/tree/src/../../../../../base/nsDisplayList.h:941
#3  0x40c0a25c in nsDisplayList::Paint (this=<value optimized out>, aBuilder=0xbecf0580, aCtx=0x80ffa8, aDirtyRect=@0xbecf0840)
    at microb-engine-20090829-1.9.2-31493/layout/base/nsDisplayList.cpp:382
#4  0x40c2dcdc in PresShell::RenderDocument (this=0x5e9a10, aRect=@0xbecf08f0, aFlags=6, aBackgroundColor=4294967295, aThebesContext=0x812270)
    at microb-engine-20090829-1.9.2-31493/layout/base/nsPresShell.cpp:5494
#5  0x40886378 in MicrobEalXshmRenderer::DrawRectToXshm (aWindow=<value optimized out>, aRect=<value optimized out>, aData=@0x47c290, aReqestId=-1, 
    aZoomValue=
#6  0x40889588 in MicrobEalXshmRenderer::HandleEvent (this=0x47c280, aEvent=<value optimized out>)
    at ../../../src/gecko/MicrobEalXshmRenderer.cpp:1087
#7  0x40e1ffb4 in nsEventListenerManager::HandleEventSubType (this=0x3433f8, aListenerStruct=0xa23c8, aListener=0x47c280, aDOMEvent=0x80febc, 
    aCurrentTarget=0x5e957c, aPhaseFlags=2)
    at microb-engine-20090829-1.9.2-31493/content/events/src/nsEventListenerManager.cpp:1034
#8  0x40e205f0 in nsEventListenerManager::HandleEvent (this=0x3433f8, aPresContext=0x35fa68, aEvent=0x80ff48, aDOMEvent=0xbecf1118, 
    aCurrentTarget=0x5e957c, aFlags=2, aEventStatus=0xbecf111c)
    at microb-engine-20090829-1.9.2-31493/content/events/src/nsEventListenerManager.cpp:1140
#9  0x40e3a040 in nsEventTargetChainItem::HandleEvent (this=0x37c028, aVisitor=@0xbecf1110, aFlags=2, 
    aMayHaveNewListenerManagers=<value optimized out>)
    at microb-engine-20090829-1.9.2-31493/content/events/src/nsEventDispatcher.cpp:244
#10 0x40e3a490 in nsEventTargetChainItem::HandleEventTargetChain (this=0x37c028, aVisitor=@0xbecf1110, aFlags=6, aCallback=0x0, 
    aMayHaveNewListenerManagers=1)
    at microb-engine-20090829-1.9.2-31493/content/events/src/nsEventDispatcher.cpp:330
#11 0x40e3b17c in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, aPresContext=<value optimized out>, aEvent=0x80ff48, 
    aDOMEvent=0x80febc, aEventStatus=0x0, aCallback=0x0)
    at microb-engine-20090829-1.9.2-31493/content/events/src/nsEventDispatcher.cpp:539
#12 0x40e3b5f4 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x5e8f74, aEvent=<value optimized out>, aDOMEvent=0x80febc, aPresContext=0x35fa68, 
    aEventStatus=0x0)
    at microb-engine-20090829-1.9.2-31493/content/events/src/nsEventDispatcher.cpp:601
#13 0x40c22560 in nsPresContext::FireDOMPaintEvent (this=0x35fa68)
    at microb-engine-20090829-1.9.2-31493/layout/base/nsPresContext.cpp:1975
#14 0x40c26ac4 in nsRunnableMethod<nsPresContext, void>::Run (this=<value optimized out>) at ../../dist/include/nsThreadUtils.h:264
---Type <return> to continue, or q <return> to quit---
#15 0x413ceec8 in nsThread::ProcessNextEvent (this=0x5aeb0, mayWait=0, result=0xbecf122c)
    at microb-engine-20090829-1.9.2-31493/xpcom/threads/nsThread.cpp:527
#16 0x41396010 in NS_ProcessPendingEvents_P (thread=0x5aeb0, timeout=20) at nsThreadUtils.cpp:180
#17 0x4135b79c in nsBaseAppShell::NativeEventCallback (this=0x5724c8)
    at microb-engine-20090829-1.9.2-31493/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#18 0x413520b4 in nsAppShell::EventProcessorCallback (source=<value optimized out>, condition=<value optimized out>, data=<value optimized out>)
    at microb-engine-20090829-1.9.2-31493/widget/src/gtk2/nsAppShell.cpp:71
#19 0x4015febc in g_io_unix_dispatch (source=0x572570, callback=0x4135206c <nsAppShell::EventProcessorCallback(_GIOChannel*, GIOCondition, void*)>, 
    user_data=0x5724c8) at glib2.0-2.20.3/glib/giounix.c:162
#20 0x401262c8 in IA__g_main_context_dispatch (context=0x44688)
    at glib2.0-2.20.3/glib/gmain.c:1836
#21 0x40129e10 in g_main_context_iterate (context=0x44688, block=1, dispatch=1, self=<value optimized out>)
    at glib2.0-2.20.3/glib/gmain.c:2467
#22 0x4012a19c in IA__g_main_loop_run (loop=0x459e8) at glib2.0-2.20.3/glib/gmain.c:2675
#23 0x402ed2ac in IA__gtk_main () at gtkmain.c:1200
#24 0x000155f4 in start_server (servtype=SERVER_EAL, pid=1741, background=0) at main.c:413
#25 0x0001584c in main (argc=5, argv=0xbecf1674) at main.c:511
#26 0x419b1974 in __libc_start_main () from /lib/libc.so.6
#27 0x0000ac7c in _start ()

#0  nsImageFrame::DisplayAltFeedback (this=0x89c28c, aRenderingContext=@0x80ffa8, aDirtyRect=@0xbecf0840, aRequest=0x0, aPt=@0xbecf04e8)
    at microb-engine-20090829-1.9.2-31493/layout/generic/nsImageFrame.cpp:1044
1044	in microb-engine-20090829-1.9.2-31493/layout/generic/nsImageFrame.cpp
(gdb) p aRequest
$1 = (class imgIRequest *) 0x0
(gdb) frame 1
#1  0x40c70a08 in PaintAltFeedback (aFrame=0x89c28c, aCtx=0x80ffa8, aDirtyRect=@0xbecf0840, aPt=@0xbecf0510)
    at microb-engine-20090829-1.9.2-31493/layout/generic/nsImageFrame.cpp:1103
1103	in microb-engine-20090829-1.9.2-31493/layout/generic/nsImageFrame.cpp
(gdb) p nsImageFrame::gIconLoad->mLoadingImage
$2 = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}
(gdb) p nsImageFrame::gIconLoad->mBrokenImage
$3 = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}
(gdb)

Comment 1

[Oleg Romashin (:romaxa)]

Probably it is blocking bug 507902.

Comment 2

[Bobby Holley (:bholley)]

Attachment: patch v1

Added a patch.

Pushed to try as 30fab04ca20e.

flagging bz for review.

Comment 3

[Nochum Sossonko [:Natch]]

Can a crash-test be created for this? Under what type of conditions does this happen?

Comment 4

[Oleg Romashin (:romaxa)]

remove broken-image.png from resources, and make image loading slower.

Comment 5

[Bobby Holley (:bholley)]

pushed to mc as 854ab30d101e

Resolving as fixed. romaxa - can you verify?

Comment 6

[Oleg Romashin (:romaxa)]

A bit later, I need to finish some other regression look-up

Comment 7

[Oleg Romashin (:romaxa)]

Works fine, requesting 1.9.2

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 397517 [details] [diff] [review]
patch v1

Will look at for next release

Comment 9

[Reed Loden [:reed]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/54e4030e8501

Comment 10

[Wayne Mery (:wsmwk)]

largely v.fixed according to crash-stats, after 3.6.3 almost no crashes.

filed Bug 578889 for what's left, which amounts to less than 1 crash per day http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A4.0b2pre&version=Firefox%3A4.0b1&version=Firefox%3A3.7a6pre&version=Firefox%3A3.7a5&version=Firefox%3A3.7a4webm&version=Firefox%3A3.7a4&version=Firefox%3A3.7a1pre&version=Firefox%3A3.6.8pre&version=Firefox%3A3.6.7pre&version=Firefox%3A3.6.7&version=Firefox%3A3.6.6pre&version=Firefox%3A3.6.6&version=Firefox%3A3.6.5pre&version=Firefox%3A3.6.4pre&version=Firefox%3A3.6.4&query_search=signature&query_type=exact&query=nsImageFrame%3A%3ADisplayAltFeedback%28nsIRenderingContext%26%2C%20nsRect%20const%26%2C%20imgIRequest*%2C%20nsPoint%29&date=07%2F14%2F2010%2020%3A04%3A31&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsImageFrame%3A%3ADisplayAltFeedback%28nsIRenderingContext%26%2C%20nsRect%20const%26%2C%20imgIRequest*%2C%20nsPoint%29

Comment 11

[Bobby Holley (:bholley)]

I am extremely unlikely to ever go back and write a crashtest for this.