590395 - "ABORT: Removing image that wasn't in the tracker!" after moving image between documents

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Jesse Ruderman]

Attachment: testcase (causes a crash during GC later)

1. Load the testcase.
2. Quit Firefox (or otherwise close it and then cause a GC).

Result:
###!!! ABORT: Removing image that wasn't in the tracker!: 'found', file content/base/src/nsDocument.cpp, line 8007

Bug 589469 might be the same as this bug (see bug 589469 comment 3 option 3), but I can't be sure because that bug doesn't have a testcase.

Comment 1

[Jesse Ruderman]

This should block Gecko 2.0 because it might be responsible for crashes at http://derstandard.at/ (Alexa: #9 in Austria).

Comment 2

[Jesse Ruderman]

Oh and also because it's likely exploitable, since in opt builds, it crashes touching a bogus address.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The appendChild call in this case does an implicit removeChild followed by implicit adoptNode.  Then see bug 589469 comment 8.

Comment 4

[Daniel Holbert [:dholbert]]

FWIW, I've got an (un-reduced, save-as-webpage-complete) testcase from a purchase receipt that triggers this same ABORT_IF_FALSE shortly after leaving print preview.

Just talked to bholley about it; if it ends up not being fixed by bholley's patch here, I'll file a new bug on that.

Comment 5

[Bobby Holley (:bholley)]

Pushed a fix for this testcase to mozilla-central:
http://hg.mozilla.org/mozilla-central/rev/cf4d7946e2e0

Resolving fixed.

Comment 6

[Daniel Holbert [:dholbert]]

The testcase I mentioned in comment 4 still triggers this abort -- I filed bug 591560 on that.

Comment 7

[Daniel Veditz [:dveditz]]

older branches appear don't trigger the alert, as expected since the regressing bug 512260 (suspected or proved?) didn't land there.

Comment 8

[Bobby Holley (:bholley)]

(In reply to comment #7)
> older branches appear don't trigger the alert, as expected since the regressing
> bug 512260 (suspected or proved?) didn't land there.

The tracker in question did not exist pre bug 512260.

Comment 9

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Jesse landed this testcase on m-c.

http://hg.mozilla.org/mozilla-central/rev/cef75243703a