591560 - "ABORT: Removing image that wasn't in the tracker!" with animated gif, after leaving print preview

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Daniel Holbert [:dholbert]]

STEPS TO REPRODUCE:
 1. Load testcase (coming up)
 2. Enter print preview
 3. Press "close" on print-preview UI to return to normal browsing.
 4. Wait 10 seconds.
 5. Return to step 2.

ACTUAL RESULTS:
The second time that I leave Print Preview, I get this abort:
###!!! ABORT: Removing image that wasn't in the tracker!: 'found', file ../../../../mozilla/content/base/src/nsDocument.cpp, line 8028

I also get this image-related NS_ENSURE_TRUE failure when I leave PrintPreview, both the first & second time:
WARNING: NS_ENSURE_TRUE(mOwner && !mCanceled) failed: file ../../../../mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 520

I originally brought this up in bug 590395 comment 4 that bug is about another instance of this assertion failure.  However, that bug's patch has been checked in, and my debug build still fails on this testcase.  (I'm at changeset 404b79632ff4, well after the fix landed).

Marking security-sensitive, since bug 590395 is security-sensitive.

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: testcase 1

Comment 2

[Daniel Holbert [:dholbert]]

(In reply to comment #0)
> ACTUAL RESULTS:
> The second time that I leave Print Preview, I get this abort:

Actually, it sometimes takes me more than two times through to trigger this -- however, I can generally hit it within a minute or so of iterating through the STR.

(one thing to keep in mind is that it usually takes 5-15 seconds after leaving print-preview for the abort to fire, when it does fire, so make sure to allow that time)

Comment 3

[Daniel Holbert [:dholbert]]

Marking as sg:crit since Bug 590395 was sg:crit.

Comment 4

[Daniel Holbert [:dholbert]]

Attachment: testcase 1

d'oh, accidentally attached unreduced testcase instead of reduced testcase. :)

Comment 5

[Daniel Holbert [:dholbert]]

Comment on attachment 470141 [details]
testcase 1

Marking accidentally-attached unreduced testcase as private, since it's got personal information (address, etc. - it's a receipt from a webstore)

Comment 6

[Daniel Holbert [:dholbert]]

Attachment: backtrace

here's the backtrace of the abort failure.

Comment 7

[Reed Loden [:reed]]

The content of attachment 470141 [details] has been deleted by
    Reed Loden [:reed] <[e-mail]>
who provided the following reason:

Contains personal information

The token used to delete this attachment was generated at 2010-08-27 21:33:59 PDT.

Comment 8

[Daniel Veditz [:dveditz]]

I haven't been able to reproduce on older branches, but bug 590395 doesn't seem to have been on those branches either.

Comment 9

[Bobby Holley (:bholley)]

As noted elsewhere, there is no tracker pre bug 512260.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The fact that builds crash every time I print makes it pretty hard to dogfood debug builds.  (I crashed both printing google maps directions yesterday and again today printing an expedia itinerary.)

Comment 11

[Bobby Holley (:bholley)]

Attachment: patch v1

Added a patch that seems to fix the problem. Flagging bz for review.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 470876 [details] [diff] [review]
patch v1

Er... yes.  Indeed.  Write a better checkin comment, though  ;)

And maybe we should just push that null-check into TrackImage instead of sprinkling it all over?

Comment 13

[Bobby Holley (:bholley)]

Attachment: patch v2

Added a new patch, addressing bz's review comments. Carrying over review. This should be ready to land.

Comment 14

[Bobby Holley (:bholley)]

This isn't a security problem - it only causes an abort in debug builds. Marking public (so somebody can land my fix!).

Comment 15

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/278f4bc80145