STEPS TO REPRODUCE: 1. Load testcase (coming up) 2. Enter print preview 3. Press "close" on print-preview UI to return to normal browsing. 4. Wait 10 seconds. 5. Return to step 2. ACTUAL RESULTS: The second time that I leave Print Preview, I get this abort: ###!!! ABORT: Removing image that wasn't in the tracker!: 'found', file ../../../../mozilla/content/base/src/nsDocument.cpp, line 8028 I also get this image-related NS_ENSURE_TRUE failure when I leave PrintPreview, both the first & second time: WARNING: NS_ENSURE_TRUE(mOwner && !mCanceled) failed: file ../../../../mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 520 I originally brought this up in bug 590395 comment 4 that bug is about another instance of this assertion failure. However, that bug's patch has been checked in, and my debug build still fails on this testcase. (I'm at changeset 404b79632ff4, well after the fix landed). Marking security-sensitive, since bug 590395 is security-sensitive.
(In reply to comment #0) > ACTUAL RESULTS: > The second time that I leave Print Preview, I get this abort: Actually, it sometimes takes me more than two times through to trigger this -- however, I can generally hit it within a minute or so of iterating through the STR. (one thing to keep in mind is that it usually takes 5-15 seconds after leaving print-preview for the abort to fire, when it does fire, so make sure to allow that time)
Marking as sg:crit since Bug 590395 was sg:crit.
blocking2.0: --- → ?
Created attachment 470143 [details] testcase 1 d'oh, accidentally attached unreduced testcase instead of reduced testcase. :)
Attachment #470141 - Attachment is obsolete: true
Attachment #470143 - Attachment is patch: false
Attachment #470143 - Attachment mime type: text/plain → text/html
Comment on attachment 470141 [details] testcase 1 Marking accidentally-attached unreduced testcase as private, since it's got personal information (address, etc. - it's a receipt from a webstore)
Attachment #470141 - Attachment is private: true
The content of attachment 470141 [details] has been deleted by Reed Loden [:reed] <email@example.com> who provided the following reason: Contains personal information The token used to delete this attachment was generated at 2010-08-27 21:33:59 PDT.
Attachment #470141 - Attachment is private: false
Assignee: nobody → bobbyholley+bmo
blocking2.0: ? → final+
I haven't been able to reproduce on older branches, but bug 590395 doesn't seem to have been on those branches either.
status1.9.1: --- → unaffected
status1.9.2: --- → unaffected
As noted elsewhere, there is no tracker pre bug 512260.
The fact that builds crash every time I print makes it pretty hard to dogfood debug builds. (I crashed both printing google maps directions yesterday and again today printing an expedia itinerary.)
Created attachment 470876 [details] [diff] [review] patch v1 Added a patch that seems to fix the problem. Flagging bz for review.
Attachment #470876 - Flags: review?(bzbarsky)
Comment on attachment 470876 [details] [diff] [review] patch v1 Er... yes. Indeed. Write a better checkin comment, though ;) And maybe we should just push that null-check into TrackImage instead of sprinkling it all over?
Attachment #470876 - Flags: review?(bzbarsky) → review+
Created attachment 470932 [details] [diff] [review] patch v2 Added a new patch, addressing bz's review comments. Carrying over review. This should be ready to land.
This isn't a security problem - it only causes an abort in debug builds. Marking public (so somebody can land my fix!).
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b6
You need to log in before you can comment on or make changes to this bug.