"ABORT: Removing image that wasn't in the tracker!" with animated gif, after leaving print preview

RESOLVED FIXED in mozilla2.0b7

Status

()

Core
ImageLib
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: dholbert, Assigned: bholley)

Tracking

(4 keywords)

Trunk
mozilla2.0b7
x86
Linux
assertion, dogfood, regression, testcase
Points:
---

Firefox Tracking Flags

(blocking2.0 final+, status1.9.2 unaffected, status1.9.1 unaffected)

Details

Attachments

(3 attachments, 2 obsolete attachments)

(Reporter)

Description

8 years ago
STEPS TO REPRODUCE:
 1. Load testcase (coming up)
 2. Enter print preview
 3. Press "close" on print-preview UI to return to normal browsing.
 4. Wait 10 seconds.
 5. Return to step 2.

ACTUAL RESULTS:
The second time that I leave Print Preview, I get this abort:
###!!! ABORT: Removing image that wasn't in the tracker!: 'found', file ../../../../mozilla/content/base/src/nsDocument.cpp, line 8028

I also get this image-related NS_ENSURE_TRUE failure when I leave PrintPreview, both the first & second time:
WARNING: NS_ENSURE_TRUE(mOwner && !mCanceled) failed: file ../../../../mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 520

I originally brought this up in bug 590395 comment 4 that bug is about another instance of this assertion failure.  However, that bug's patch has been checked in, and my debug build still fails on this testcase.  (I'm at changeset 404b79632ff4, well after the fix landed).

Marking security-sensitive, since bug 590395 is security-sensitive.
(Reporter)

Comment 1

8 years ago
Created attachment 470141 [details]
testcase 1
(Reporter)

Comment 2

8 years ago
(In reply to comment #0)
> ACTUAL RESULTS:
> The second time that I leave Print Preview, I get this abort:

Actually, it sometimes takes me more than two times through to trigger this -- however, I can generally hit it within a minute or so of iterating through the STR.

(one thing to keep in mind is that it usually takes 5-15 seconds after leaving print-preview for the abort to fire, when it does fire, so make sure to allow that time)
(Reporter)

Comment 3

8 years ago
Marking as sg:crit since Bug 590395 was sg:crit.
Blocks: 512260
blocking2.0: --- → ?
Keywords: testcase
Whiteboard: [sg:critical?]
(Reporter)

Comment 4

8 years ago
Created attachment 470143 [details]
testcase 1

d'oh, accidentally attached unreduced testcase instead of reduced testcase. :)
Attachment #470141 - Attachment is obsolete: true
(Reporter)

Updated

8 years ago
Attachment #470143 - Attachment is patch: false
(Reporter)

Updated

8 years ago
Attachment #470143 - Attachment mime type: text/plain → text/html
(Reporter)

Comment 5

8 years ago
Comment on attachment 470141 [details]
testcase 1

Marking accidentally-attached unreduced testcase as private, since it's got personal information (address, etc. - it's a receipt from a webstore)
Attachment #470141 - Attachment is private: true
(Reporter)

Comment 6

8 years ago
Created attachment 470144 [details]
backtrace

here's the backtrace of the abort failure.
The content of attachment 470141 [details] has been deleted by
    Reed Loden [:reed] <reed@reedloden.com>
who provided the following reason:

Contains personal information

The token used to delete this attachment was generated at 2010-08-27 21:33:59 PDT.
Attachment #470141 - Attachment is private: false
Assignee: nobody → bobbyholley+bmo
blocking2.0: ? → final+
I haven't been able to reproduce on older branches, but bug 590395 doesn't seem to have been on those branches either.
status1.9.1: --- → unaffected
status1.9.2: --- → unaffected
(Assignee)

Comment 9

8 years ago
As noted elsewhere, there is no tracker pre bug 512260.
The fact that builds crash every time I print makes it pretty hard to dogfood debug builds.  (I crashed both printing google maps directions yesterday and again today printing an expedia itinerary.)
Keywords: dogfood
(Assignee)

Comment 11

8 years ago
Created attachment 470876 [details] [diff] [review]
patch v1

Added a patch that seems to fix the problem. Flagging bz for review.
Attachment #470876 - Flags: review?(bzbarsky)
Comment on attachment 470876 [details] [diff] [review]
patch v1

Er... yes.  Indeed.  Write a better checkin comment, though  ;)

And maybe we should just push that null-check into TrackImage instead of sprinkling it all over?
Attachment #470876 - Flags: review?(bzbarsky) → review+
(Assignee)

Comment 13

8 years ago
Created attachment 470932 [details] [diff] [review]
patch v2

Added a new patch, addressing bz's review comments. Carrying over review. This should be ready to land.
Attachment #470876 - Attachment is obsolete: true
Attachment #470932 - Flags: review+
(Assignee)

Comment 14

8 years ago
This isn't a security problem - it only causes an abort in debug builds. Marking public (so somebody can land my fix!).
Group: core-security
(Assignee)

Updated

8 years ago
Whiteboard: [sg:critical?]
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/278f4bc80145
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b6
You need to log in before you can comment on or make changes to this bug.