592855 - crash [@ nsImageFrame::GetImageMap(nsPresContext*) ]

Status: RESOLVED WORKSFORME

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Scoobidiver (away)]

Build : Mozilla/5.0 (Windows NT 5.1.2600 Service Pack 3; rv:2.0b5pre)
Gecko/20100831 Firefox/4.0b5pre

This is a new crash signature which has been introduced by this build.
It is #17 crasher for this build

Signature	nsImageFrame::GetImageMap(nsPresContext*)
UUID	b66f1877-092c-4807-badc-8a2052100901
Time 	2010-09-01 08:53:01.119857
Uptime	332
Last Crash	334 seconds (5.6 minutes) before submission
Install Age	79704 seconds (22.1 hours) since version was first installed.
Product	Firefox
Version	4.0b5pre
Build ID	20100831040721
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	AuthenticAMD family 6 model 10 stepping 0
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0xffffffffffffffff
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0045

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsImageFrame::GetImageMap 	layout/generic/nsImageFrame.cpp:1348
1 	xul.dll 	nsImageFrame::PaintImage 	layout/generic/nsImageFrame.cpp:1175

The regression window is :
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2010-08-30&enddate=2010-08-31

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

(In reply to comment #0)
> The regression window is :
> http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2010-08-30&enddate=2010-08-31

Range based on CSets:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0487454f4219&tochange=1b43ce0bda4f

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Not blocking without testcase

Comment 3

[Scoobidiver (away)]

It happens only with build 20100831040721
It was fixed in build 20100901041125

The fix range would be :
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1b43ce0bda4f&tochange=f47972d05473