ABORT: What is the next frame supposed to be?: 'haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())'

VERIFIED FIXED in mozilla8



8 years ago
5 years ago


(Reporter: cbook, Assigned: joe)


(Blocks: 1 bug, {assertion})


Firefox Tracking Flags

(firefox5-, firefox6-)


(Whiteboard: [sg:dos (self-inflicted)][inbound], URL)


(2 attachments)



8 years ago
Crashed during Topsite run on http://www.7m.cn: EXIT STATUS: CRASHED signal 10 SIGBUS (162.840153 seconds) with Mac Trunk Debug Build

###!!! ABORT: What is the next frame supposed to be?: 'haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())', file /work/mozilla/builds/2.0.0/mozilla/modules/libpr0n/src/RasterImage.cpp, line 1405

http://www.7m.cn: EXIT STATUS: CRASHED signal 10 SIGBUS (162.840153 seconds)

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libmozalloc.dylib             	0x04f24e34 TouchBadMemory() + 17 (mozalloc_abort.cpp:64)
1   libmozalloc.dylib             	0x04f24e8f mozalloc_abort(char const*) + 69 (mozalloc_abort.cpp:88)
2   XUL                           	0x000222d4 GetAssertBehavior() + 0 (nsDebugImpl.cpp:192)
3   XUL                           	0x000227cf NS_DebugBreak_P + 702 (nsDebugImpl.cpp:338)
4   XUL                           	0x0028e7fb mozilla::imagelib::RasterImage::Notify(nsITimer*) + 867 (RasterImage.cpp:1409)
5   XUL                           	0x0180c5b4 nsTimerImpl::Fire() + 1284 (nsTimerImpl.cpp:429)
6   XUL                           	0x0180c80b nsTimerEvent::Run() + 217 (nsTimerImpl.cpp:519)
7   XUL                           	0x01804bff nsThread::ProcessNextEvent(int, int*) + 907 (nsThread.cpp:633)
8   XUL                           	0x01788c93 NS_ProcessPendingEvents_P(nsIThread*, unsigned int) + 146 (nsThreadUtils.cpp:200)
9   XUL                           	0x014606b1 nsBaseAppShell::NativeEventCallback() + 181 (nsBaseAppShell.cpp:133)
10  XUL                           	0x0140e625 nsAppShell::ProcessGeckoEvents(void*) + 497 (nsAppShell.mm:400)
11  com.apple.CoreFoundation      	0x960c64cb __CFRunLoopDoSources0 + 1563
12  com.apple.CoreFoundation      	0x960c3f8f __CFRunLoopRun + 1071
13  com.apple.CoreFoundation      	0x960c3464 CFRunLoopRunSpecific + 452
14  com.apple.CoreFoundation      	0x960c3291 CFRunLoopRunInMode + 97
15  com.apple.HIToolbox           	0x953ac004 RunCurrentEventLoopInMode + 392
16  com.apple.HIToolbox           	0x953abdbb ReceiveNextEventCommon + 354
17  com.apple.HIToolbox           	0x953abc40 BlockUntilNextEventMatchingListInMode + 81
18  com.apple.AppKit              	0x92df578d _DPSNextEvent + 847
19  com.apple.AppKit              	0x92df4fce -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 156
20  com.apple.AppKit              	0x92db7247 -[NSApplication run] + 821
21  XUL                           	0x0140d323 nsAppShell::Run() + 291 (nsAppShell.mm:746)
22  XUL                           	0x0114cb16 nsAppStartup::Run() + 148 (nsAppStartup.cpp:191)
23  XUL                           	0x0003fc29 XRE_main + 11868 (nsAppRunner.cpp:3695)
24  org.mozilla.firefoxdebug      	0x000025f1 main + 714 (nsBrowserApp.cpp:158)
25  org.mozilla.firefoxdebug      	0x00002272 start + 54


8 years ago
Blocks: 532972

Comment 1

8 years ago
I've seen this on 7 urls from 2010-12-20T23:25:25 - 2011-01-18T08:16:49 on Mac OS X 10.5 intel only.
Summary: Crash - TouchBadMemory() + 17 → ABORT: What is the next frame supposed to be?: 'haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())'
Component: General → ImageLib
QA Contact: general → imagelib

Comment 2

8 years ago
is this the same as socorro crash 
[@ mozilla::imagelib::RasterImage::DrawFrameTo(imgFrame*, imgFrame*, nsIntRect&) ]


Comment 3

8 years ago
FYI: I see this daily in the crash test automation. The domains I've reproduced
it on so far are:

5giay.vn, aglaonemaonline.wordpress.com, ak.178.com, ale-aukcje.pl, animeq-ja.blogspot.com, azz-overload.net, b3ta.com, bbs.3dmgame.com, bbs.goapk.com, bbs.temox.com, bbs.voc.com.cn, bbs.weiphone.com, benyouhui.it168.com, board.postjung.com, book.zongheng.com, bsnl.co.in, cf.766.com, cinemaxx.ru, clubs.ya.ru, data.movie.xunlei.com, dek-d.com, dematom.com, desciclopedia.org, dethi.zinaki.com, dnbforum.com, extra2.bsgi.org.br, fanfiction.nyah.com.br, filiza.ru, filmehd.net, filmix.net, forum.brest.by, forum.stop55.com, foto-mult.ru, funnyjunk.com, game.ali213.net, gaydar.co.uk, getdrivesafe.com, home.blogtruyen.com, hurtom.com, hvg.hu, item.taobao.com, jeddah-lx.com, jyukujyo1.blog86.fc2.com, kapook.com, keep4u.ru, kenhsinhvien.net, klikajadeh.com, manga24h.com, masteroff.org, me.zing.vn, nnm.ru, onua.com.ua, p0rno-tv.com, pes-land.ru, picpost.postjung.com, porevo.info, pornonights.ru, porntuba.ru, proc.com.ua, product.it168.com, quangcaogiare.vn, rds-zone.ro, realmentecaseiras.blogspot.com, reddodo.com, rutracker.org, rutracker.ru, sacanagembr.com, sancharnet.in, sfw.org.ua, share.earthlinktele.com, skyclipart.ru, softvnn.com, sport.ro, spotato.net, stafaband.info, stalker74.do.am, supernatural.chudoforum.ru, tagboards.miarroba.es, tieba.baidu.com, top.l2jbrasil.com, trenietreni.it, tt.mop.com, tvdedegraca-i.blogspot.com, verdadescristianas.blogcindario.com, vnsharing.net, wadize2ab.com, www.56.com, www.91baby.com, www.alshmalgate.net, www.aridesa.com.br, www.b-g4ever.com, www.bdh16.gov.tr, www.bolero.ru, www.bommeltje.nl, www.bsnl.co.in, www.celebjihad.com, www.clubthai-it.com, www.corluzz.co.cc, www.cortag.com.br, www.cuplari.ro, www.darkzone.in.th, www.dek-d.com, www.dilforum.com, www.divertiviaggi.it, www.drb-al56r.com, www.driva-eget.se, www.egy4n.com, www.ehentai.ru, www.el7akeem.com, www.erotycznyblog.pl, www.fatimanews.com.br, www.filmai.in, www.franchise108.com, www.gameqq.net, www.gaydar.nl, www.gillmarine.com, www.goosiam.com, www.hacken.cc, www.hazirfilm.com, www.hinata.xpg.com.br, www.i11i.net, www.ibnmsr.com, www.indowebster.com, www.indowebster.web.id, www.j-doramanga.com, www.jambotube.com, www.jobmonitor.hu, www.jorgeemateus.com.br, www.k-gameonline.com, www.klikajadeh.com, www.knowsky.com, www.lastfm.pl, www.libertatea.ro, www.livefilmeporno.com, www.macx.cn, www.maisfutebol.iol.pt, www.manodrabuziai.lt, www.mapion.co.jp, www.masterporn.ru, www.megafilex.com, www.myanmarhiphopchannel.com, www.okbole.com, www.phueanthae.in.th, www.pixiv.net, www.playstation-android.sk, www.playxp.com, www.pokemonmythology.110mb.com, www.pokexperto.net, www.pornbb.org, www.pornotesao.com, www.portalfilmes.org, www.proground.org.ru, www.raamas.com, www.rabota.ru, www.radialistas.net, www.rashedalmajid.com, www.rustorrents.net, www.saberdetudo.com.br, www.sakh.com, www.samsunsporluyuz.net, www.seed18up.net, www.series.el3lam.com, www.sexyboard.org, www.shum2money.ru, www.sisaketfc.com, www.smaxi.net, www.smayli.ru, www.spicycute.com, www.spoki.lv, www.sport.ro, www.stepashka.com, www.telaerotica.com, www.thailandsusu.com, www.tportal.hr, www.tran33m.com, www.tuifly.com, www.tvguide.co.uk, www.uol.com.br, www.vatgia.com, www.xxx4u.ru, www.yugionline.com.br, www.zavarka.ru, www.zimabdk.com, www3.familyoldphotos.com, xahoithongtin.com.vn, xemtiep.com, xuk.ru, yourserv.ru, zerx.ru, ziapps.com, znamenitosti-na-foto.ru, zona-zona-internet.blogspot.com

Note that I only tested the urls on these sites because our users are crashing

Comment 4

8 years ago
This continues to be a common Abort during crash automation testing. It can cause issues for automated testing by potentially hiding other crashes.

If it isn't important enough to fix, then perhaps it should be a non-fatal ASSERTION rather than an Abort?
FWIW, we just hit this abort during a tbox reftest run - filed Bug 652238.

Comment 6

8 years ago
also hitting this again on the topsite tests for firefox 5 beta 

###!!! ABORT: What is the next frame supposed to be?: 'haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())', file /work/mozilla/builds/firefox5/mozilla-beta/modules/libpr0n/src/RasterImage.cpp, line 1466

http://www.ujap.edu.ve: EXIT STATUS: CRASHED signal 10 SIGBUS (311.669375 seconds)

joe is this something to fix for firefox 5?

Comment 7

8 years ago
to add something for the domains here its also on elite-view.com
This is blocking crash test automation. It appears to be a widespread problem and needs to be handled differently than a runtime abort. If it's a problem in our code we need another way to fix it. If it's simply reporting an error in the image then it definitely shouldn't be an abort -- the web is full of crap.
Assignee: nobody → bobbyholley+bmo
Severity: critical → blocker
Whiteboard: [sg:dos (suicide)]
may not rate landing on the beta branch unless it's a topcrash, but Fx6 for sure.
tracking-firefox5: --- → ?
tracking-firefox6: --- → ?
Keywords: testcase-wanted
--> joe per bug 609499 comment 7
Assignee: bobbyholley+bmo → joe


8 years ago
tracking-firefox6: ? → +
tracking-firefox5: ? → -

Comment 11

8 years ago
This is still a common issue in crash testing on 2.0.0, Beta, Aurora, and Nightly on Windows, Mac, Linux.

Does this really qualify to be a fatal assertion? Can it be demoted to just an NS_ASSERTION ?
OS: Mac OS X → OpenBSD


8 years ago
OS: OpenBSD → All
Whiteboard: [sg:dos (suicide)] → [sg:dos (self-inflicted)]


8 years ago
Duplicate of this bug: 671977
FWIW, the URL where Scott periodically hit this when filing duplicate bug 671977 was:
(warning: lots of animated gifs there ^, tends to slow down browser)
We're getting deep into 6 Beta and I don't think we'd take anything that wasn't really safe at this point. Is that likely in the next week or so?

Comment 15

8 years ago
This is just a fatal assertion in debug builds. I'm not clear on why it was marked tracking for Fx6; it probably shouldn't be.

Comment 16

8 years ago
(In reply to comment #15)
> This is just a fatal assertion in debug builds. I'm not clear on why it was
> marked tracking for Fx6; it probably shouldn't be.

i think it was marked because of the reasons in comment #8 - since other crashes can hide etc

Comment 17

8 years ago
For example, last night I hit this abort locally while investigating a crash with a stack like nsXULTemplateBuilder::Uninit nsXULTemplateBuilder::~nsXULTemplateBuilder nsXULContentBuilder::~nsXULContentBuilder nsXULTemplateBuilder::Release nsXPCOMCycleCollectionParticipant::Unroot 

As you can see in comment 3, this abort is common place and interferes with crash testing.
Is there a reason we can't just skip the NS_ABORT_IF_FALSE? It seems like later on in the function the check is performed to determine if the next frame is there, and it waits if it's not... so it doesn't seem like there is any reason why the ABORT can't be changed to WARN.

Comment 19

8 years ago
Created attachment 546934 [details] [diff] [review]
Sometimes, images pause mid-frame when downloading. We handle this just fine, but unfortunately we assert that it's not the case. Since this assertion is just bogus, delete it.
Attachment #546934 - Flags: review?(jmuizelaar)

Comment 20

8 years ago
Created attachment 546935 [details] [diff] [review]
Add a crashtest for an image that takes a very long time to download the next frame, giving our animation timer a chance to fire.
Attachment #546935 - Flags: review?(jmuizelaar)


8 years ago
Keywords: crash, testcase-wanted → assertion
Attachment #546934 - Flags: review?(jmuizelaar) → review+
Comment on attachment 546935 [details] [diff] [review]
Add a crashtest for an image that takes a very long time to download the next frame, giving our animation timer a chance to fire.

Why do we use @mozilla.org/timer instead of setTimeout?

Comment 22

8 years ago
setTimeout is an attribute on the window object, and we don't have a window object.
Comment on attachment 546935 [details] [diff] [review]
Add a crashtest for an image that takes a very long time to download the next frame, giving our animation timer a chance to fire.

Add a comment about where 5 seconds come from. i.e. what time does it need to be larger than.
Attachment #546935 - Flags: review?(jmuizelaar) → review+

Comment 24

8 years ago
Joe, this is still significantly affecting crash testing. Can we land this soon?
Seems this is ready to land, but we won't get this for 6 any more, nor do I think it's critical enough to rush in. tracking6-.
tracking-firefox6: + → -

Comment 27

8 years ago
Ms2ger found an important bug in my crashtest (not holding on to a reference to the timer), so I quickly pushed a fix:

Last Resolved: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla8

Comment 29

8 years ago
verified. not seen in automation since 8/5.
You need to log in before you can comment on or make changes to this bug.