671977 - NS_ABORT_IF_FALSE logic seems to be incorrect in RasterImage::Notify() ("ABORT: What is the next frame supposed to be?")

Status: RESOLVED DUPLICATE of bug 627015

(Core :: Graphics: ImageLib, defect)

Description

[Scott Johnson (:jwir3)]

Hit an NS_ABORT_IF_FALSE in RasterImage::Notify(), causing a failure in debug builds, but the actual code doesn't appear to be necessary. The following is a backtrace from this issue:

#0  0x00007ffff64a33dd in TouchBadMemory () at /home/sjohnson/Source/mozilla-central/mozilla/memory/mozalloc/mozalloc_abort.cpp:66
#1  0x00007ffff64a3431 in mozalloc_abort (
    msg=0x7fffffffb090 "###!!! ABORT: What is the next frame supposed to be?: 'haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())', file /home/sjohnson/Source/mozilla-central/mozilla/modu"...)
    at /home/sjohnson/Source/mozilla-central/mozilla/memory/mozalloc/mozalloc_abort.cpp:87
#2  0x00007ffff3c39502 in Abort (
    aMsg=0x7fffffffb090 "###!!! ABORT: What is the next frame supposed to be?: 'haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())', file /home/sjohnson/Source/mozilla-central/mozilla/modu"...)
    at /home/sjohnson/Source/mozilla-central/mozilla/xpcom/base/nsDebugImpl.cpp:388
#3  0x00007ffff3c39414 in NS_DebugBreak_P (aSeverity=3, aStr=0x7ffff4478910 "What is the next frame supposed to be?", 
    aExpr=0x7ffff44788b8 "haveFullNextFrame || (mDecoder && mFrames.Length() > mDecoder->GetCompleteFrameCount())", 
    aFile=0x7ffff4477ad0 "/home/sjohnson/Source/mozilla-central/mozilla/modules/libpr0n/src/RasterImage.cpp", aLine=1472)
    at /home/sjohnson/Source/mozilla-central/mozilla/xpcom/base/nsDebugImpl.cpp:345
#4  0x00007ffff2828a96 in mozilla::imagelib::RasterImage::Notify (this=0x7fffd2e53200, timer=0x7fffd2d38940)
    at /home/sjohnson/Source/mozilla-central/mozilla/modules/libpr0n/src/RasterImage.cpp:1470
#5  0x00007ffff3c30c70 in nsTimerImpl::Fire (this=0x7fffd2d38940)
    at /home/sjohnson/Source/mozilla-central/mozilla/xpcom/threads/nsTimerImpl.cpp:427
#6  0x00007ffff3c31063 in nsTimerEvent::Run (this=0x7fffd2f500a0)
    at /home/sjohnson/Source/mozilla-central/mozilla/xpcom/threads/nsTimerImpl.cpp:520

So, what appears to be happening is that this chunk of code is failing:
http://mxr.mozilla.org/mozilla-central/source/modules/libpr0n/src/RasterImage.cpp?mark=1448-1451#1441

During the failure (debugging with GDB), I have the following:

(gdb) p haveFullNextFrame
$7 = false

(gdb) p mDecoder
$1 = {mRawPtr = 0x7fffcc6f9000}

(gdb) p mDecoder->mRawPtr->GetCompleteFrameCount()
[Thread 0x7fffd7afb700 (LWP 20925) exited]
$5 = 59

(gdb) p *mFrames.mHdr
$4 = {static sEmptyHdr = {static sEmptyHdr = <same as static member of an already seen type>, mLength = 0, 
    mCapacity = 0, mIsAutoArray = 0}, mLength = 59, mCapacity = 64, mIsAutoArray = 0}

I suspect this ABORT statement might be a bit unnecessary, because it looks like later in the function, we actually check for this circumstance and wait a bit for the frame to be decoded:
http://mxr.mozilla.org/mozilla-central/source/modules/libpr0n/src/RasterImage.cpp?mark=1484-1489#1441