If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash @ nsWindowGfx::Data32BitTo1Bit

RESOLVED FIXED in mozilla22

Status

()

Core
Widget: Win32
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Assigned: ehugg)

Tracking

({crash, regression})

13 Branch
mozilla22
All
Windows 7
crash, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
It's a crash signature that spiked in 13.0a1/20120223.
The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=373c710112e6&tochange=5e756e59a794

Signature 	nsWindowGfx::Data32BitTo1Bit(unsigned char*, unsigned int, unsigned int) More Reports Search
UUID	70f30422-c513-4def-98c0-9b57c2120223
Date Processed	2012-02-23 18:27:42
Uptime	5403
Install Age	1.5 hours since version was first installed.
Install Time	2012-02-23 16:57:13
Product	Firefox
Version	13.0a1
Build ID	20120223031236
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 4 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xb25b000
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9540, AdapterSubsysID: 21ae1458, AdapterDriverVersion: 8.782.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
EMCheckCompatibility	True	
Total Virtual Memory	2147352576
Available Virtual Memory	1766428672
System Memory Use Percentage	37
Available Page File	5382426624
Available Physical Memory	2174717952

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsWindowGfx::Data32BitTo1Bit 	widget/windows/nsWindowGfx.cpp:747
1 	xul.dll 	nsWindowGfx::CreateIcon 	widget/windows/nsWindowGfx.cpp:704
2 	xul.dll 	NS_TableDrivenQI 	obj-firefox/xpcom/build/nsISupportsImpl.cpp:49
3 	xul.dll 	mozilla::image::RasterImage::QueryInterface 	image/src/RasterImage.cpp:184
4 	xul.dll 	mozilla::widget::TaskbarTabPreview::SetIcon 	widget/windows/TaskbarTabPreview.cpp:131
5 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
6 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2178
7 	xul.dll 	XPCWrappedNative::SetAttribute 	js/xpconnect/src/xpcprivate.h:2657
8 	xul.dll 	XPC_WN_GetterSetter 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1580
9 	xul.dll 	xul.dll@0x13f5ef 	
10 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:499
11 	xul.dll 	XPC_WN_JSOp_ThisObject 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1344
12 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:549
13 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:517
14 	mozjs.dll 	js::InvokeGetterOrSetter 	js/src/jsinterp.cpp:623
15 	mozjs.dll 	js::Shape::set 	js/src/jsscopeinlines.h:311
16 	mozjs.dll 	js_NativeSet 	js/src/jsobj.cpp:5180
17 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:5648
18 	xul.dll 	XPC_WN_OnlyIWrite_Proto_SetPropertyStub 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1764
19 	mozjs.dll 	mozjs.dll@0x741f 	
20 		@0xffffff86 	
21 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2735
22 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2585

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsWindowGfx%3A%3AData32BitTo1Bit%28unsigned%20char*%2C%20unsigned%20int%2C%20unsigned%20int%29
(Assignee)

Comment 1

5 years ago
Created attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon
(Assignee)

Comment 2

5 years ago
Comment on attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon


I ran into this while using the Application Verifier under Windows 8 to diagnose an unrelated problem.  This keeps 'data' from pointing to an area that's already been freed by the release of 'dest', or at least this patch made AppVerif happy.

I'm putting Jesup down as reviewer anticipating that he will find the proper owner for this area to review.
Attachment #728493 - Flags: review?(rjesup)
Comment on attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon

Thanks Ethan!
Attachment #728493 - Flags: review?(rjesup) → review?(joe)
Comment on attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon

Review of attachment 728493 [details] [diff] [review]:
-----------------------------------------------------------------

::: widget/windows/nsWindowGfx.cpp
@@ +638,1 @@
>                                                           gfxASurface::ImageFormatARGB32);

Put this on the previous line too.
Attachment #728493 - Flags: review?(joe) → review+
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/f8613cef1d54
https://hg.mozilla.org/mozilla-central/rev/f8613cef1d54
Assignee: nobody → ethanhugg
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.