730277 - Crash @ nsWindowGfx::Data32BitTo1Bit

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect)

Description

[Scoobidiver (away)]

It's a crash signature that spiked in 13.0a1/20120223.
The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=373c710112e6&tochange=5e756e59a794

Signature 	nsWindowGfx::Data32BitTo1Bit(unsigned char*, unsigned int, unsigned int) More Reports Search
UUID	70f30422-c513-4def-98c0-9b57c2120223
Date Processed	2012-02-23 18:27:42
Uptime	5403
Install Age	1.5 hours since version was first installed.
Install Time	2012-02-23 16:57:13
Product	Firefox
Version	13.0a1
Build ID	20120223031236
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 4 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xb25b000
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9540, AdapterSubsysID: 21ae1458, AdapterDriverVersion: 8.782.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
EMCheckCompatibility	True	
Total Virtual Memory	2147352576
Available Virtual Memory	1766428672
System Memory Use Percentage	37
Available Page File	5382426624
Available Physical Memory	2174717952

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsWindowGfx::Data32BitTo1Bit 	widget/windows/nsWindowGfx.cpp:747
1 	xul.dll 	nsWindowGfx::CreateIcon 	widget/windows/nsWindowGfx.cpp:704
2 	xul.dll 	NS_TableDrivenQI 	obj-firefox/xpcom/build/nsISupportsImpl.cpp:49
3 	xul.dll 	mozilla::image::RasterImage::QueryInterface 	image/src/RasterImage.cpp:184
4 	xul.dll 	mozilla::widget::TaskbarTabPreview::SetIcon 	widget/windows/TaskbarTabPreview.cpp:131
5 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
6 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2178
7 	xul.dll 	XPCWrappedNative::SetAttribute 	js/xpconnect/src/xpcprivate.h:2657
8 	xul.dll 	XPC_WN_GetterSetter 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1580
9 	xul.dll 	xul.dll@0x13f5ef 	
10 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:499
11 	xul.dll 	XPC_WN_JSOp_ThisObject 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1344
12 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:549
13 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:517
14 	mozjs.dll 	js::InvokeGetterOrSetter 	js/src/jsinterp.cpp:623
15 	mozjs.dll 	js::Shape::set 	js/src/jsscopeinlines.h:311
16 	mozjs.dll 	js_NativeSet 	js/src/jsobj.cpp:5180
17 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:5648
18 	xul.dll 	XPC_WN_OnlyIWrite_Proto_SetPropertyStub 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1764
19 	mozjs.dll 	mozjs.dll@0x741f 	
20 		@0xffffff86 	
21 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2735
22 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2585

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsWindowGfx%3A%3AData32BitTo1Bit%28unsigned%20char*%2C%20unsigned%20int%2C%20unsigned%20int%29

Comment 1

[Ethan Hugg [:ehugg]]

Attachment: Hold reference until data used in CreateIcon

Comment 2

[Ethan Hugg [:ehugg]]

Comment on attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon


I ran into this while using the Application Verifier under Windows 8 to diagnose an unrelated problem.  This keeps 'data' from pointing to an area that's already been freed by the release of 'dest', or at least this patch made AppVerif happy.

I'm putting Jesup down as reviewer anticipating that he will find the proper owner for this area to review.

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon

Thanks Ethan!

Comment 4

[Joe Drew (not getting mail)]

Comment on attachment 728493 [details] [diff] [review]
Hold reference until data used in CreateIcon

Review of attachment 728493 [details] [diff] [review]:
-----------------------------------------------------------------

::: widget/windows/nsWindowGfx.cpp
@@ +638,1 @@
>                                                           gfxASurface::ImageFormatARGB32);

Put this on the previous line too.

Comment 5

[Ethan Hugg [:ehugg]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f8613cef1d54

Comment 6

[Joe Drew (not getting mail)]

https://hg.mozilla.org/mozilla-central/rev/f8613cef1d54