801701 - crash in imgStatusTrackerObserver::OnStartDecode

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Scoobidiver (away)]

It first appeared or started spiking in 19.0a1/20121014. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=90857937b601&tochange=57304bbf9c0e
It's likely a regression from bug 505385.

Signature 	imgStatusTrackerObserver::OnStartDecode() More Reports Search
UUID	9ad0b5c1-9d6e-40ae-823e-97c3d2121015
Date Processed	2012-10-15 15:47:33
Uptime	1673
Last Crash	1.3 days before submission
Install Age	40.6 minutes since version was first installed.
Install Time	2012-10-15 15:06:51
Product	Firefox
Version	19.0a1
Build ID	20121014030627
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x29281eb4
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 04941028, AdapterDriverVersion: 8.15.10.2418
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0126
Total Virtual Memory	4294836224
Available Virtual Memory	3295420416
System Memory Use Percentage	53
Available Page File	5872615424
Available Physical Memory	1925521408

Frame 	Module 	Signature 	Source
0 	xul.dll 	imgStatusTrackerObserver::OnStartDecode 	image/src/imgStatusTracker.cpp:63
1 	xul.dll 	mozilla::image::RasterImage::InitDecoder 	image/src/RasterImage.cpp:2385
2 	xul.dll 	mozilla::image::RasterImage::RequestDecodeCore 	image/src/RasterImage.cpp:2595
3 	xul.dll 	mozilla::image::RasterImage::RequestDecode 	image/src/RasterImage.cpp:2528
4 	xul.dll 	imgRequest::RequestDecode 	image/src/imgRequest.cpp:452
5 	xul.dll 	imgRequestProxy::RequestDecode 	image/src/imgRequestProxy.cpp:320
6 	xul.dll 	LockEnumerator 	content/base/src/nsDocument.cpp:8531
7 	xul.dll 	nsBaseHashtable<nsPtrHashKey<imgIRequest>,unsigned int,unsigned int>::s_EnumRead 	obj-firefox/dist/include/nsBaseHashtable.h:400
8 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.cpp:716
9 	xul.dll 	nsDocument::SetImageLockingState 	content/base/src/nsDocument.cpp:8559
10 	xul.dll 	PresShell::SetIsActive 	layout/base/nsPresShell.cpp:8955
11 	xul.dll 	nsDocShell::SetIsActive 	docshell/base/nsDocShell.cpp:5185
12 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
13 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2408
14 	xul.dll 	XPCWrappedNative::SetAttribute 	js/xpconnect/src/xpcprivate.h:2857
15 	xul.dll 	XPC_WN_GetterSetter 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1528
16 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
17 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:411
18 	mozjs.dll 	js::Shape::set 	js/src/jsscopeinlines.h:313
19 	mozjs.dll 	js::baseops::SetPropertyHelper 	js/src/jsobj.cpp:4694
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=imgStatusTrackerObserver%3A%3AOnStartDecode%28%29
https://crash-stats.mozilla.com/report/list?signature=imgRequestProxy%3A%3ABlockOnload%28%29
https://crash-stats.mozilla.com/report/list?signature=imgRequest%3A%3AResetCacheEntry%28%29

Comment 1

[Josh Matthews [:jdm]]

Attachment: Fix references to non-existent requests in status trackers for extracted frames.

I haven't been able to reproduce the crash yet, but this is my best guess.

Comment 2

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5ced91531316

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/5ced91531316

Comment 4

[Scoobidiver (away)]

It's not fixed, at least not fully.

Comment 5

[Josh Matthews [:jdm]]

From the stacks, the remaining crashes have a different cause. I'll open a new bug to handle those.