803121 - crash in imgRequestProxy::GetStatusTracker

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Josh Matthews [:jdm]]

This bug was filed from the Socorro interface and is 
report bp-f8778e4f-8149-4ef0-920a-545ad2121017 .
============================================================= 

The imgRequestProxy destructor uses GetImage, and imgRequestProxyStatic doesn't override this, so we end up doing a null-deref since mOwner is null for static requests.

Comment 1

[Josh Matthews [:jdm]]

https://crash-stats.mozilla.com/report/list?range_value=7&range_unit=days&date=2012-10-18&signature=imgRequestProxy%3A%3AGetStatusTracker%28%29&version=Firefox%3A19.0a1

Comment 2

[Josh Matthews [:jdm]]

I was wrong; we're using virtual functions in imgRequestProxyStatic from ~imgRequestProxy, and that's Very Bad.

Comment 3

[Josh Matthews [:jdm]]

Attachment: Avoid using virtual functions in imgRequestProxy's destructor.

Comment 4

[Joe Drew (not getting mail)]

Comment on attachment 673371 [details] [diff] [review]
Avoid using virtual functions in imgRequestProxy's destructor.

Review of attachment 673371 [details] [diff] [review]:
-----------------------------------------------------------------

It doesn't make me dance, except for the spelling, but I also don't have any great suggestions for you.

::: image/src/imgRequestProxy.cpp
@@ +24,5 @@
>  #include "nspr.h"
>  
>  using namespace mozilla::image;
>  
> +class ProxyBehaviour

These classes deserve explanatory comments

Comment 5

[Josh Matthews [:jdm]]

Whoops, forgot about this. I'll land this expediently.

Comment 6

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3216284b25b5

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3216284b25b5