854140 - crash in imgFrame::ImageUpdated @ mozilla::gfx::BaseRect

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect)

Description

[Scoobidiver (away)]

It first showed up in 22.0a1/20130322. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d6fe70c79c5&tochange=0e9badd3cf39
It's likely a regression from bug 716140.

Signature 	mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>::Union(nsIntRect const&) More Reports Search
UUID	1354b645-f69c-4448-8665-d5b742130323
Date Processed	2013-03-23 15:57:01
Uptime	28
Last Crash	18.7 hours before submission
Install Age	1.3 hours since version was first installed.
Install Time	2013-03-23 14:39:25
Product	Firefox
Version	22.0a1
Build ID	20130323031040
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x28
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0e22, AdapterSubsysID: 0865196e, AdapterDriverVersion: 9.18.13.1407
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor07.phx1.mozilla.com_3838:2008
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x0e22
Total Virtual Memory	2147352576
Available Virtual Memory	1718398976
System Memory Use Percentage	38
Available Page File	6043475968
Available Physical Memory	2322919424

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::gfx::BaseRect<int,nsIntRect,nsIntPoint,nsIntSize,nsIntMargin>::Union 	obj-firefox/dist/include/mozilla/gfx/BaseRect.h:119
1 	xul.dll 	imgFrame::ImageUpdated 	image/src/imgFrame.cpp:532
2 	xul.dll 	mozilla::image::Decoder::PostInvalidation 	image/src/Decoder.cpp:353
3 	xul.dll 	mozilla::image::nsPNGDecoder::EndImageFrame 	image/decoders/nsPNGDecoder.cpp:189
4 	xul.dll 	mozilla::image::nsPNGDecoder::end_callback 	image/decoders/nsPNGDecoder.cpp:865
5 	gkmedias.dll 	MOZ_PNG_push_read_chunk 	media/libpng/pngpread.c:358
6 	gkmedias.dll 	MOZ_PNG_process_data 	media/libpng/pngpread.c:40
7 	xul.dll 	mozilla::image::nsPNGDecoder::WriteInternal 	image/decoders/nsPNGDecoder.cpp:346
8 	xul.dll 	mozilla::image::Decoder::Write 	image/src/Decoder.cpp:110
9 	xul.dll 	mozilla::image::RasterImage::WriteToDecoder 	image/src/RasterImage.cpp:2697
10 	xul.dll 	mozilla::image::RasterImage::AddSourceData 	image/src/RasterImage.cpp:1714
11 	xul.dll 	mozilla::image::RasterImage::WriteToRasterImage 	image/src/RasterImage.cpp:3350
12 	xul.dll 	nsPipeInputStream::ReadSegments 	xpcom/io/nsPipe3.cpp:775
13 	xul.dll 	mozilla::image::RasterImage::OnImageDataAvailable 	image/src/RasterImage.cpp:1865
14 	xul.dll 	imgRequest::OnDataAvailable 	image/src/imgRequest.cpp:802
15 	xul.dll 	ProxyListener::OnDataAvailable 	image/src/imgLoader.cpp:2147
16 	xul.dll 	nsJARChannel::OnDataAvailable 	modules/libjar/nsJARChannel.cpp:1012
17 	xul.dll 	nsInputStreamPump::OnStateTransfer 	netwerk/base/src/nsInputStreamPump.cpp:484
18 	xul.dll 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:372
19 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:82
20 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
21 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
22 	xul.dll 	nsThread::Shutdown 	xpcom/threads/nsThread.cpp:474
23 	xul.dll 	nsRunnableMethodImpl<tag_nsresult 	obj-firefox/dist/include/nsThreadUtils.h:367
24 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
25 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
26 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
27 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:209
28 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:183
29 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
30 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:161
31 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:288
32 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3880
33 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3947
34 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4161
35 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:228
36 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ABaseRect%3Cint%2C+nsIntRect%2C+nsIntPoint%2C+nsIntSize%2C+nsIntMargin%3E%3A%3AUnion%28nsIntRect+const%26%29

Comment 1

[Joe Drew (not getting mail)]

This might get fixed by accident by the patch in bug 853337, since it no longer nulls out mCurrentFrame. It's also possible (though not likely) that bug 853356 would have an effect on this crash.

Anyways, we should keep our eyes on it.

Comment 2

[Scoobidiver (away)]

There have been no crashes since 22.0a1/20130324. The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3825fdbcec62&tochange=0a10eca0c521