Closed Bug 905010 Opened 11 years ago Closed 11 years ago

crash when viewing pdf using built-in pdf viewer

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 903722

People

(Reporter: glob, Unassigned)

References

(
URL
)

Details

(Keywords: crash, reproducible)

Attachments

(1 file)

All thread gdb stack trace with correct symbols
30.32 KB, text/plain
Details
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:26.0) Gecko/20100101 Firefox/26.0 i crash when viewing this pdf using built-in pdf viewer: http://www.perthairport.com.au/T1%20car%20park%20location%20map.pdf no about:crashes entry. Assertion failed: (s->stack->next != NULL), function CGGStackRestore, file Context/CGGStack.c, line 77. assuming i've driven gdb correctly, the stack trace is: #0 0x00007fff8e2e9212 in __pthread_kill () #1 0x00007fff92260b54 in pthread_kill () #2 0x00007fff922a4dce in abort () #3 0x00007fff922a5e2a in __assert_rtn () #4 0x00007fff8f0b6e48 in CGGStackRestore () #5 0x00007fff8f0b6d8e in CGContextRestoreGState () #6 0x00000001019044cb in imgLoader::SupportImageWithMimeType () #7 0x000000010290de71 in mac_plugin_interposing_child_OnShowCursor () #8 0x0000000102907021 in mac_plugin_interposing_child_OnShowCursor () #9 0x0000000103571071 in JS_DefineDebuggerObject () #10 0x000000010356a9fd in JS_DefineDebuggerObject () #11 0x000000010356718e in JS_DefineDebuggerObject () #12 0x00000001035605b2 in JS_DefineDebuggerObject () #13 0x000000010356aa10 in JS_DefineDebuggerObject () #14 0x00000001037087ca in js::IsInRequest () #15 0x0000000103571071 in JS_DefineDebuggerObject () #16 0x000000010356a9fd in JS_DefineDebuggerObject () #17 0x000000010356b154 in JS_DefineDebuggerObject () #18 0x000000010387bfca in js::DeadObjectProxy::~DeadObjectProxy () #19 0x00000001054ef1dc in ?? () #20 0x000000016c309848 in ?? () #21 0x00000001054e5eaf in ?? () #22 0x000000010389ed6b in js::DeadObjectProxy::~DeadObjectProxy () #23 0x000000010389f1fe in js::DeadObjectProxy::~DeadObjectProxy () #24 0x00000001035696cf in JS_DefineDebuggerObject () #25 0x00000001035605b2 in JS_DefineDebuggerObject () #26 0x000000010356aa10 in JS_DefineDebuggerObject () #27 0x00000001037094f6 in js::IsInRequest () #28 0x0000000103571071 in JS_DefineDebuggerObject () #29 0x000000010356a9fd in JS_DefineDebuggerObject () #30 0x000000010356718e in JS_DefineDebuggerObject () #31 0x00000001035605b2 in JS_DefineDebuggerObject () #32 0x000000010356aa10 in JS_DefineDebuggerObject () #33 0x0000000103707af3 in js::IsInRequest () #34 0x000000011a7a7e16 in ?? () #35 0x00000001663a1a50 in ?? () #36 0x00000001054e5eaf in ?? () #37 0x000000010389ed6b in js::DeadObjectProxy::~DeadObjectProxy () #38 0x000000010389eb1d in js::DeadObjectProxy::~DeadObjectProxy () #39 0x0000000103560582 in JS_DefineDebuggerObject () #40 0x000000010356aa10 in JS_DefineDebuggerObject () #41 0x000000010356b154 in JS_DefineDebuggerObject () #42 0x00000001036a3d6c in JS_CallFunctionValue () #43 0x0000000101d9f1d5 in js::BaseProxyHandler::finalizeInBackground () #44 0x000000010297947e in mac_plugin_interposing_child_OnShowCursor () #45 0x0000000102978e91 in mac_plugin_interposing_child_OnShowCursor () #46 0x0000000103571071 in JS_DefineDebuggerObject () #47 0x000000010356a9fd in JS_DefineDebuggerObject () #48 0x000000010356b154 in JS_DefineDebuggerObject () #49 0x00000001036a39f8 in JS_CallFunctionName () #50 0x0000000101da1822 in js::BaseProxyHandler::finalizeInBackground () #51 0x0000000101dc4e49 in js::BaseProxyHandler::finalizeInBackground () #52 0x0000000101db85be in js::BaseProxyHandler::finalizeInBackground () #53 0x0000000102d45f9e in XRE_AddJarManifestLocation () #54 0x0000000102ce11ec in mac_plugin_interposing_child_OnShowCursor () #55 0x000000010261f9f7 in JSD_GetValueForObject () #56 0x00000001025bbddf in JSD_GetValueForObject () #57 0x00007fff9185bb31 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ () #58 0x00007fff9185b455 in __CFRunLoopDoSources0 () #59 0x00007fff9187e7f5 in __CFRunLoopRun () #60 0x00007fff9187e0e2 in CFRunLoopRunSpecific () #61 0x00007fff8d442eb4 in RunCurrentEventLoopInMode () #62 0x00007fff8d442c52 in ReceiveNextEventCommon () #63 0x00007fff8d442ae3 in BlockUntilNextEventMatchingListInMode () #64 0x00007fff94096563 in _DPSNextEvent () #65 0x00007fff94095e22 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #66 0x00000001025bae56 in JSD_GetValueForObject () #67 0x00007fff9408d1d3 in -[NSApplication run] () #68 0x00000001025bc41e in JSD_GetValueForObject () #69 0x000000010233fe52 in XRE_StartupTimelineRecord () #70 0x000000010100f89e in XRE_InitCommandLine () #71 0x000000010100fee5 in XRE_InitCommandLine () #72 0x000000010101028e in XRE_main () #73 0x00000001000022ac in start ()
Severity: normal → critical
Component: Untriaged → General
Product: Firefox → Core
Version: unspecified → Trunk
The symbols in your stack trace make no sense, and so look spurious. You appear to have tested with a mozilla-central debug nightly. Please try again with a recent m-c "regular" nightly. I *know* those don't have their symbols stripped.
I can also reproduce these crashes, testing with today's "regular" mozilla-central nightly on OS X 10.8.4, and with a clean profile. Here's a gdb all-thread stack trace.
Even my stack is missing a few elements. The crashes appear to actually be happening here: https://hg.mozilla.org/mozilla-central/annotate/4930fdea3efa/gfx/2d/DrawTargetCG.cpp#l1423 On that basis I'll tentatively assign this to Core : Graphics.
Component: General → Graphics
Duplicate of bug 903722?
> Duplicate of bug 903722? Sure sounds like it.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: