990082 - crash in nsWindowGfx::CreateIcon(imgIContainer*, bool, unsigned int, unsigned int, nsIntSize, HICON__**)

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Liz Henry (:lizzard) (relman/hg->git project)]

This bug was filed from the Socorro interface and is 
report bp-c7d6cc33-4b21-40d3-b77e-bba652140330.
=============================================================

This is the #2 topcrasher for Firefox 31, with 271 out of 4290 crashes in the last week. There are crashes for the 2014033003 build. I haven't looked to find a regression range yet.

Comment 1

[(Away)]

jwatt does anything stand out to you?

http://hg.mozilla.org/mozilla-central/annotate/382f676d0ed9/widget/windows/nsWindowGfx.cpp#l693

I *think* it's a null dataSource if I'm reading the disassembly properly.

Comment 2

[u279076]

I'm adding QAWANTED to this bug to see if we can reproduce. Paul, can you please take a crack at this?

There's only one useful comment here so far:
"I scroll down using mouse 3, (push), and the screen flashes black (not just firefox, but my entire monitor). That happenes very frequently, but never crashes. It only crashes when I mouse 3 a link, boom, crash. Hope this helps!"

Stack:
0 	xul.dll 	nsWindowGfx::CreateIcon(imgIContainer *,bool,unsigned int,unsigned int,nsIntSize,HICON__ * *) 	widget/windows/nsWindowGfx.cpp
1 	xul.dll 	mozilla::widget::TaskbarTabPreview::SetIcon(imgIContainer *) 	widget/windows/TaskbarTabPreview.cpp
2 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
3 	xul.dll 	XPC_WN_GetterSetter(JSContext *,unsigned int,JS::Value *) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
4 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
5 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value const *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
6 	mozjs.dll 	js::Shape::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,bool,JS::MutableHandle<JS::Value>) 	js/src/vm/Shape-inl.h
7 	mozjs.dll 	js::NativeSet<0>(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<js::Shape *>,bool,JS::MutableHandle<JS::Value>) 	js/src/jsobj.cpp
8 	mozjs.dll 	js::baseops::SetPropertyHelper<0>(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<jsid>,unsigned int,JS::MutableHandle<JS::Value>,bool) 	js/src/jsobj.cpp
9 	mozjs.dll 	SetPropertyOperation 	js/src/vm/Interpreter.cpp
10 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
11 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
12 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
13 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value const *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
14 	mozjs.dll 	js::CrossCompartmentWrapper::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) 	js/src/jswrapper.cpp
15 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
16 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
17 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
18 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
19 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value const *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
20 	mozjs.dll 	JS_CallFunctionValue(JSContext *,JS::Handle<JSObject *>,JS::Handle<JS::Value>,JS::HandleValueArray const &,JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
21 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS *,unsigned short,XPTMethodDescriptor const *,nsXPTCMiniVariant *) 	js/xpconnect/src/XPCWrappedJSClass.cpp
22 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const *,nsXPTCMiniVariant *) 	js/xpconnect/src/XPCWrappedJS.cpp
23 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp
24 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp
25 	xul.dll 	nsSimpleStreamListener::OnStopRequest(nsIRequest *,nsISupports *,tag_nsresult) 	netwerk/base/src/nsSimpleStreamListener.cpp

The URL reported was Facebook. David, is it worth trying to reach out to this user?

Comment 3

[Jonathan Watt [:jwatt]]

(In reply to David Major [:dmajor] (UTC+12) from comment #1)
> jwatt does anything stand out to you?
> 
> http://hg.mozilla.org/mozilla-central/annotate/382f676d0ed9/widget/windows/
> nsWindowGfx.cpp#l693
> 
> I *think* it's a null dataSource if I'm reading the disassembly properly.

Indeed. Pushed trivial fix:

https://hg.mozilla.org/integration/mozilla-inbound/rev/8494153485ee

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8494153485ee

Comment 5

[Paul Silaghi, QA [:pauly]]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #2)
> There's only one useful comment here so far:
> "I scroll down using mouse 3, (push), and the screen flashes black (not just
> firefox, but my entire monitor). That happenes very frequently, but never
> crashes. It only crashes when I mouse 3 a link, boom, crash. Hope this
> helps!"
I've tried several scenarios with scrolling and clicking with mouse 3 button on facebook.com and 9gag.com, but I didn't get any crash so far.
31.0a1 (2014-04-06), win 7 x64.

Comment 6

[u279076]

Thanks for trying to reproduce this Paul. We'll have to rely on crashstats to determine if this is fixed. I will take this to check in a few days.

Comment 7

[Tracy Walker [:tracy]]

There are no instances of this crash on Nightly for the past week. But this is has risen to #9 on Fx30. So we'll need the fix uplifted there.  Jonathan, please file that request, thanks.

Comment 8

[Jonathan Watt [:jwatt]]

Attachment: patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 979853
User impact if declined: topcrash
Testing completed (on m-c, etc.): been on m-c for days
Risk to taking this patch (and alternatives if risky): very, very low risk
String or IDL/UUID changes made by this patch: none

Trivial fix.

Comment 9

[Tracy Walker [:tracy]]

Sylvestre, can we get uplift approval for this trivial fix. The crash has been verified eliminated on Nightly(31). However, at this time it is a top 10 crasher on Aurora(30).  Thanks.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8406195 [details] [diff] [review]
patch

With pleasure!

Comment 11

[Jonathan Watt [:jwatt]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/0fa9873c2881