seen on commercial trunk builds: mac os9 2002-12-11-13-trunk mac osx 2002-12-11-13-trunk -goto test quicktime site URL Crash talkback from os9: Stack Signature free() 1a3864cf Email Address twalker@netscape.com Product ID MozillaTrunk Build ID 2002121112 Trigger Time 2002-12-11 15:22:26 Platform MacOS Operating System MacOS version 9.2.1 Module NSStdLib URL visited http://www.apple.com/trailers User Comments crash entering quicktime site Trigger Reason PowerPC unmapped memory exception Source File Name nsAllocatorManager.cp Trigger Line No. Stack Trace free() [nsAllocatorManager.cp] .__dl__FPv [CPlusPlusLevel.cp] .__dla__FPv [CPlusPlusLevel.cp] nsICODecoder::Close() [nsICODecoder.cpp, line 177] imgRequest::OnStopRequest() [imgRequest.cpp, line 672] ProxyListener::OnStopRequest() [imgLoader.cpp, line 868] nsStreamListenerTee::OnStopRequest() [nsStreamListenerTee.cpp, line 65] nsHttpChannel::OnStopRequest() [nsHttpChannel.cpp, line 3019] nsOnStopRequestEvent::HandleEvent() [nsRequestObserverProxy.cpp, line 212] nsARequestObserverEvent::HandlePLEvent() [nsRequestObserverProxy.cpp, line 115] PL_HandleEvent() [plevent.c, line 644] PL_ProcessPendingEvents() [plevent.c, line 574] nsEventQueueImpl::ProcessPendingEvents() [nsEventQueue.cpp, line 388] nsMacNSPREventQueueHandler::ProcessPLEventQueue() [nsToolkit.cpp, line 177] nsMacNSPREventQueueHandler::RepeatAction() [nsToolkit.cpp, line 142] Repeater::DoRepeaters() [nsRepeater.cpp, line 136] nsMacMessagePump::DispatchEvent() [nsMacMessagePump.cpp, line 501] nsMacMessagePump::DoMessagePump() [nsMacMessagePump.cpp, line 313] nsAppShell::Run() [nsAppShell.cpp, line 120] nsAppShellService::Run() [nsAppShellService.cpp, line 471] main1() [nsAppRunner.cpp, line 1544] main() [nsAppRunner.cpp, line 1905] .__start

Tracy : Do you still crash if you disable Edit\preferences\Appearance\[ ] Show Web Site Icons ? nsICODecoder::Close() is the Mozilla Icon Decoder

disabling Edit\preferences\Appearance\[ ] Show Web Site Icons pref works. I can goto the site and view a quicktime trailer now. reducing severity; as this is a vaild workaround.

*** Bug 184919 has been marked as a duplicate of this bug. ***

over to peter

Shouldn't this go to imagelib folks?

um....yeah, this probably isn't a plugin bug if it's crashing in imglib, -->reassign Looking at bonsai, I see timeless touched nsICODecoder.cpp in bug 108271. cc:ing him and those who reviewed and worked on that patch.

really reducing severity, workaround is disable Edit\preferences\Appearance\[ ] Show Web Site Icons

I am seeing this on windows and linux builds now with early morning builds 2002-12-12-04-trunk. Note that 12-11-04-trunk builds for linux and windows did not exhibit this problem. changing OS to all using workaround to test quicktime on all platforms.

Actually it's a favicon...

this is a duplicate. or the other bug is. let me look for it.

hm I was thinking about bug 183980 but am not really sure anymore if it is a dup... the last comment's stack is identical to this one here, though. I'll let someone else mark the dup, if desired.

The previous changes exposed a bug in the ICO decoder that used to overwrite its own alpha data but now overwrites random memory :-/

Comment on attachment 109133 [details] [diff] [review] Proposed patch no that is the wrong way to fix this bug, imho. Your patch for bug 108271 contained this change in nsICODecoder.cpp: - mCurLine = (mDirEntry.mHeight - 1); + mCurLine = mDirEntry.mHeight; Clearly, that makes mCurLine one-based instead of zero-based. but you haven't changed other parts of nsICODecoder. I would prefer it if you would undo that change and zero-base mCurLine again

Comment on attachment 109133 [details] [diff] [review] Proposed patch sigh, ok. I was convinced on IRC. if that fixes it, r=biesi

Comment on attachment 109133 [details] [diff] [review] Proposed patch sr=tor

As a side-note, I'd also prefer zero-based code.

*** Bug 185129 has been marked as a duplicate of this bug. ***

Info as requested - ref: http://www.dpreview.com/ crashes ********** Date/Time: 2002-12-12 17:30:53 -0800 OS Version: 10.2.2 (Build 6F21) Host: blighty-1.csd.sgi.com Command: Mozilla PID: 1176 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0xd3445888 Thread 0 Crashed: #0 0x0022de30 in Block_link #1 0x0022e628 in deallocate_from_var_pools #2 0x0022ec68 in _pool_free #3 0x0022ef50 in free #4 0x001e16a0 in PR_Free #5 0x002853b4 in nsVoidArray::SizeTo(int) #6 0x00286578 in nsAutoVoidArray::SizeTo(int) #7 0x00286510 in nsAutoVoidArray::Clear(void) #8 0x021b3ccc in nsHttpHeaderArray::Clear(void) #9 0x021b7b50 in nsHttpResponseHead::Reset(void) #10 0x02197f9c in 0x2197f9c #11 0x021a0a64 in nsHttpChannel::Release(void) #12 0x002fa2e4 in nsCOMPtr_base::_dt(void) #13 0x021b8b54 in nsHttpTransaction::_dt(void) #14 0x021ba5a8 in nsHttpTransaction::DeleteSelfOnConsumerThread(void) #15 0x021ba888 in nsHttpTransaction::Release(void) #16 0x002fa2e4 in nsCOMPtr_base::_dt(void) #17 0x0219452c in nsOnStopRequestEvent::_dt(void) #18 0x02193e24 in nsARequestObserverEvent::DestroyPLEvent(PLEvent *) #19 0x002d20fc in PL_DestroyEvent #20 0x002d2080 in PL_HandleEvent #21 0x002d1e9c in PL_ProcessPendingEvents #22 0x00279b3c in nsEventQueueImpl::ProcessPendingEvents(void) #23 0x0291ce8c in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void) #24 0x0291cd30 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &) #25 0x02047b14 in Repeater::DoRepeaters(EventRecord const &) #26 0x02933ab8 in nsMacMessagePump::DispatchEvent(int, EventRecord *) #27 0x029337f0 in nsMacMessagePump::DoMessagePump(void) #28 0x029330fc in nsAppShell::Run(void) #29 0x028f224c in nsAppShellService::Run(void) #30 0x001a41b4 in main1(int, char **, nsISupports *) #31 0x001a4c0c in main Thread 1: #0 0x9000566c in syscall #1 0x90515d9c in BSD_waitevent #2 0x9051576c in CarbonSelectThreadFunc #3 0x90021268 in _pthread_body Thread 2: #0 0x9003efc8 in semaphore_wait_signal_trap #1 0x9003ede4 in _pthread_cond_wait #2 0x9051dda0 in CarbonOperationThreadFunc #3 0x90021268 in _pthread_body Thread 3: #0 0x90042ba8 in semaphore_timedwait_signal_trap #1 0x9003edd4 in _pthread_cond_wait #2 0x90233438 in TSWaitOnSemaphoreCommon #3 0x9023c258 in TimerThread #4 0x90021268 in _pthread_body Thread 4: #0 0x9003efc8 in semaphore_wait_signal_trap #1 0x9003ede4 in _pthread_cond_wait #2 0x9023341c in TSWaitOnSemaphoreCommon #3 0x90248aec in AsyncFileThread(void*) #4 0x90021268 in _pthread_body Thread 5: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x901490a8 in __CFRunLoopRun #3 0x9018157c in CFRunLoopRunSpecific #4 0x901488f8 in CFRunLoopRun #5 0x0314f2c8 in -[MyCameraCentral wiringThread:] #6 0x9081cd38 in forkThreadForFunction #7 0x90021268 in _pthread_body Thread 6: #0 0x9003efc8 in semaphore_wait_signal_trap #1 0x9003ede4 in _pthread_cond_wait #2 0x90525b90 in CarbonInetOperThreadFunc #3 0x90021268 in _pthread_body Thread 7: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x928ec28c in JNI_CreateJavaVM_Impl #3 0x928ec224 in JNI_CreateJavaVM_Impl #4 0x928a51fc in JVM_GetClassMethodsCount #5 0x90021268 in _pthread_body Thread 8: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283de9c in JVM_NewInstance #3 0x9285eae4 in JVM_FillInStackTrace #4 0x928647a0 in JVM_Send #5 0x9290114c in JNI_CreateJavaVM_Impl #6 0x928a51fc in JVM_GetClassMethodsCount #7 0x90021268 in _pthread_body Thread 9: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0xa2843c38 in typeinfo name for std::bad_exception #10 0x92838bdc in JVM_CurrentTimeMillis #11 0x92878c28 in JVM_FindClassFromClass #12 0x92892c90 in JVM_IsSameClassPackage #13 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #14 0x928787a0 in JVM_FindClassFromClass #15 0x928a51fc in JVM_GetClassMethodsCount #16 0x90021268 in _pthread_body Thread 10: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x090845cc in 0x90845cc #9 0x090845cc in 0x90845cc #10 0xa2843c38 in typeinfo name for std::bad_exception #11 0x92838bdc in JVM_CurrentTimeMillis #12 0x92878c28 in JVM_FindClassFromClass #13 0x92892c90 in JVM_IsSameClassPackage #14 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #15 0x928787a0 in JVM_FindClassFromClass #16 0x928a51fc in JVM_GetClassMethodsCount #17 0x90021268 in _pthread_body Thread 11: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283de9c in JVM_NewInstance #3 0x92844e18 in JVM_GetClassLoader #4 0x92844ba4 in JVM_GetClassLoader #5 0x928a51fc in JVM_GetClassMethodsCount #6 0x90021268 in _pthread_body Thread 12: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x9285eb40 in JVM_FillInStackTrace #4 0x92903300 in JVM_InitProperties #5 0x92903138 in JVM_InitProperties #6 0x928787a0 in JVM_FindClassFromClass #7 0x928a51fc in JVM_GetClassMethodsCount #8 0x90021268 in _pthread_body Thread 13: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x9285eb40 in JVM_FillInStackTrace #4 0x9288890c in JVM_StartThread #5 0x92876c10 in JVM_FindLoadedClass #6 0x928787a0 in JVM_FindClassFromClass #7 0x928a51fc in JVM_GetClassMethodsCount #8 0x90021268 in _pthread_body Thread 14: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0x090845cc in 0x90845cc #10 0x090845cc in 0x90845cc #11 0x0908468c in 0x908468c #12 0x0908468c in 0x908468c #13 0xa2843c38 in typeinfo name for std::bad_exception #14 0x92838bdc in JVM_CurrentTimeMillis #15 0x92878c28 in JVM_FindClassFromClass #16 0x92892c90 in JVM_IsSameClassPackage #17 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #18 0x928787a0 in JVM_FindClassFromClass #19 0x928a51fc in JVM_GetClassMethodsCount #20 0x90021268 in _pthread_body Thread 15: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0xa2843c38 in typeinfo name for std::bad_exception #10 0x92838bdc in JVM_CurrentTimeMillis #11 0x92878c28 in JVM_FindClassFromClass #12 0x92892c90 in JVM_IsSameClassPackage #13 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #14 0x928787a0 in JVM_FindClassFromClass #15 0x928a51fc in JVM_GetClassMethodsCount #16 0x90021268 in _pthread_body Thread 16: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0x0908468c in 0x908468c #10 0xa2843c38 in typeinfo name for std::bad_exception #11 0x92838bdc in JVM_CurrentTimeMillis #12 0x92878c28 in JVM_FindClassFromClass #13 0x92892c90 in JVM_IsSameClassPackage #14 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #15 0x928787a0 in JVM_FindClassFromClass #16 0x928a51fc in JVM_GetClassMethodsCount #17 0x90021268 in _pthread_body Thread 17: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0x0908468c in 0x908468c #10 0xa2843c38 in typeinfo name for std::bad_exception #11 0x92838bdc in JVM_CurrentTimeMillis #12 0x92878c28 in JVM_FindClassFromClass #13 0x92892c90 in JVM_IsSameClassPackage #14 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #15 0x928787a0 in JVM_FindClassFromClass #16 0x928a51fc in JVM_GetClassMethodsCount #17 0x90021268 in _pthread_body Thread 18: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0xa2843c38 in typeinfo name for std::bad_exception #10 0x92838bdc in JVM_CurrentTimeMillis #11 0x92878c28 in JVM_FindClassFromClass #12 0x92892c90 in JVM_IsSameClassPackage #13 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #14 0x928787a0 in JVM_FindClassFromClass #15 0x928a51fc in JVM_GetClassMethodsCount #16 0x90021268 in _pthread_body Thread 19: #0 0x90074168 in mach_msg_trap #1 0x900064b0 in mach_msg #2 0x9283ddf4 in JVM_NewInstance #3 0x92845d80 in JVM_ArrayCopy #4 0x9285d620 in JVM_MonitorNotify #5 0x9285e2f8 in JVM_MonitorWait #6 0x09086668 in 0x9086668 #7 0x0908468c in 0x908468c #8 0x0908468c in 0x908468c #9 0x090845cc in 0x90845cc #10 0xa2843c38 in typeinfo name for std::bad_exception #11 0x92838bdc in JVM_CurrentTimeMillis #12 0x92878c28 in JVM_FindClassFromClass #13 0x92892c90 in JVM_IsSameClassPackage #14 0x9288cf70 in JVM_GetMethodIxExceptionTableEntry #15 0x928787a0 in JVM_FindClassFromClass #16 0x928a51fc in JVM_GetClassMethodsCount #17 0x90021268 in _pthread_body PPC Thread State: srr0: 0x0022de30 srr1: 0x0200f030 vrsave: 0x00000000 xer: 0x00000000 lr: 0x0022e628 ctr: 0x0022ef30 mq: 0x00000000 r0: 0xfffffffb r1: 0xbffff120 r2: 0x003e8000 r3: 0xc2ff69fe r4: 0x0444cb98 r5: 0xceff8cfd r6: 0xd3445888 r7: 0xceff8cf0 r8: 0x04afb558 r9: 0xa0220eac r10: 0xa0220be4 r11: 0xa00042f8 r12: 0x003e98b0 r13: 0x00000000 r14: 0x00000000 r15: 0x00000000 r16: 0x00000000 r17: 0x00000000 r18: 0x00000000 r19: 0x00000000 r20: 0xbffffe90 r21: 0x04afaa10 r22: 0x00000001 r23: 0x04afbfb0 r24: 0x003db2b8 r25: 0x021f1184 r26: 0x02038b90 r27: 0x04afbfb0 r28: 0x00000000 r29: 0x00000000 r30: 0xc2ff69fe r31: 0xc2ff69fe

*** Bug 184986 has been marked as a duplicate of this bug. ***

*** Bug 185082 has been marked as a duplicate of this bug. ***

I tried the quicktime site an had no difficulty accessing I am using the Macho build 2002121207 using OS X 10.1.5 . (Note that the Mach-o build is not yet the offical OS X build yet so the previous test on OS X was with a different browser version[CFM] for OS X.)

*** Bug 185115 has been marked as a duplicate of this bug. ***

*** Bug 184945 has been marked as a duplicate of this bug. ***

Max: That sounds like another bug to me. Neil: Do you want me to check this in? Or do you already have CVS write access?

Christian: I've found the bug 185082 that was dupped of this one. Bug 184945 and bug 185082 look identical for me. Moreover, comment #1 also cured a crash in bug 184945. I don't know internal details of the crashes but if they are different - feel free to reopen any of mentioned bugs.

>As a side-note, I'd also prefer zero-based code. If it helps, imagine mCurLine is the number of lines remaining to decode...

>If it helps, imagine mCurLine is the number of lines remaining to decode... er. maybe you should rename it, then. I didn't intend it to be used that way, when I originally wrote that code. but whatever, I need to file a cleanup bug anyway.

fixed

still seeing this with early a.m. bits. I imagine the fix was checked in after the builds ran this morning. I'll double check this with later builds today.

verified with mac builds that were started after 7:00 this morning

Christian Biesinger wrote : > Max: That sounds like another bug to me. ok, perhaps someone could un-dupe the bug (185129) I logged then.... thanks. Max.

*** Bug 185227 has been marked as a duplicate of this bug. ***

*** Bug 185109 has been marked as a duplicate of this bug. ***

*** Bug 185129 has been marked as a duplicate of this bug. ***

*** Bug 185064 has been marked as a duplicate of this bug. ***

*** Bug 185196 has been marked as a duplicate of this bug. ***

Since 185196 has been marked as a dup of this, and occurred in today's build, this obviously has not been fixed!

WFM with 2002121308/win2k. James - exactly which build today do you see this with? it appears in the earlier builds from today, but shouldn't appear in the later ones.

-> fixed (only reopen if you are sure that you have a build with a patch) Please reopen your bug if you see this with 20021214..

2002121204 had it. 121308 didn't so I agree it is fixed.

*** Bug 185078 has been marked as a duplicate of this bug. ***

*** Bug 185381 has been marked as a duplicate of this bug. ***

*** Bug 185407 has been marked as a duplicate of this bug. ***

*** Bug 185187 has been marked as a duplicate of this bug. ***

*** Bug 184955 has been marked as a duplicate of this bug. ***

*** Bug 185042 has been marked as a duplicate of this bug. ***

*** Bug 185542 has been marked as a duplicate of this bug. ***

*** Bug 185256 has been marked as a duplicate of this bug. ***

*** Bug 185320 has been marked as a duplicate of this bug. ***

*** Bug 185961 has been marked as a duplicate of this bug. ***

*** Bug 183536 has been marked as a duplicate of this bug. ***

*** Bug 183980 has been marked as a duplicate of this bug. ***

still WFM 2003041009/win2k, no new reports. verified.

unfortunately I have no idea whether this is the icon that triggered this bug