199966 - [FIXr]renaming image referenced in css and browser crashes upon reload

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P1)

Description

[Ralf Hauser]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030331
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030331

I took Eric's demo and adapted the css as follows: 
div#content {
    position: absolute;
    color: inherit; /* http://jigsaw.w3.org/css-validator wants this */
    background: rgb(233,233,233)
      url(hands-grey.gif) 0.0cm 2.4cm no-repeat fixed;
...

Reproducible: Always

Steps to Reproduce:
1. load a page based on the css (I do that on my harddrive as file:// not http://)
2. rename hands-grey.gif to hands-grey0.gif in the file explorer
3. click on reload (a few times e.g. 3)
Actual Results:  
the browser crashes

Expected Results:  
the background image would disappear or an error would be displayed

Comment 1

[Boris Zbarsky [:bzbarsky]]

Any chance of attaching your modified HTML/CSS, with the URL to modify
clearly marked, to this bug?

Comment 2

[Ralf Hauser]

Attachment: i.html

a css and the jpg to follow

Comment 3

[Ralf Hauser]

Attachment: h.css

Comment 4

[Ralf Hauser]

Attachment: h.jpg

once you have loaded the page consisting of all three elements, rename the
h.jpg to h1.jpg and reload --> today's build of Mozilla dies

Comment 5

[Boris Zbarsky [:bzbarsky]]

Taking bug... 

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed patch

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 118987 [details] [diff] [review]
Proposed patch

So the problem is that if in LoadImage we have a cached request and this has no
validator _and_ the AsyncOpen fails (which it apparently does in this case...)
then the validator will be destroyed without ever getting an OnStartRequest
call.  The request will then be pointing to a stale mValidator and a crash will
ensue the next time we enter that codepath.

The fix is to have the imgCacheValidator destructor properly clear the
mValidator pointer on its mRequest (the other two changes are just random
cleanup).

Comment 8

[Boris Zbarsky [:bzbarsky]]

taking, even...

Comment 9

[Johnny Stenback (:jst)]

Comment on attachment 118987 [details] [diff] [review]
Proposed patch

sr=jst

Comment 10

[Stuart Parmenter]

Comment on attachment 118987 [details] [diff] [review]
Proposed patch

r=pavlov

Comment 11

[Boris Zbarsky [:bzbarsky]]

Fix checked in for 1.4b.  Thanks for the testcase, Ralf!

Comment 12

[Chris Petersen]

Verified in the 2003-04-23-03 Macho and 2003-04-22-08 Win32 trunk builds.