99569 - M094, N620 & Trunk crash cancelling plugin [@ nsPluginInstanceOwner::GetTagType][@ 0x0ee8ce8b - nsAString::do_AssignFromElementPtr][@ 0x00000009 be877c8b - nsPluginInstanceOwner::GetTagType][@ 0x00000001 - nsPluginHostImpl::InstantiateEmbededPlugin]

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P3)

Description

[Aleka]

always reproducable on my machine, just by typing the URL mentioned above.

It's got to do with the banner at the top of the page, and the plugin missing
(on my host) to dispay it. I don't even know the plugin type.

I tried loading that page about 6 times. Only in one of those attempts mozilla
didn't pop-up the window instructing to get the missing plugin. That was also
the only time mozilla didn't crash immediately. However, when I clicked on the
banner holder (which was empty -just displayed the missing plugin icon), the
mozilla window asking to get the missing plugin poped-up, and mozilla crashed
once again.

www.in.gr is one of the two Greek sites receing the highest traffic. The crash
may disappear when they change the banner at their front page -I don't know.

Comment 1

[Aleka]

I've sent 4 talkback incidents on this crash. The IDs are:
TB35362819G
TB35362822Q
TB35363172M
TB35363781H

Comment 2

[Warner Young]

It also crashed for me on Win98.

Comment 3

[Aleka]

No longer crashes - Friday morning, PDT.
The banner has changed so there's no way to reproduce it.
The only leads you can get now are from the talkback reports.

Comment 4

[shrirang khanzode]

I can still crash on my NT 0917 branch:

Stack Trace
0x0ee8ce8b
nsAString::do_AssignFromElementPtr 
[d:\builds\seamonkey\mozilla\string\src\nsAString.cpp, line 263]
nsPluginInstanceOwner::GetTagType 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 2233]
nsPluginHostImpl::InstantiateEmbededPlugin 
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp, line 
3087]
nsPluginStreamListenerPeer::OnStartRequest 
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp, line 
1837]
nsHttpChannel::ProcessNormal 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
472]
nsHttpChannel::ProcessResponse 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
442]
nsHttpChannel::OnStartRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
2151]
nsOnStartRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 
111]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 
1072] 

Comment 5

[av (gone)]

The Flash instantiation code for the banner is generated by some js script. I 
was lucky to intercept the resulting html code. Attaching.

Comment 6

[av (gone)]

Attachment: the html code which causes the crash

Comment 7

[av (gone)]

Please note the absence of spaces between argument in the <embed> and <object> 
tags. It looks like this:

HEIGHT=60QUALITY="high"MENU="false"TYPE="application/x-shockwave-flash"PLUG...

If it is corrected the page loads fine.

Comment 8

[av (gone)]

Attachment: corrected html code, spaces added

Comment 9

[av (gone)]

Althoug all my last comments are still stand true, it may give a false lead. If 
I put break points in nsObjectFrame::Init, nsObjectFrame::Destroy and 
nsPluginInstanceOwner::GetTagType (its member mOwner which is nsObjectFrame 
object is accessed here), I see that several object frames are created and 
destroyed during the page load, and mOwner is accessed in GetTagType in between. 
At one point mOwner reffers to an object frame which has just been destroyed, 
and thus crash.

The questions to answer are:
Why does the frame get reflown several times? Why does inserting spaces into 
html fix the problem?

Comment 10

[Peter Lubczynski]

*** Bug 100313 has been marked as a duplicate of this bug. ***

Comment 11

[Peter Lubczynski]

Here's more Talkback data from bug 100313:

Talkback data for M094 and N620 are both showing crashes at
nsPluginInstanceOwner::GetTagType. (Most are on Win98 and NT, but three Linux
users have been able to crash the M094 build.)
   
         nsPluginInstanceOwner::GetTagType
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 2233]
         nsPluginHostImpl::InstantiateEmbededPlugin
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
3087]
         nsPluginStreamListenerPeer::OnStartRequest
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
1837]
         nsHttpChannel::ProcessNormal
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 472]
         nsHttpChannel::ProcessResponse
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 442]
         nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2151]
         nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 111]
         PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c 
line 591]
         PL_ProcessPendingEvents       
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line
524]
         _md_EventReceiverProc 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
         KERNEL32.DLL + 0x24407 (0xbff94407)
         0x00688b62
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsObjectFrame.cpp
line :
2233

N620 comments:
--------------
     (35251919) Comments: cancelling the plug-in
     (35249449) URL: http://abcnews.com
(35249449) Comments: attempting to load real video of abcnews coverage on
the attack on theworld trade center 


M094 crash comments:
--------------------
Comments: I was browsing three sites: the poll in http://members.xoom.it/V_2k/
the cart on www.overclockmania.net  and the "confirm registration" page on
SourceForge.
     (35486390) Comments: I did nothing ;)  well I don't know  because I was not
present at the terminal.
     (35482557) URL: http://www.heise.de/tp/
(35482557) Comments: nothing.... clicking on a link.
     (35472344) URL: http://www.allfunnypictures.com/pictures.htm
(35472344) Comments: It was loading the page and crashed.
     (35456286) URL: http://gamesweb.com/pc/downloads/
(35456286) Comments: reproducable!
     (35456280) URL: http://gamesweb.com/pc/downloads/
(35456280) Comments: reproducable!
     (35445018) URL: http://www.fileplanet.com
(35430183) URL: www.adequacy.org
     (35430183) Comments: Using the 'back' button to navigate to the home page
from an article. (Linux)
     (35402190) URL: http://www.abcnews.com/
(35402190) Comments: Opened audio feed.  ABC news opened seperate window. 
Closed window before it completely loaded.

Comment 12

[Cindy Roberts]

This isn't crashing for me (using the 9/24 Netscape commercial build Win98 on
http://www.in.gr).  There aren't any comments on this bug since the 18th of
Sept.  If this is affecting many top sites, we'd like to see if we can fix in
the next Netscape commercial release.  However, we only have a few days left to
do so.  Can QA regess against the Netscape commercial builds and determine if
this is still a valid bug?  If so, and we can get fixes/reviews in the next day
or two, please mark as nsbranch+.

Comment 13

[Jay Patel [:jay]]

Here's the most recent crash on the M094/N620 branch:

nsPluginInstanceOwner::GetTagType 52a2be29
	http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsObjectFrame.cpp line 2233
	Build: 2001091405 CrashDate: 2001-09-15 UptimeMinutes: 9  Total: 9 
	OS: Windows 98  4.10 build 67766446
	 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=35412715
StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=35412715


And this continues to be a topcrasher for Mozilla 0.9.4:

nsPluginInstanceOwner::GetTagType   66
BBID range: 35402190 - 35793472
Min/Max Seconds since last crash: 76 - 262784
Min/Max Runtime: 333 - 565094
Crash data range: 2001-09-14 to 2001-09-23
Build ID range: 2001091311 to 2001091311

     (35779469)	URL: x.theemes.org
     (35779469)	Comments: multiple windows open
     (35760399)	Comments: Something about downloading a QuickTime plug-in. In order to view
the web page I had to download a QuickTime plug-in  but I didn't want to and
pressed back. Or something...
     (35708703)	URL: http://www.vilani.com/
(35708703)
Comments: Mozilla was opening the web site
     (35679045)	Comments: crash using back-forward buttons  flash loading on each page could
be somehow involved  once the flash source itself (file content) was displayed
instead of rendered as flash
     (35673945)	URL: http://www.snopes.com/
(35673887)
URL: http://www.snopes.com/
(35651836)
Comments: Opening a URL from ICQ message.2 browser windows always open... both
load the page but the first window has a blank address field.
     (35563996)	URL: www.nikita.org / www.plycon.com
(35563996)
Comments: Just closed window on nikita.org and browsing Plycon when 'invalid
page fault' in gklayout.dll.  I'd also been playing with alternate themes the
night before...
     (35556846)	Comments: Listening to a wav file via quicktime plugin
     (35532345)	Comments: just surfing  since 0.9.4 since is generally  much slower than
with 0.9.3
     (35513781)	URL: www.kmelektronik.de
(35490240)
Comments: I was browsing three sites: the poll in http://members.xoom.it/V_2k/
the cart on www.overclockmania.net and the "confirm registration" page on
SourceForge.


And is also a topcrasher on the MozillaTrunk:

nsPluginInstanceOwner::GetTagType   7
BBID range: 35456321 - 35784698
Min/Max Seconds since last crash: 32 - 110294
Min/Max Runtime: 9355 - 110304
Crash data range: 2001-09-16 to 2001-09-23
Build ID range: 2001091409 to 2001092210
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsObjectFrame.cpp
line : 2419
     (35670759)	URL: bbs.pcstats.com/viahardware
     (35670759)	Comments: hitting a link before page loaded fully
     (35491849)	URL: http://forums.winamp.com/
(35491849)
Comments: I had several browsers opened.  I was viewing a picture in one of them
 and reading forums in several others.  I clicked a link and got the error
message from Win2k.

Comment 14

[shrirang khanzode]

i am still crashing using 0920 branch using andrei's attachment. with the same 
stack trace I mentioned earlier which is :
nsAString::do_AssignFromElementPtr 
[d:\builds\seamonkey\mozilla\string\src\nsAString.cpp, line 263]
nsPluginInstanceOwner::GetTagType 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 2233]
nsPluginHostImpl::InstantiateEmbededPlugin 
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp, line 
3087]
nsPluginStreamListenerPeer::OnStartRequest 
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp, line 
1837]
nsHttpChannel::ProcessNormal 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
472]
nsHttpChannel::ProcessResponse 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
442]
nsHttpChannel::OnStartRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
2151]
nsOnStartRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 
111]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 
1072] 

Comment 15

[av (gone)]

To reproduce this bug consisntently, do not use www.in.gr, as it does not always 
generate the problematic code. Use attachement 49652 -- saved html code from the 
very same site.

Comment 16

[Jay Patel [:jay]]

From Shrirang's comments, I looked up the 0x0ee8ce8b stack signature, and it is
a topcrasher for Mozilla 0.9.4 as well...and there are a few incidents on the
latest N620 branch too.  Here is the data from Talkback:

0x0ee8ce8b   42 
BBID range: 35418798 - 35835126
Min/Max Seconds since last crash: 34 - 162591
Min/Max Runtime: 105 - 500618
Crash data range: 2001-09-15 to 2001-09-24
Build ID range: 2001091311 to 2001091311

Stack Trace: 

	 0x0ee8ce8b
	 nsAString::do_AssignFromElementPtr
[d:\builds\seamonkey\mozilla\string\src\nsAString.cpp  line 263]
	 nsPluginInstanceOwner::GetTagType
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 2233]
	 nsPluginHostImpl::InstantiateEmbededPlugin
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
3087]
	 nsPluginStreamListenerPeer::OnStartRequest
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
1837]
	 nsHttpChannel::ProcessNormal
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 472]
	 nsHttpChannel::ProcessResponse
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 442]
	 nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2151]
	 nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 111]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 453]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1276]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1593]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1611]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x17d08 (0x77e97d08)     (35835126)	URL: http://www.in.gr
(35818861)
URL: http://www.doom2.org
(35818861)
Comments: visiting that site. happens every time.
     (35816756)	URL: www.ebay.co.uk
(35773783)
Comments: This page consistently crashes
     (35773350)	URL: www.in.gr
(35773350)
Comments: I went to www.in.gr I selected something from the news articles it has
in the middle column  I read it and then I pressed the Back button and the
Mozilla crashed
     (35756733)	URL: http://free.freespeech.org/shatner/
(35756733)
Comments: Crashed on loading page.
     (35682027)	URL: http://www.msn.co.kr/
(35682027)
Comments: It can't read a memory address!The command had refered the
self-address and crashed.
     (35677338)	URL: www.amdforums.com
(35677338)
Comments: Mozilla 0.9.4 with the 'Modern' theme also crashes on this page.
     (35677262)	Comments: had a bunch of windows open. Tried to open another one.
     (35677216)	URL: www.amdforums.com
(35677216)
Comments: mozilla 0.9.4  without the tabbed interface (only the littlemozilla
theme)  crashed approximately the same as before. I will retry after applying
the 'modern' theme. (If I don't send a third feedback  then it was the
littlemozilla theme).  
     (35676439)	URL: amdmb.com
     (35676439)	Comments: mozilla 0.9.4 with (1) littlemozilla theme and (2) the multiview 
tabbed interface installed and active. While attempting to display the list of
discussion threads page ('forum') on amdmb.com  the application crashed.
     (35599496)	Comments: Unknown Win32 exception occuring frequently while browsing.
     (35517506)	URL: http://www.in.gr
(35496172)
URL: www.in.gr
(35496172)
Comments: Just browsing
     (35484871)	Comments: loaded a page with a midi file
     (35450268)	URL: www.weather.com
(35450268)
Comments: loaded weather.com like normal. it told me it couldn't find the
plugin-finder plugin  and died.
     (35446604)	URL: www.kurtcagle.net
(35445734)
URL: www.kurtcagle.net
(35445734)
Comments: opening web page (an xsl site)
     (35433415)	URL: http://kickme.to/thepivotpoint
(35433415)
Comments: After the page loaded  I switched to my other open mozilla window
(http://pub22.ezboard.com/bhomeoftheunderdogs)  and the program crashed.

Comment 17

[Peter Lubczynski]

Attachment: patch to fix crash

Comment 18

[Peter Lubczynski]

This page has more than one problem. It looks like the "flashing" (and the
Reflows() Andrei was wondering about) is caused by a re-frame. That is another bug.

I think I figured out the plugin problem and crash here: the object frame was
going away but not the instance owner because it was addref'ed by the stream. 

I fixed this by breaking the link the instance owner has to the object frame
when nsPluginInstanceOwner::Destroy() is called. Since it's supposed to be
destroyed at this point anyway, this should not hurt anything. That fixes the
crash in GetTagType() because it already does check for a null object frame (as
opposed to a stale pointer). 

Once step further using this fix, I found that the default plugin would
incorrectly be placed because of the error now being returned by GetTagType().
We should really not do anything and abort the stream if our object frame got
destroyed. So, after Necko first calls us in
nsPluginStreamListenerPeer::OnStartRequest(), I added a sanity check for a
missing object frame by using the same technique in GetTagType(). 
The Flash on this page now seems to work and there is no crash. I'm seeking
reviews for my patch.

Comment 19

[Peter Lubczynski]

*** Bug 101792 has been marked as a duplicate of this bug. ***

Comment 20

[Phil Schwartau]

cc'ing [e-mail], who discovered bug 101792.

Comment 21

[av (gone)]

Comment on attachment 50911 [details] [diff] [review]
patch to fix crash

Great! This may also fix other similar crashes. r=av

Comment 22

[Jay Patel [:jay]]

Yet another similar crash is occurring under the stack signature and offset:
0x00000009 be877c8b

Here is a recent incident:

0x00000009 be877c8b
	 line 
	Build: 2001091311 CrashDate: 2001-09-25 UptimeMinutes: 8448  Total: 8448 
	OS: Windows NT  5.0 build 2195
	 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=35863611
StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=35863611
(35863611)
URL: http://www.bluemountain.com
(35863611)
Comments: Checking an ecard.

Stack Trace
0x00000009
nsPluginInstanceOwner::GetTagType
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 2233]
nsPluginHostImpl::InstantiateEmbededPlugin
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp, line
3087]
nsPluginStreamListenerPeer::OnStartRequest
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp, line
1837]
nsHttpChannel::ProcessNormal
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 472]
nsHttpChannel::ProcessResponse
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 442]
nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2151]
nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 111]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 453]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1276]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1593]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1611]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 23

[Jay Patel [:jay]]

It looks like another similar crash is happening with M094 on Linux under the
0x00000001 stack signature.  Here is a one of those entries as well:

Incident ID 35889359
Stack Signature 0x00000001 9393d059
Trigger Time 2001-09-25 21:02:47
Email Address
User Comments
Build ID 2001091311
Product ID Netscape6.20
Platform ID LinuxIntel (Linux 2.4.2-2)
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
0x00000001
nsPluginHostImpl::InstantiateEmbededPlugin()
nsPluginStreamListenerPeer::OnStartRequest()
nsHttpChannel::ProcessNormal()
nsHttpChannel::ProcessResponse()
nsHttpChannel::OnStartRequest()
nsOnStartRequestEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0x1001e (0x4036101e)
libglib-1.2.so.0 + 0x117f3 (0x403627f3)
libglib-1.2.so.0 + 0x11dd9 (0x40362dd9)
libglib-1.2.so.0 + 0x11f8c (0x40362f8c)
libgtk-1.2.so.0 + 0x94803 (0x40277803)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1c177 (0x404a5177) 

Comment 24

[Peter Lubczynski]

this patch should fix those as well

Comment 25

[Marc Attinasi]

Comment on attachment 50911 [details] [diff] [review]
patch to fix crash

sr=attinasi

Comment 26

[Jaime Rodriguez, Jr.]

check it in - PDT+

Comment 27

[Peter Lubczynski]

patch in trunk and branch, marking FIXED

Comment 28

[shrirang khanzode]

verified on all 3 branch builds (1001) that this crash is not reproducible and 
seems fixed. adding vtrunk.

Comment 29

[Peter Lubczynski]

*** Bug 102385 has been marked as a duplicate of this bug. ***