11475 - [Crasher] Clicking on back button crashes application.

Status: VERIFIED DUPLICATE of bug 11522

(Core :: Networking, defect, P3)

Description

[Prashant Desale]

Clicking on back button after viewing gif file crashes application.

Build : 1999-08-09-09. [Apprunner]

STEPS TO REPRODUCE:
1] Please visit above specified URL.
2] At bottom of page you'll see one link "plus.gif.". Please click this link.
3] Now you'll see one very small gif image on screen.
4] Now click back button on browser. [It'll crash the application.]
5] If it does not crash application, click "plus.gif." again, and click back
button now. [sometimes it needs multiple clicks on back button to crash the
application.]

I'm providing stack trace report.

Incident ID: 12211894.

Trigger Type:  Program Crash
Trigger Reason:  Access violation


Call Stack:    (Signature = 0x09b0c98f d3bcd880)

0x09b0c98f

nsDocumentBindInfo::Bind
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1623]

nsDocLoaderImpl::LoadDocument
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 678]

nsWebShell::DoLoadURL
[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2131]

nsWebShell::LoadURL
[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2317]

nsWebShell::LoadURL
[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 1915]

NSAPPSHELL.DLL + 0x973e (0x609c973e)

NSAPPSHELL.DLL + 0x9cd1 (0x609c9cd1)

NSAPPSHELL.DLL + 0x9d33 (0x609c9d33)


js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 655]

js_Interpret
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2229]

js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 675]

js_Interpret
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2229]

js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 675]

js_InternalCall
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 748]

JS_CallFunctionValue
[d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2645]

nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 98]

nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line
608]

RDFElementImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp, line 2363]

nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
736]

nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
262]

PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1886]

nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 834]

nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1611]

HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 67]

nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 502]

nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 523]

nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3270]

ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3463]

nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2526]

nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 572]

KERNEL32.DLL + 0x35d9 (0xbff735d9)

KERNEL32.DLL + 0x2222f (0xbff9222f)


0x00638c00



 Registers:
 EAX:09b0a2f0 EBX:096f9fd0 ECX:09b0a85c EDX:8174b724
 ESI:096f8010 EDI:09aa1540 ESP:0063ef30 EBP:0063ef74
 EIP:09b0c98f CF pf af zf sf of IF df nt RF vm   IOPL: 0

 CS:016f DS:0177 SS:0177 ES:0177 FS:13ef GS:0000


 Operating System:  Windows 95 4.0 build 67306684

 Service Pack:   C

 Processor:  Not Available

 Processor Speed:  Not Available

 Physical Memory:  128.0 MB

 MEMORYSTATUS Structure:
                       Available    Total
 Physical Memory:      37.1 MB      128.0 MB
 Page File:            1013.1 MB    1013.1 MB
 Virtual Memory:       1878.4 MB    2044.0 MB

Comment 1

[joki (gone)]

I believe the click is incidental here.  The crash is trying to doublefree a
pointer in nsDocLoaderImpl::SetDocumentChannel.  Reassigning.

Comment 2

[Eli Goldberg]

CC:ing self. For the record, this bug results in the Imaging test case execution
proceed extremely slowly, as a result of constant crashes.

Thus, raising severity to 'major'.

Comment 3

[Chris Petersen]

I'm seeing this bug on all platforms witb the Aug 16th build. If click the reload
button, the crash will also occur.

Comment 4

[rpotts (gone)]

*** This bug has been marked as a duplicate of 11522 ***

Comment 5

[Jan Carpenter]

verifying dup

Comment 6

[leger]

Bulk move of all Networking-Core (to be deleted component) bugs to new
Networking component.