207169 - when opening with default page http://www.mozilla.org/start and then opening http://www.berlingske.dk in a tab, then : crash [@ il_mng_refresh ]

Status: RESOLVED DUPLICATE of bug 207540

(Core :: Graphics: ImageLib, defect)

Description

[henning petersen]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4b) Gecko/20030507
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4b) Gecko/20030507

While mozilla opens http://www.mozilla.org/start, as default, then I open
http://www.berlingske.dk in a tab ('open in background' not set as option in
preferences). Then it crashes. It's reproducible but fails now and then.

Reproducible: Sometimes

Steps to Reproduce:
1. http://www.mozilla.org/start open; it is set as default
2. Open http://www.berlingske.dk in 'a new tab' ('open in background' not set as
option in preferences)

Actual Results:  
3. Then it crashes and 'talkback is launced


Expected Results:  
It usually doesn't finish loading http://www.berlingske.dk , of course this was
the intention

I checked through the other incidents matching 'crash and win98', but other
URL-crashes are not identical cases

Comment 1

[Matthias Versen [:Matti]]

Reporter:
Please submit a Talkback report, open Mozilla/components/atlkback.exe and post
the Talkback ID from that crash into this bug.

Comment 2

[henning petersen]

Talback id's on this type of crash from today:

TB20460465W TB20460260G TB20460237Z TB20460182X TB20459933W TB20459853W 
TB20459834W TB20459538K TB20459188X TB20459180M TB20459172G

Comment 3

[Matthias Versen [:Matti]]

Incident ID 20460465
Stack Signature 	il_mng_refresh cb1c7de1
Product ID 	MozillaTrunk
Build ID 	2003050714
Trigger Time 	2003-05-26 14:29:31
Platform 	Win32
Operating System 	Windows 98 4.10 build 67766222
Module 	IMGMNG.DLL
URL visited 	http://mail.yahoo.com
User Comments 	
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/modules/libpr0n/decoders/mng/imgContainerMNG.cpp
Trigger Line No. 	456
Stack Trace 	
il_mng_refresh
[c:/builds/seamonkey/mozilla/modules/libpr0n/decoders/mng/imgContainerMNG.cpp,
line 456]
mng_display_progressive_refresh
[c:/builds/seamonkey/mozilla/modules/libimg/mng/libmng_display.c, line 297]
mng_process_display
[c:/builds/seamonkey/mozilla/modules/libimg/mng/libmng_display.c, line 2279]
mng_display_resume
[c:/builds/seamonkey/mozilla/modules/libimg/mng/libmng_hlapi.c, line 2034]
mng_display_freeze
[c:/builds/seamonkey/mozilla/modules/libimg/mng/libmng_hlapi.c, line 2101]
imgContainerMNG::~imgContainerMNG
[c:/builds/seamonkey/mozilla/modules/libpr0n/decoders/mng/imgContainerMNG.cpp,
line 61]
imgContainerMNG::`scalar deleting destructor'
imgContainerMNG::Release
[c:/builds/seamonkey/mozilla/modules/libpr0n/decoders/mng/imgContainerMNG.cpp,
line 36]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 66]
imgRequest::~imgRequest
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 81]
imgRequest::`scalar deleting destructor'
imgRequest::Release
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 61]
imgRequestProxy::~imgRequestProxy
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 85]
imgRequestProxy::`scalar deleting destructor'
imgRequestProxy::Release
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 41]
nsCOMPtr_base::assign_with_AddRef
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 75]
nsAString::do_AssignFromReadable
[c:/builds/seamonkey/mozilla/string/src/nsAString.cpp, line 265]
0x088b0674


Reporter: The URL in your report is different. Are you sure that this is the
correct TB ID ?

Comment 4

[henning petersen]

yes, but talkback keeps the value that I wrote once, unfortunately I missed
resetting it. The last report or so,perhaps TB20459172G, was actually on
mail.yahoo.com, but try the ones I wrote instead of the talkback reported value.
I'll try to report correct address from now.

Comment 5

[henning petersen]

yes, but talkback keeps the value that I wrote once, unfortunately I missed
resetting it. The last report or so,perhaps TB20459172G, was actually on
mail.yahoo.com, but try the ones I wrote instead of the talkback reported value.
I'll try to report correct address from now.

Comment 6

[henning petersen]

no, url in the talkback report is probably wring. But talkback keeps the value
that I wrote once, unfortunately I missed replacing it. The last report or
so,perhaps TB20459172G, was actually on mail.yahoo.com, but try the ones I wrote
instead of the talkback reported value. I'll try to report correct address from now.

Comment 7

[Jim Dunn]

[e-mail]

Comment 8

[Christian :Biesinger (don't email me, ping me on IRC)]

I can't reproduce this bug on win2000 2003051216.

however, dbradley took a look at the assembler code and found out that the crash
happens here:
http://lxr.mozilla.org/seamonkey/source/modules/libpr0n/decoders/mng/imgContainerMNG.cpp#453
453     container->mFrame->GetRect(dirtyRect);
because container->mFrame is null. apparently it was non-null earlier in the
function, though.

Comment 9

[henning petersen]

http://bugzilla.mozilla.org/show_bug.cgi?id=207540

Bug 207540 is in fact the same bug, and it is closed or invalid or whatever now,
I should think. If someone would change the status to the correct one, because I
don't know if it's invalid, closed, or something else.

- -  Henning

from 207540
Ok this is really something; I have had probably 100 crashes with Mozilla 1.3
alfa,beta, 1.4rc1 and now with 1.4rc2. And now I have an idea of what goes on.

The themes 'NautiPolis 1.0' (which by the way is really nice) makes Mozilla
crash. It happens only when using tabs, for instance I always get a crash when I
open 1 or more tabs, no matter if I have other windows open or not (this is on
win98). Sometimes the crash comes with the first tab, other times I can do a
little surfing before it happens, but it really is consistant.

I will file it under my earlier id:

Bugzilla Bug 207540


Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko/20030612

*** This bug has been marked as a duplicate of 207540 ***