103477 - rendering breaks (or crash) when going from tweakers.net to bugzilla - Trunk [@ nsVoidArray::IndexOf][@ IndexOf]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Ferdinand]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.4+)
Gecko/20011006
BuildID:    2001100608

On win2k using 2001100608 (cvs), with the 'Accept images that come from the
originating server only' pref set: If I go to http://www.tweakers.net/ and then
to http://bugzilla.mozilla.org/ the rendering of the page and scrollbars breaks,
I have to move windows over the canvas to get the page to display. This is the
same for every page I try to load after bugzilla as well.
If the bugzilla page is in cache, the browser crashes instead.

Reproducible: Always
Steps to Reproduce:
1. Set 'Accept images that come from the originating server only' pref
2. Go to http://www.tweakers.net/
3. Go to http://bugzilla.mozilla.org/
4. If bugzilla is in cache (memory or disk), the browser crashes
5. If bugzilla isn't in cache, rendering breaks completely

Actual Results:  Browser either becomes unusable, or it crashes

Expected Results:  Continued correct rendering, and no crashes.

I think that the problem is in the iframe, as that tends to show up over
incorrectly rendered pages. Any site with an image in an iframe will probably do
the trick tweakers.net does for this bug.
I'm building a debug build now, will attach a stack of the crash once it's done.
Workaround is allowing all images to load.

Comment 1

[Ferdinand]

Attachment: stack of crash

Comment 2

[Ferdinand]

I've found that closing the browser window after rendering is broken results in
a crash too. Using sourceforge.net instead of tweakers.net will work to
reproduce crash and rendering problems as well.

Comment 3

[R.K.Aa.]

first lines of that stack are what i see in gdb when crashing by clicking links
at http://www.dinside.no (Linux 2001100606)

Comment 4

[Ferdinand]

indeed, www.dinside.no gives the same crash in a more easily reproducable form:
it even crashes when accepting all images, and it skips the paint problem stage.

Comment 5

[R.K.Aa.]

i see the same stack in bug 103504 when opening image properties in composer.

Comment 6

[R.K.Aa.]

*** Bug 103504 has been marked as a duplicate of this bug. ***

Comment 7

[R.K.Aa.]

*** Bug 103501 has been marked as a duplicate of this bug. ***

Comment 8

[R.K.Aa.]

raising severity another notch - this is crashing all over the place

Comment 9

[Matthias Versen [:Matti]]

This is a smoketest blocker.
smoketest B.7 (www.msn.com) is crashing with this stack....

Comment 10

[Samuel Sieb]

This is caused by the patch for bug 92248 (onmouseover flickering).

Comment 11

[Stuart Parmenter]

taking

Comment 12

[Stuart Parmenter]

Attachment: Patch to fix this

Comment 13

[Stuart Parmenter]

Attachment: Better patch

Comment 14

[R.K.Aa.]

built on linux w/patch in attachment 52407 [details] [diff] [review]: www.dinside.no no longer crashes
when clicking links. Image properties in Composer work fine again.

Comment 15

[R.K.Aa.]

*** Bug 103506 has been marked as a duplicate of this bug. ***

Comment 16

[David Hyatt]

sr=hyatt

Comment 17

[jag (Peter Annema)]

 NS_IMETHODIMP imgRequestProxy::Cancel(nsresult status)
 {
-  if (mCanceled)
+  if (mCanceled || mOwner)
     return NS_ERROR_FAILURE;

That should be !mOwner.

Fix that, and r=jag.

Comment 18

[Christian :Biesinger (don't email me, ping me on IRC)]

*** Bug 103547 has been marked as a duplicate of this bug. ***

Comment 19

[R.K.Aa.]

*** Bug 103557 has been marked as a duplicate of this bug. ***

Comment 20

[Stuart Parmenter]

fixed

Comment 21

[Stuart Parmenter]

*** Bug 103536 has been marked as a duplicate of this bug. ***

Comment 22

[Ferdinand]

confirming fixed on w2k 2001100712 (cvs)

Comment 23

[R.K.Aa.]

*** Bug 103589 has been marked as a duplicate of this bug. ***

Comment 24

[Matthias Versen [:Matti]]

*** Bug 103581 has been marked as a duplicate of this bug. ***

Comment 25

[Ferdinand]

*** Bug 103625 has been marked as a duplicate of this bug. ***

Comment 26

[Matthias Versen [:Matti]]

*** Bug 103625 has been marked as a duplicate of this bug. ***

Comment 27

[R.K.Aa.]

*** Bug 103654 has been marked as a duplicate of this bug. ***

Comment 28

[Frank de Lange]

Confirming fixed on Linux (20011008 CVS)

Comment 29

[Matthias Versen [:Matti]]

for the QA: Confirming fixed on win2k build 20011008.. (CVS)

Comment 30

[Jay Patel [:jay]]

Adding Trunk to summary for tracking and cc'ing Talkback folk.

Comment 31

[Brant Gurganus]

VERIFIED 2002123108