103557 - Crash at www.aftonbladet.se

Status: VERIFIED DUPLICATE of bug 103477

(Core :: Graphics: ImageLib, defect)

Description

[Daniel Bratell]

I crash whenever I try to load http://www.aftonbladet.se in nsVoidArray::IndexOf 
because mOwner in imgRequestProxy is null in imgRequestProxy::Cancel

The stack is

nsVoidArray::IndexOf(const nsVoidArray * const 0x00000028, void * 0x0277e250) 
line 375
nsVoidArray::RemoveElement(nsVoidArray * const 0x00000028, void * 0x0277e250) 
line 588
imgRequest::RemoveProxy(imgRequest * const 0x00000028, imgRequestProxy * 
0x0277e250, unsigned int 2147500037) line 172
imgRequestProxy::Cancel(imgRequestProxy * const 0x0277e250, unsigned int 
2147500037) line 168
nsImageFrame::Destroy(nsImageFrame * const 0x00000003, nsIPresContext * 
0x027ef060) line 232
nsFrameList::DestroyFrames(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 
0x027ef060) line 136
nsLineBox::DeleteLineList(nsIPresContext * 0x027ef060, nsLineBox * 0x0283030c) 
line 267
nsBlockFrame::Destroy(nsBlockFrame * const 0x0282b6b4, nsIPresContext * 
0x027ef060) line 326 + 9 bytes
nsFrameList::DestroyFrames(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 
0x027ef060) line 136
nsFrameList::DestroyFrames(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 
0x027ef060) line 136
nsFrameList::DestroyFrames(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 
0x027ef060) line 136
nsFrameList::DestroyFrames(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 
0x027ef060) line 136
nsTableFrame::Destroy(nsTableFrame * const 0x0282a810, nsIPresContext * 
0x027ef060) line 294 + 10 bytes
nsFrameList::DestroyFrames(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 
0x027ef060) line 136
nsTableOuterFrame::Destroy(nsTableOuterFrame * const 0x0282a614, nsIPresContext 
* 0x027ef060) line 84 + 10 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x027ef060, nsLineBox * 0x02865484) 
line 267
nsBlockFrame::Destroy(nsBlockFrame * const 0x02829c50, nsIPresContext * 
0x027ef060) line 326 + 9 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x027ef060, nsLineBox * 0x00000000) 
line 267
nsBlockFrame::Destroy(nsBlockFrame * const 0x028298d8, nsIPresContext * 
0x027ef060) line 326 + 9 bytes
nsFrameList::DestroyFrame(nsFrameList * const 0x00000028, nsIPresContext * 
0x027ef060, nsIFrame * 0x028298d8) line 217
CanvasFrame::RemoveFrame(CanvasFrame * const 0x02825d70, nsIPresContext * 
0x027ef060, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x028298d8) 
line 371
FrameManager::RemoveFrame(FrameManager * const 0x00000000, nsIPresContext * 
0x027ef060, nsIPresShell & {...}, nsIFrame * 0x02825d70, nsIAtom * 0x00000000, 
nsIFrame * 0x028298d8) line 858 + 18 bytes
nsCSSFrameConstructor::ReconstructDocElementHierarchy(nsCSSFrameConstructor * 
const 0x02825d70, nsIPresContext * 0x027ef060) line 7145
StyleSetImpl::ReconstructDocElementHierarchy(StyleSetImpl * const 0x02533fa0, 
nsIPresContext * 0x027ef060) line 1186
PresShell::ReconstructFrames(PresShell * const 0x00000028) line 5131
PresShell::StyleSheetRemoved(PresShell * const 0x0269fe18, nsIDocument * 
0x0261ff50, nsIStyleSheet * 0x028b2fb0) line 5148
nsDocument::InsertStyleSheetAt(nsDocument * const 0x00000004, nsIStyleSheet * 
0x028b2fb0, int 39010208, int 1) line 1386
CSSLoaderImpl::InsertSheetInDoc(CSSLoaderImpl * const 0x00000028, 
nsICSSStyleSheet * 0x00000001, int 3, nsIContent * 0x028afe8c, int 1, 
nsICSSLoaderObserver * 0x00000000) line 1113
CSSLoaderImpl::LoadStyleLink(CSSLoaderImpl * const 0x00000000, nsIContent * 
0x028afe60, nsIURI * 0x028b2fb0, const nsString & {""}, const nsString & {""}, 
int -1, int 3, nsIParser * 0x027e1e88, int & 1, nsICSSLoaderObserver * 
0x00000000) line 1387 + 21 bytes
nsStyleLinkElement::UpdateStyleSheet(nsStyleLinkElement * const 0x028afe8c, int 
1, nsIDocument * 0x0261ff50, int 3) line 340
HTMLContentSink::ProcessLINKTag(HTMLContentSink * const 0x00000028, const 
nsIParserNode & {...}) line 4529
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x027d1e00, const nsIParserNode 
& {...}) line 3460
CNavDTD::AddLeaf(CNavDTD * const 0x00000028, const nsIParserNode * 0x0268ea68) 
line 3767 + 10 bytes
CNavDTD::AddHeadLeaf(CNavDTD * const 0x00000028, nsIParserNode * 0x0268ea68) 
line 3825 + 8 bytes
CNavDTD::HandleStartToken(CNavDTD * const 0x00000028, CToken * 0x00000000) line 
1713 + 10 bytes
CNavDTD::HandleToken(CNavDTD * const 0x024a3f28, CToken * 0x02860a60, nsIParser 
* 0x027e1e88) line 881 + 10 bytes
CNavDTD::BuildModel(CNavDTD * const 0x024a3f28, nsIParser * 0x027e1e88, 
nsITokenizer * 0x0266e980, nsITokenObserver * 0x00000000, nsIContentSink * 
0x027d1e00) line 517 + 10 bytes
nsParser::BuildModel(nsParser * const 0x00000028) line 2027
nsParser::ResumeParse(nsParser * const 0x00000028, int 1, int 1) line 1889 + 7 
bytes
nsParser::ContinueParsing(nsParser * const 0x00000028) line 1519 + 9 bytes
HTMLContentSink::ScriptEvaluated(HTMLContentSink * const 0x0263a934, unsigned 
int 0, nsIDOMHTMLScriptElement * 0x0263a934, int 0, int 1) line 5000
nsScriptLoader::FireScriptEvaluated(nsScriptLoader * const 0x00000028, unsigned 
int 0, nsScriptLoadRequest * 0x027d1e04) line 527
nsScriptLoader::ProcessRequest(nsScriptLoader * const 0x00000028, 
nsScriptLoadRequest * 0x02590b90) line 486
nsScriptLoader::OnStreamComplete(nsScriptLoader * const 0x00000000, 
nsIStreamLoader * 0x00000000, nsISupports * 0x02590b90, unsigned int 14655496, 
unsigned int 6521, const char * 0x00000000) line 767
nsStreamLoader::OnStopRequest(nsStreamLoader * const 0x027e2064, nsIRequest * 
0x02590b90, nsISupports * 0x00000000, unsigned int 0) line 136 + 46 bytes
nsStreamListenerTee::OnStopRequest(nsStreamListenerTee * const 0x024b93b8, 
nsIRequest * 0x02789628, nsISupports * 0x00000000, unsigned int 0) line 24 + 21 
bytes
nsHttpChannel::OnStopRequest(nsHttpChannel * const 0x0278962c, nsIRequest * 
0x0266fd34, nsISupports * 0x00000000, unsigned int 0) line 2336
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x00000028) line 
177
PL_HandleEvent(PLEvent * 0x0259b0ec) line 591
PL_ProcessPendingEvents(PLEventQueue * 0x100316b3) line 520 + 6 bytes
_md_EventReceiverProc(HWND__ * 0x00d69f28, unsigned int 4200267, unsigned int 
14033528, long 0) line 1071 + 10 bytes
nsAppShellService::Run(nsAppShellService * const 0x00d62278) line 457
main1(int 1, char * * 0x00373fc0, nsISupports * 0x00372d40) line 1293 + 9 bytes
main(int 1, char * * 0x00373fc0) line 1621 + 25 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00133484, 
HINSTANCE__ * 0x00400000) line 1639 + 21 bytes
MOZILLA! WinMainCRTStartup + 308 bytes

Comment 1

[R.K.Aa.]

*** This bug has been marked as a duplicate of 103477 ***

Comment 2

[Terri Preston]

Verified Duplicate