132534 - Browser Crashes Viewing Image

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Ben Goodger (use ben at mozilla dot org for email)]

1) Load URL above
2) Right click
3) View Image...

Actual result:
crash in |nsEventStateManager::ResetBrowseWithCaret| at  
shellItem->GetItemType(&itemType); (shellItem is null)

Expected result:
View image.

Comment 1

[Arthur]

Not crashing on Linux 200231721. Moving the mouse out of the window with the
loaded image simply closes it but not the rest of the browser...

Comment 2

[Sebastian Biallas]

BuildID 2002031608, Win 98, I got talkback..
TB4295792Y

Comment 3

[Sebastian Biallas]

Sorry, meant bug 132532...

Comment 4

[Adam Hauner]

2002032003/Win2K - viewing okay, but closing tab with image crashed whole
browser -> TB4295978K

Comment 5

[Arthur]

Trying to open in tab crashes linux too, TB4296095Q

Comment 6

[Tuukka Tolvanen (sp3000)]

Does crash for me on linux cvs 2002-03-20 with original steps too, no tabs or such

Comment 7

[NilsE]

WFM on cvs RH 7.1 linux 2002-03-21, 0700 UTC.

However, when selecting view image I get an assertion:

Document http://www.photographica.org/photos/archives2/020212_apl_396x600.shtml
loaded successfully
XXX Damage rectangle (45,4245,4021,31) does not intersect the widget's view
(0,0,4020,4230)!
XXX Damage rectangle (9555,7065,4111,4321) does not intersect the widget's view
(0,0,4110,4320)!
Error reading file /export/nils/moz-cache/Cache/561ACE13d01
Error loading URL
http://www.photographica.org/photos/archives2/020212_apl_396x600.jpg : 80004005
(NS_ERROR_FAILURE)

If there is a reproducable crash, someone should assign this to the right
component. Might be ImageLib, but due to assertions Networking:Cache is also
possible.

Comment 8

[NilsE]

Attachment: assertions befor crash & gdb backstrace of crach

OK, it *does* crash *if* JavaScript is turned on (which I usually haven't). Now
the assertions are different. Assertions and gdb backtrace in attachment. Even
with backtrace, I'm unsure about component. Could be DOM ...

Comment 9

[Tuukka Tolvanen (sp3000)]

Attachment: gdb bt for 'view image' from context menu

Comment 10

[Boris Zbarsky [:bzbarsky]]

ccing aaronl since accessibility code is crashing.

Comment 11

[Asa Dotzler [:asa]]

windows trunk build 03/21

0x00000001
nsXULElement::Slots::~Slots
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4905]
nsXULElement::~nsXULElement
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 528]
nsXULElement::`scalar deleting destructor'
nsXULElement::Release
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 648]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsElementMap::ContentListItem::Destroy
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsElementMap.h, line 79]
nsElementMap::ReleaseContentList
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsElementMap.cpp, line 161]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsElementMap::~nsElementMap
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsElementMap.cpp, line 134]
nsXULDocument::~nsXULDocument
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp]
0x498b610b 

Over to Toolkit:XUL

Comment 12

[John Morrison]

this is bug 68454; the dreaded cyndilauper onblur='window.close()' bug.

Comment 13

[Aaron Leventhal]

This should be fixed by the fix for bug 131089. Has the reporter tried it with a
a recent build?

Comment 14

[NilsE]

aaronl: I'm not the reporter, but it still crashes with current CVS build. But
shouldn't this be marked a dupe of bug 68454?

Comment 15

[Aaron Leventhal]

I think it was crashing in several places, and I fixed the one the original
reported spoke of in ResetBrowseWithCaret(). Sounds like it's still crashing in
some other places.

Comment 16

[Adam Hauner]

Browser with opened DOM Inspector (as tool or sidebar) is still crashing just on
entering page - 2002032916/Win2K -> TB4639070M, TB4639069W, TB4639051M, TB4639022Q

Comment 17

[Stefan Fleiter (:sfleiter)]

Had a crash on:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9+) Gecko/20020413
Build-Id: 2002041307
After clicking right mouse button and choosing View Image.
Talkback-ID: TB5185918Z
I always use tabs, but don't know whether this has to do with
the crash.

Comment 18

[Adam Hauner]

Also still crashing with 200041203/Win2K:
TB5186840M - no tabs, Save Image As...
TB5186877W - in tab, Save Image As...
TB5186906K - no tabs, View Image
TB5186926G - in tab, View Image

Comment 19

[Boris Zbarsky [:bzbarsky]]

*** Bug 139756 has been marked as a duplicate of this bug. ***

Comment 20

[Tanu Mutreja]

Seems that the URL is no more valid...

Comment 21

[Juan José Mata]

Setting target milestone to 'Future' since 'mozilla1.1alpha' has already passed.

Comment 22

[Chris Lyon]

*** Bug 196806 has been marked as a duplicate of this bug. ***

Comment 23

[!Mike]

My system crashes when I select `View Image` from the right-mouse menu on an
inline image in the mail client. The new window opens with sizes in title but no
image will be displayed.

Linux is dead, only hw-reset possible. Mozilla 1.4 and 1.5RC2.
(Mozilla 1.5 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20030925)

How to get more debug data?

Comment 24

[Dan M]

Confusing bug. Comments 0, 7/8, 17, 18 and 23 seem to refer to the same (View
Image) bug. There's a smattering of other-sounding bugs spread throughout the
other comments. I can't reproduce a View Image crash on my system (WinXP) and I
don't have access to a Linux box right now. So I can't help.

!Mike, I can only suggest running under gdb in the hopes that the debugger will
provide an extra layer of segfault protection and hand your machine back to you
after the crash. If it helps, then to get a useful stack trace you'd need to try
it again with your own debug build of Mozilla. It's a lot of trouble, I know,
and I'm only a little hopeful that gdb will help.

Comment 25

[Arthur]

Bug has not been seen since mid 2002, the URL isn't working anymore and there's
no testcase. Marking WorksForMe and hoping that this has been fixed somewhere
somehow. If anyone has a testcase or a new URL please reopen.