14181 - Coredump on url

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Suresh Duddi (gone)]

9/16 build. Going to the url caused the crash. Looks like ImageConsumer is
invalid.

(gdb) bt
#0  0x88c8327 in ?? ()
#1  0x4002746b in ImageConsumer::OnStopRequest (this=0x88c82e0,
channel=0x88c8328, aContext=0x0, status=0, aMsg=0xbffff694) at
nsImageNetContextAsync.cpp:381
#2  0x40027364 in ImageConsumer::KeepPumpingStream (aTimer=0x8944ea8,
aClosure=0x88c82e0) at nsImageNetContextAsync.cpp:350
#3  0x411d88d5 in ?? () from
/home/dp/build.debug/mozilla/dist/bin/components/libtimer_gtk.so
#4  0x411d8c9a in ?? () from
/home/dp/build.debug/mozilla/dist/bin/components/libtimer_gtk.so
#5  0x40748fa3 in ?? () from /usr/lib/libglib-1.2.so.0
#6  0x407482c6 in ?? () from /usr/lib/libglib-1.2.so.0
#7  0x40748801 in ?? () from /usr/lib/libglib-1.2.so.0
#8  0x40748979 in ?? () from /usr/lib/libglib-1.2.so.0
#9  0x40677f3a in ?? () from /usr/lib/libgtk-1.2.so.0
#10 0x4053fe49 in ?? () from
/home/dp/build.debug/mozilla/dist/bin/libwidget_gtk.so
#11 0x403b6e41 in ?? () from
/home/dp/build.debug/mozilla/dist/bin/libnsappshell.so
#12 0x804b4b7 in main1 (argc=1, argv=0xbffffa34) at nsAppRunner.cpp:585
#13 0x804b739 in main (argc=1, argv=0xbffffa34) at nsAppRunner.cpp:631
#14 0x40281cb3 in ?? () from /lib/libc.so.6

Comment 1

[pnunn]

dp:
a quick question. Did just going to the url cause the crash or
did you have to click on links in the frames?
I'm seeing a different crash with a different call stack on NT.
thanks,
pn

Comment 2

[pnunn]

I have fixed the gif bug. but as soon as I fixed
that bug and attempt to click around on the right
frame links I see another bug in nsWebShell.

I will close this one and reopen one for the new bug.
-pn

Comment 3

[Eli Goldberg]

Hi, Pam ---

This URL is crashing after one image iteration on today's Linux build. (Or, after
several iterations, if you view http://webgroup/btek/mozsmokes.gif directly)

Doesn't crash on Windows/Mac. (Well, not immediately, and not with the same stack
signature.)

Talkback tracking # of 13765822. Looks vaguely timer-related, so it may be yours.

Comment 4

[pnunn]

*** Bug 1031 has been marked as a duplicate of this bug. ***

Comment 5

[Eli Goldberg]

[Note to self: please double-check bug #1031 while verifying this bug.]

Comment 6

[pnunn]

I gotta fix for this...but I've got to test like
mad. Get a code review and test on other platforms.
-pn

Comment 7

[pnunn]

Turning over to you, Rick.
-p

Comment 8

[rpotts (gone)]

I've just checked in the changes to nsImageNetContext.cpp

Comment 9

[rpotts (gone)]

Ok...  So I'm stuck with a CVS lock in mozilla/gfx/src.  So I won't be able to
check in the fix until the lock is broken :-(

Comment 10

[rpotts (gone)]

I've just checked in the new version of nsImageNetContextAsync.cpp  so
everything should be fine...

Comment 11

[Eli Goldberg]

After several minutes, this animated GIF does not result in a crash. (1031 does,
however, so that one has been re-opened.)

Thus, verified on:
      1999100708 Mac OS & Linux
      1999100708 Win32

Comment 12

[pnunn]

*** Bug 14227 has been marked as a duplicate of this bug. ***

Comment 13

[pnunn]

*** Bug 16549 has been marked as a duplicate of this bug. ***