Trunk M100 M110 crashes [@ nsImageBoxListener::OnStopDecode]

RESOLVED DUPLICATE of bug 153815

Status

()

Core
Layout
P1
critical
RESOLVED DUPLICATE of bug 153815
16 years ago
16 years ago

People

(Reporter: greer, Assigned: Alexandru Savulov)

Tracking

({crash, testcase, topcrash+})

Trunk
x86
Windows 2000
crash, testcase, topcrash+
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: (jp), crash signature)

Attachments

(4 attachments)

(Reporter)

Description

16 years ago
Logging this one to avoid confusion over all of the decorations in bug 133410.
This signature is still showing up in Trunk crash reports following the
resolution of that bug as FIXED. I haven't been able to crash the testcase in
bug 133410, so it would appear that a different set of user actions can still
crash this code. (Possibly related to the crashes in bug 144315
[nsImageListener::FrameChanged].)  

cc'ing Judson who was lucky enough to stumble onto this one (comment at the
bottom). And hoping he might have some insight as to how to reproduce it. Also
cc'ing harishd, waterson, and jrgm who had input into bug 133410.


Stack Trace: 

	 nsImageBoxListener::OnStopDecode
[nsImageBoxFrame.cpp  line 877]
	 imgRequestProxy::FrameChanged
[imgRequestProxy.cpp  line 295]
	 imgRequest::FrameChanged
[imgRequest.cpp  line 338]
	 imgContainer::Notify
[imgContainer.cpp  line 459]
	 nsTimerImpl::Fire
[nsTimerImpl.cpp  line 357]
	 nsTimerManager::FireNextIdleTimer
[nsTimerImpl.cpp  line 593]
	 nsAppShell::Run
[nsAppShell.cpp  line 134]
	 nsAppShellService::Run
[nsAppShellService.cpp  line 451]
	 main1
[nsAppRunner.cpp  line 1472]
	 main
[nsAppRunner.cpp  line 1808]
	 WinMain
[nsAppRunner.cpp  line 1826]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0xd326 (0x77e8d326)
 
 	Source File : nsImageBoxFrame.cpp line : 877
----------------
Values at the time of crash:

nsImageBoxListener::OnStopDecode
        this = 0x04c8f490
           (*this) = Data not available
        request = 0x030f9d30
           (*request) = Data not available
        cx = 0x04c8f490
           (*cx) = Data not available
        status = 80454792 (0x04cba488)
        statusArg = 0x0012fdf4
           (*statusArg) = 0 (0x00000000)
        pc = {nsCOMPtr<nsIPresContext>}

------------------------------------
 Trunk (nsImageBoxListener::OnStopDecode):       58
 Unique Users  41
(6478448) - [Windows 98  4.10 build 67766446] (Build 2002051908)- 2002-05-20 :
reading email thru www.privasec.com & article at www.washingtonpost.com URL:
dialup.swbell.net/customer/
(6460983) - [Windows 98  4.10 build 67766446] (Build 2002051908)- 2002-05-20 :
Nothing special  loaded up comhem.se (as start page). After that i typed
slashdot.org in the url bar  the site loaded up  but approximately when it was
ready mozilla crashed URL: http://slashdot.org
(6329210) - [Windows 98  4.90 build 73010104] (Build 2002051408)- 2002-05-15 :
going from this site to slashdot.org URL:
http://tvlistings3.zap2it.com/partners/grid.asp?partner_id=097
(6320663) - [Windows NT  5.0 build 2195] (Build 2002051408)- 2002-05-15 :
clicked on job search  then on the beta  then choose my criteria and clicked
submit URL: http://www.monster.com
(6360076) - [Windows NT  5.0 build 2195] (Build 2002051604)- 2002-05-16 : tried
closing a window.  Not sure what I might have done. 
(6348131) - [Windows NT  5.1 build 2600] (Build 2002051408)- 2002-05-16 : ?
(6408914) - [Windows NT  5.0 build 2195] (Build 2002051708)- 2002-05-18 :
clicking on link context menu URL:
(6383879) - [Windows NT  4.0 build 1381] (Build 2002051608)- 2002-05-17 :
looking at page  loading another in background tab URL:
http://www.webreview.com/style/css1/charts/mastergrid.shtml
(6454557) - [Windows NT  5.0 build 2195] (Build 2002051808)- 2002-05-19 : I was
browsing Ebay when it crashed  not sure what triggered it or what URL it was.
URL: http://www.planethalflife.com/half-life/
(6407590) - [Windows 98  4.90 build 73010104] (Build 2002051608)- 2002-05-17 :
Crashed twice at the above URL: once when trying to print  and once when loading
it to get the URL for a TalkBack report.The first crash was preceded by the
events described in Bug #145176 ("Printing triggers 'download' of
'printProgress.xul'")  I URL:
http://www.techreview.com/articles/print_version/scigliano0602.asp
(6403019) - [Windows NT  5.0 build 2195] (Build 2002051604)- 2002-05-17 : Was
reading the "Greatest Disasters" article and on page 8 click on the Continue
link.  Mozilla crashed. URL: http://www.techreview/articles/scigliano0602.asp?p=8
(6494291) - [Windows NT  5.0 build 2195] (Build 2002052008)- 2002-05-20 : was
browsing at ebay  hit the back button and it crashed. URL:
http://www.planethalflife.com/half-life/
(6391489) - [Windows NT  5.0 build 2195] (Build 2002051704)- 2002-05-17 :
Opening some new forum topics URL: Arstechnica.com
(6387557) Build: 2002051704 Plat: Windows NT  5.0 build 2195 Time: 2002-05-17
valeski@netscape.com       viewing a web page
(Reporter)

Updated

16 years ago
Keywords: crash, topcrash

Comment 1

16 years ago
Changing priority to P1
Priority: -- → P1
Reassigning to Alex
Assignee: attinasi → alexsavulov

Comment 3

16 years ago
Here's some more Talkback data from recent builds:
     Count   Offset    Real Signature
[ 16   nsImageBoxListener::OnStopDecode 56f9cda2 -
nsImageBoxListener::OnStopDecode ]
[ 12   nsImageBoxListener::OnStopDecode 9974a836 -
nsImageBoxListener::OnStopDecode ]
[ 4   nsImageBoxListener::OnStopDecode 01d08173 - nsImageBoxListener::OnStopDecode ]
[ 3   nsImageBoxListener::OnStopDecode 8e9e0116 - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode f8319efa - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode f77ef39c - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode d9a28331 - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode cebc2561 - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode ce61840a - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode b7d7c72f - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode af24b2c6 - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode 9a9b193f - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode 98475348 - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode 95b60c6e - nsImageBoxListener::OnStopDecode ]
[ 1   nsImageBoxListener::OnStopDecode 56d61ac6 - nsImageBoxListener::OnStopDecode ]
 
     Crash date range: 2002-05-25 to 2002-06-03
     Min/Max Seconds since last crash: 35 - 287343
     Min/Max Runtime: 1023 - 287343
     Keyword List : click(4),  
     Count   Platform List 
     22   Windows NT 5.0 build 2195
     13   Windows NT 5.1 build 2600
     7   Windows 98 4.10 build 67766446
     2   Windows 98 4.90 build 73010104
     2   Windows 98 4.10 build 67766222
 
     Count   Build Id List 
     24   2002052508
     15   2002052809
     7   2002053104
 
     No of Unique Users        35
 
 Stack trace(Frame) 

	 nsImageBoxListener::OnStopDecode
[nsImageBoxFrame.cpp  line 876] 
	 imgRequestProxy::FrameChanged
[imgRequestProxy.cpp  line 295] 
	 imgRequest::FrameChanged
[imgRequest.cpp  line 339] 
	 imgContainer::Notify
[imgContainer.cpp  line 459] 
	 nsTimerImpl::Fire
[nsTimerImpl.cpp  line 357] 
	 nsTimerManager::FireNextIdleTimer
[nsTimerImpl.cpp  line 593] 
	 nsAppShell::Run
[nsAppShell.cpp  line 134] 
	 nsAppShellService::Run
[nsAppShellService.cpp  line 451] 
	 main1
[nsAppRunner.cpp  line 1472] 
	 main
[nsAppRunner.cpp  line 1808] 
	 WinMain
[nsAppRunner.cpp  line 1826] 
	 WinMainCRTStartup()  
	 KERNEL32.DLL + 0xd326 (0x77e8d326)   
 
     (6967732)	URL: www.k-lite.tk
     (6967732)	Comments: opening new tab
     (6928557)	URL: http://www.kuro5hin.org/modsub
     (6928557)	Comments: loading page
     (6899975)	URL: www.lewrockwell.com
     (6899975)	Comments: Had simply opened a second tab via [CTRL] [T] at this site and BOOM.
     (6897206)	Comments: browsing ebay
     (6885625)	URL:
http://listings.ebay.com/aw/listings/list/category4804/index.html?gotopage=200&x=8&y=11
     (6885625)	Comments: I clicked next  and the next page was half drawn.
     (6880028)	Comments: I had just clicked on search  and the results page was being layed
out.
     (6873109)	URL: userfriendly.com
     (6859969)	URL: www.mycareer.com.au
     (6859969)	Comments: Surfing
     (6825682)	URL: http://www.guru3d.com
     (6791441)	URL: www.ebay.com
     (6791441)	Comments: browsing ebay listings
     (6790521)	URL: userfriendly.com
     (6783255)	Comments: visit http://www.betanews.comthen click the link (top stories:
Windows 2000 SP3 Nears  Adds Antitrust Tweaks);after the page is loaded  then it
crashed.There is no problem for a new profile nor visit the link
     (6783255)	Comments:  http://www.betanews.com/article.php3?sid=1022670919 directly.
     (6770616)	Comments: Going into bookmarks...
     (6767005)	Comments: back button
     (6741419)	Comments: Two crashes while using gestures to browse.
     (6741376)	URL: http://www.nyugat.hu/news/
     (6741376)	Comments: I clicked on a link and as soon as the page started displaying 
the browser crashed

I'm going to try to reproduce this one using the new comments.
Whiteboard: (jp)

Comment 4

16 years ago
Adding M1RC3 to summary since there are a lot of incidents with Mozilla 1.0 RC3
as well.  The stack is pretty much the same, but here are more comments from
M1RC3 users:
     (6941105)	URL: http://www.spiegel.de
     (6938473)	URL: www.spiegel.de
     (6938473)	Comments: started the soccer worldcup life ticker window
     (6913319)	URL: www.skyperfectv.co.jp
     (6895624)	URL: http://www.spiegel.de/sport/fussball/0151819896500.html
     (6833181)	URL: http://www.bostonphoenix.com/
     (6833181)	Comments: alt-left arrow to get back from Phoenix front page.
     (6833129)	URL: http://www.bostonphoenix.com/
     (6833129)	Comments: was in a subsection of the site  hit alt-left arrow to get back to
front page  then hit alt-right arrow to get back to subpage before front page
had finished loading.
     (6832893)	URL: www.newscientist.com
     (6832893)	Comments: Just reading an article.  Only irregularity is that I had
thePreferences window open while browsing.
     (6760549)	URL: http://www.spiegel.de/politik/ausland/0151819806000.html
     (6760549)	Comments: loading the above page from a link in another page
     (6758017)	Comments: i want to open a website.
     (6668367)	Comments: While I was loading a web page with a lot of images  the browser
crashed after I pressed on the Edit button on the tool bar.
     (6653834)	URL: a guess => www.aramco.com
     (6653834)	Comments: clicked on the Aramco site  then clicked on "employment opportunities"
     (6640482)	Comments: Mozilla had about 4 windows open  as well as about 7 tabs. Then it
just exited.
Keywords: qawanted
Summary: Trunk crashes [@ nsImageBoxListener::OnStopDecode] → Trunk M1RC3 crashes [@ nsImageBoxListener::OnStopDecode]

Comment 5

16 years ago
Making topcrash+ and adding testcase keyword.  I was able to reproduce this
crash a couple of times.  It wasn't easy, but both crashes were at the same
site: http://www.guru3d.com .

Here are my 2 incidents:
Incident ID 7003713
Stack Signature nsImageBoxListener::OnStopDecode c492451c
Email Address jpatel@netscape.com
Product ID MozillaTrunk
Build ID 2002060408
Trigger Time 2002-06-04 15:36:21
Platform Win32
Operating System Windows NT 4.0 build 1381
Module gklayout.dll
URL visited http://www.guru3d.com
User Comments Clicked on bestbuy link in left menu and browsed that page for a
while...then clicked on the nvidia 4600 video card in upper right of page...and
boom!
Trigger Reason Access violation
Source File Name nsImageBoxFrame.cpp
Trigger Line No. 876
Stack Trace
nsImageBoxListener::OnStopDecode [nsImageBoxFrame.cpp, line 876]
imgRequestProxy::FrameChanged [imgRequestProxy.cpp, line 295]
imgRequest::FrameChanged [imgRequest.cpp, line 339]
imgContainer::Notify [imgContainer.cpp, line 459]
nsTimerImpl::Fire [nsTimerImpl.cpp, line 357]
nsTimerManager::FireNextIdleTimer [nsTimerImpl.cpp, line 593]
nsAppShell::Run [nsAppShell.cpp, line 134]
nsAppShellService::Run [nsAppShellService.cpp, line 451]
0x022f5010
main [nsAppRunner.cpp, line 1808]
WinMain [nsAppRunner.cpp, line 1826]
WinMainCRTStartup()
KERNEL32.dll + 0x1ba06 (0x77f1ba06)
-----------------------------------------------------------------------
Incident ID 7003942
Stack Signature nsImageBoxListener::OnStopDecode d33879f4
Email Address jpatel@netscape.com
Product ID MozillaTrunk
Build ID 2002060408
Trigger Time 2002-06-04 15:44:33
Platform Win32
Operating System Windows NT 4.0 build 1381
Module gklayout.dll
URL visited http://www.guru3d.com
User Comments Same steps as last time...best buy page -> nvidia 4600 page...but
then i clicked back a few times to get back to bug 146027 (which is the crash i
was trying to reproduce a second time).
Trigger Reason Access violation
Source File Name nsImageBoxFrame.cpp
Trigger Line No. 876
Stack Trace
nsImageBoxListener::OnStopDecode [nsImageBoxFrame.cpp, line 876]
imgRequestProxy::FrameChanged [imgRequestProxy.cpp, line 295]
imgRequest::FrameChanged [imgRequest.cpp, line 339]
imgContainer::Notify [imgContainer.cpp, line 459]
nsTimerImpl::Fire [nsTimerImpl.cpp, line 357]
nsTimerManager::FireNextIdleTimer [nsTimerImpl.cpp, line 593]
nsAppShell::Run [nsAppShell.cpp, line 134]
nsAppShellService::Run [nsAppShellService.cpp, line 451]
0x02305010
main [nsAppRunner.cpp, line 1808]
WinMain [nsAppRunner.cpp, line 1826]
WinMainCRTStartup()
KERNEL32.dll + 0x1ba06 (0x77f1ba06)

The site likes throwing popup ads at you (after almost every click)...not sure
if they have anything to do with this crash, but thought it should be noted.
Keywords: qawanted, topcrash → testcase, topcrash+
(Assignee)

Updated

16 years ago
Depends on: 144315
*** Bug 150576 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 7

16 years ago
this must be the same issue like on bug 144315. i need to decide for a way to
fix 144135 before i can get to this one.
(Assignee)

Comment 8

16 years ago
it is the same issue
(Assignee)

Comment 9

16 years ago
Created attachment 87434 [details] [diff] [review]
moves  ...mListener.get())->SetFrame(nsnull)... to destructor

this is the only way to make sure that the frame is set to null when the frame
gets destroyeds since i cannot reproduce the crash and we don't know how does
it happens that the frame gets destroyed without calling Destroy. i know, is
not the real fix but is better than nothing. i invite anyone aquainted with the

image stuff to take a nearer look and if he think this can be solved otherwise,

then go on.
crash happens also on the mib2 webpage -
http://www.sonypictures.com/movies/meninblack/ (recieved numerous reports by email)

Comment 11

16 years ago
This is trunk only, right?
Blocks: 143047
Keywords: nsbeta1+

Comment 12

16 years ago
Jaime: No, this has been an issue with all the Mozilla 1.0 RCs and is also a
topcrasher with Mozilla 1.0 right now (updating summary M1RC3 -> M100).
Summary: Trunk M1RC3 crashes [@ nsImageBoxListener::OnStopDecode] → Trunk M100 crashes [@ nsImageBoxListener::OnStopDecode]
(Assignee)

Comment 13

16 years ago
based on

http://bugzilla.mozilla.org/show_bug.cgi?id=144315#c26

this can be reproduced on the trunk only. however it might be wrong.  this bug
is a twin of bug 144315, but unfortunately both are hard to reproduce. working
on them.

Comment 14

16 years ago
Created attachment 88341 [details]
nsImageBoxListener::OnStopDecode crashes with Mozilla 1.1 Alpha (M11A)

Actually, looking at Mozilla 1.1 Alpha Talkback data, this is the #1 crash
right now.  Almost 1/6 of all crashes with that most recent Mozilla release are
of this type.

Comment 15

16 years ago
Updating summary again from M100 to M11A since this is now a topcrasher with
Mozilla 1.1 Alpha as well.
Summary: Trunk M100 crashes [@ nsImageBoxListener::OnStopDecode] → Trunk M11A crashes [@ nsImageBoxListener::OnStopDecode]

Comment 16

16 years ago
Puttin M100 back in summary since that is the last release off the Gecko1.0
Branch that is showing this crash.  I will attach Mozilla 1.0 crash reports in
case anyone wants to try to reproduce this with a recent Branch build.
Summary: Trunk M11A crashes [@ nsImageBoxListener::OnStopDecode] → Trunk M100 M11A crashes [@ nsImageBoxListener::OnStopDecode]

Comment 17

16 years ago
Created attachment 88342 [details]
nsImageBoxListener::OnStopDecode  crashes with Mozilla 1.0

This attachment shows that this crash is not only on the MozillaTrunk, but is a
topcrasher on the Gecko1.0 Branch as well.

Comment 18

16 years ago
According to the latest MozillaTrunk topcrash data, this crash last occurred
with builds from 6/14.  Do we know of any checkins on that day that would have
fixed this crash?  

See: http://warp/u/talkback/reports/Trunk/Trunk-topcrashers.html

Comment 19

16 years ago
trying to repro crash on win2000 and i get this assertion:
###!!! ASSERTION: attribute encountered -- this shouldn't happen unless the attr
ibute was not part of a start tag!: 'Error', file c:\builds\trunk\mozilla\htmlpa
rser\src\CNavDTD.cpp, line 2247

is this possible?

Comment 20

16 years ago
also getting this assertion when i try to repro using jpatel's instns:

###!!! ASSERTION: no popup/tooltip node on document!: 'targetNode', file c:\buil
ds\trunk\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 609

went to www.guru3d.com
clicked on best buy on lhs
clicked on nvidia 4600 video card in upper right of page
then pressed the back button twice

Comment 21

16 years ago
>trying to repro crash on win2000 and i get this assertion:
>###!!! ASSERTION: attribute encountered -- this shouldn't happen unless the attr
>ibute was not part of a start tag!: 'Error', file c:\builds\trunk\mozilla\htmlpa
>rser\src\CNavDTD.cpp, line 2247

This assertion is harmless. What it means is that the attribute encountered is
not part of a start attribute ( i.e., in this case the attribute is part of an
end tag....go figure! ). In other words just ignore this assertion.

Comment 22

16 years ago
sorry if i'm spamming. i don't know how important this info is. let me know,
please. got this assertion:
###!!! ASSERTION: reflow dirty lines failed: 'NS_SUCCEEDED(rv)', file c:\builds\
trunk\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 950

once i got to the nvidia page and hit the back botton twice, consecutively.
gonna try the sony url...

Comment 23

16 years ago
cool, got a crash!
loaded the sony url from below. got these assertions but kept clicking ignore.
this url gave me two new windows - one pop up and the other is just another
navigator window. i closed both of them. went to the url bar of my original
browser window and pressed return (reload?). as it was trying to give me those 2
windows again it crashed. oh, i was using a debug trunk build; though i;m not
sure how old my trunk build is.

this is the callstack from the debugger:
nsImageListener::FrameChanged(nsImageListener * const 0x0382e900, imgIContainer
* 0x0338acf8, nsISupports * 0x035f6a48, gfxIImageFrame * 0x035ebf08, nsRect *
0x0012fd28) line 2383 + 36 bytes
imgRequestProxy::FrameChanged(imgIContainer * 0x0338acf8, gfxIImageFrame *
0x035ebf08, nsRect * 0x0012fd28) line 295
imgRequest::FrameChanged(imgRequest * const 0x035ed9e4, imgIContainer *
0x0338acf8, nsISupports * 0x00000000, gfxIImageFrame * 0x035ebf08, nsRect *
0x0012fd28) line 336
imgContainer::Notify(imgContainer * const 0x0338acfc, nsITimer * 0x035d15b8)
line 460
nsTimerImpl::Fire() line 343
nsTimerManager::FireNextIdleTimer(nsTimerManager * const 0x01653498) line 588
nsAppShell::Run(nsAppShell * const 0x010df548) line 134
nsAppShellService::Run(nsAppShellService * const 0x01124618) line 458
main1(int 0x00000001, char * * 0x00306e90, nsISupports * 0x00000000) line 1456 +
32 bytes
main(int 0x00000001, char * * 0x00306e90) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8d326()

line it's dying is:
return mFrame->FrameChanged(aContainer, pc, newframe, dirtyRect);

Comment 24

16 years ago
so i'm able to crash all the time.
steps to repro:
1) open trunk browser
2) go to http://www.sonypictures.com/movies/meninblack/
3) if running debug build, ignore all assertions
4) two new windows will popup, close them both (a small popup, navigator window
   with MIB graphics it)
5) what's left is the original browser window (which should look very empty except 
   the top of the page has mouse-over click throughs)
6) in the url textfield, unhighlight (if highlighted) and press return

at that point you should crash.

Comment 25

16 years ago
sorry, looks like my stack trace and repro steps are for bug 144315. d'oh.
(Assignee)

Comment 26

16 years ago
no problem. i have the same results. the two bigs are twins so the cause is the
same. i also have another way to repro.
(Assignee)

Comment 27

16 years ago
Here is an importatnt question guys: 

from my experimets, i get the broken frame tree only when there is a popup
window around. (all the URL's i was successfull to test so far bringup a popup
window)

Did anyone reproduced this (or it's twin bug 144315) on URLs that do not pop up
a second window?

Comment 28

16 years ago
Alex:  I recall a popup being involved when I crashed before at www.guru3d.com .
 I have not been able to reproduce the nsImageBoxListener::OnStopDecode crash at
the site since I submitted my 2 incidents in comment #5.  I have been able to
reproduce the nsImageListener::FrameChanged crash as noted in bug 144315.
(Assignee)

Comment 29

16 years ago
yeah, i still think that the fix for that one (bug 144315) will also repair this
one or there will be a twin fix. the bug is a caused by a bitchy mix of factors
popup, framesets and animated gifs :-) Until now everyone that was able to
repro, saw this.

Comment 30

16 years ago
To avoid having to update 2 separate bugs, I'm just going to mark this a dup of
bug 153815.  If anyone disagrees, please reopen.  

We fixed an instance of this kind of crash in bug 144315, but this stack
signature continues to show up in Talkback reports...those crashes are now
represented in bug 153815.

*** This bug has been marked as a duplicate of 153815 ***
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → DUPLICATE

Updated

16 years ago
No longer blocks: 143047
(Assignee)

Comment 31

16 years ago
we're going to repoen this bug since we're not sure if is or is not affected by
bug 153815. however there will be no progress here until bug 153815 does not get
solved.
Status: RESOLVED → REOPENED
Depends on: 153815
No longer depends on: 144315
Resolution: DUPLICATE → ---
*** Bug 165422 has been marked as a duplicate of this bug. ***
(Reporter)

Comment 33

16 years ago
*** Bug 162604 has been marked as a duplicate of this bug. ***

Comment 34

16 years ago
Got another talkback for you guys, and a damn easy way to reproduce it.
TBID: TB10130463H
Reproduced by opening http://mobygames.com/
Reload a few times, usually crashes before the 5th.
I'll try to extract a testcase from there.
WinXP, 1.1 release.

I crashed 3 times on ebay recently (at least 2 last night) I think when or
shortly after marking items to remember, or just clicking on an item.  Doesn't
take long, VERY annoying.

Example stack from TB (same as mentioned here):


    nsImageBoxListener::OnStopDecode
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp, line
876]
     imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line
295]
     imgRequest::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 339]
     imgContainer::Notify
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgContainer.cpp, line 460]
     nsTimerImpl::Fire
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp, line 352]
nsTimerManager::FireNextIdleTimer
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp, line 588]
nsAppShell::Run
[c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp, line 156]
     nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line
452]
     main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1534]    main
[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1881]
     WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1899]    WinMainCRTStartup()             kernel32.dll + 0x1eb69
(0x77e7eb69)

Comment 36

16 years ago
Updating summary with M110 since this is a MAJOR issue with Mozilla 1.1. 
Talkback data shows this as the #1 topcrash with over 3K incidents out of a
sample of 16K total incidents for that release.  

Not sure if we have figured out how closely this is related to bug 153815, but
it looks like there has been some progress there...so hopefully we'll be able to
tackle this crash as well.

Here is the latest stack from M110 Talkback data:
nsImageBoxListener::OnStopDecode
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp  line 876] 
	 imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp  line 295] 
	 imgRequest::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp  line 339] 
	 imgContainer::Notify
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgContainer.cpp  line 460] 
	 nsTimerImpl::Fire	[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp 
line 352] 
	 nsTimerManager::FireNextIdleTimer
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 588] 
	 nsAppShell::Run	[c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp
 line 156] 
	 nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp  line 452] 
	 main1	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1534] 
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1881] 
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1899] 
	 WinMainCRTStartup()  
	 kernel32.dll + 0x1eb69 (0x77e7eb69)   

And most of the user comments just mention searching on ebay for things.  I will
attach a complete list of user comments and urls.

We also need a target milestone for this bug...
Summary: Trunk M100 M11A crashes [@ nsImageBoxListener::OnStopDecode] → Trunk M100 M110 crashes [@ nsImageBoxListener::OnStopDecode]

Comment 37

16 years ago
Created attachment 97990 [details]
user comments and url for crashes with Mozilla 1.1

LOTS of user comments and urls for users crashing with the
nsImageBoxListener::OnStopDecode stack signature using Mozilla 1.1
(Assignee)

Comment 38

16 years ago
bug 153815 got fixed on the trunk. this one is very likely a duplicate of bug
153815. CCing Kin for oppinion.
(Assignee)

Comment 39

16 years ago
ok, i've seen enough.
this are the URL's from talkback reports that have this bug's stack signature:

http://search.ebay.com/ ...
http://listings.ebaymotors.com/ ...
http://www.ebaymotors.com/ ...
http://www.osnews.com
http://www.guru3d.com/
http://www.bayarea.com/mld/bayarea/
http://www.guardian.co.uk/ ...
http://www.zagat.com
http://www.egreetings.com/ ...
http://www.cdmediaworld.com  
http://www.telegraph.co.uk/ ...
http://www.nikkei.co.jp/ ...
http://derstandard.at/ ...
http://www.webreview.com/ ...

On all this sites we hit Kin's new added code to fix bug 153815. Top runner was
ebay.com. From my knowledge of bug 153815 (i worked a while on debugging that
issue) I can say now that this bug is a duplicate of bug 153815 so I will mark
it as such.

If there will be again talkback crashes with this signature with a build younger
than this comment, please reopen this bug and let me know per direct email. thx!

*** This bug has been marked as a duplicate of 153815 ***
Status: REOPENED → RESOLVED
Last Resolved: 16 years ago16 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsImageBoxListener::OnStopDecode]
You need to log in before you can comment on or make changes to this bug.