149302 - DOM inspector crashes on box model / image capture [@inBitmapChannel::AsyncOpen]

Status: VERIFIED WONTFIX

(Other Applications :: DOM Inspector, defect)

Description

[Mark Annand]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.0) Gecko/20020530

Steps to reproduce:

Open web page in browser.

Hold control and shift, press 'i' to launch DOM inspector

Select HTML node in left window

Select 'Box model' in window on right.

Select 'Image capture' button

Result: Mozilla crashes (every time)

Talkback incidents sent: TB 7027796X also TB 7025451G and also TB7025323H

Comment 1

[Dylan Foley]

confirming on win95 build 2002052306

MOZILLA caused an invalid page fault in
module INSPECTOR.DLL at 0137:606773e7.
Registers:
EAX=02c60014 CS=0137 EIP=606773e7 EFLGS=00010202
EBX=00000000 SS=013f ESP=0064ddd8 EBP=0064de20
ECX=00000000 DS=013f ESI=02b87a10 FS=10df
EDX=00000000 ES=013f EDI=61176e8a GS=0000
Bytes at CS:EIP:
8a 12 88 10 8b 55 f8 83 c0 03 8a 52 01 88 50 fe 
Stack dump:
02b87a10 61176e8a 00000000 6117ab48 61179f08 02b87b40
00000000 6117a6b4 02b87990 02c6000c 02b87b40 02b87ac0
605b6488 02b7d9f0 00000335 00000607

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

Stack Signature  inBitmapChannel::AsyncOpen 2c6f3937
Email Address [e-mail]
Product ID Gecko1.0
Build ID 2002053008
Trigger Time 2002-06-05 08:13:14
Platform Win32
Operating System Windows NT 5.0 build 2195
Module inspector.dll
URL visited
User Comments Checking that the DOM inspector crash is reproducible
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\extensions\inspector\base\src\inBitmapChannel.cpp
Trigger Line No. 176
Stack Trace
inBitmapChannel::AsyncOpen
[d:\builds\seamonkey\mozilla\extensions\inspector\base\src\inBitmapChannel.cpp,
line 176]
imgLoader::LoadImage
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgLoader.cpp, line 372]
nsImageFrame::RealLoadImage
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1984]
nsImageFrame::LoadImage
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1924]
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 70]
nsImageFrame::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1809]
nsCSSFrameConstructor::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 10832]
StyleSetImpl::AttributeChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1576]
PresShell::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5155]
nsXULDocument::AttributeChanged
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 2083]
nsGenericHTMLElement::SetHTMLAttribute
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 1965]
nsGenericHTMLElement::SetAttr
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 1620]
nsGenericHTMLElement::SetAttr
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 1797]
nsGenericElement::SetAttribute
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 968]
nsGenericHTMLElement::SetAttribute
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.h,
line 685]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2028]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2744]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3426]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1019]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1220]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
2219]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3461]
PresShell::HandleDOMEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6153]
nsButtonBoxFrame::MouseClicked
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 192]
nsButtonBoxFrame::HandleEvent
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 142]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6122]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6073]
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2640]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1721]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6126]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6028]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2076]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1887]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 891]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 908]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4745]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 5000]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3652]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1153]
USER32.DLL + 0x1b60 (0x77e11b60)
USER32.DLL + 0x1cca (0x77e11cca)
USER32.DLL + 0x83f1 (0x77e183f1)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 451]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1473]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1809]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1827]
WinMainCRTStartup()
KERNEL32.DLL + 0xd326 (0x77e8d326) 

Comment 3

[timeless]

not bug 143912 :-(

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

For which URL does this happen? Or does it happen for all URLs?

Comment 5

[Mark Annand]

It happens with all URLs I think.

Comment 6

[jsp]

Works for me with 20020530 and 2002060908 on Windows 2000. That is, it doesn't
crash, though there is a pause while the page is captured.

Comment 7

[Andy Edmonds]

Crashes 1.0 for me W2K.

Comment 8

[Alex Vincent [:WeirdAl]]

Found this in Mozilla 1.2a, Win98SE.

What is the intention of the Image Capture button, precisely?  What is it
supposed to capture?  If we know that, we can do some sanity checking in the
XUL/JS to prevent this crash.  Unfortunately, that wouldn't necessarily fix the
root cause of the crash.

Comment 9

[Michael Schumacher]

The image capture button is supposed to capture the box of the currently
selected element. If you hover over the different parts (padding area, margin
area), the corresponding values are shown in the area above the image.

See also http://www.w3.org/TR/CSS2/box.html.

Comment 10

[[e-mail]]

wontfixing this bug, since the checkin for bug 210096 removed the feature this
bug was pertinent to. If this assessment is incorrect, please reopen.

Comment 11

[timeless]

vrfy wont