153799 - trunk and branch Crash [@nsImageListener::FrameChanged]

Status: VERIFIED DUPLICATE of bug 144315

(Core :: Layout, defect)

Description

[Alex Vincent [:WeirdAl]]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0.0) Gecko/20020530
BuildID:    Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0.0) Gecko/20020530

Twice now I've had crashes from Mozilla 1.0 while viewing a testcase for bug
153281.  Both times I had about 4 or 5 tabs open in a browser window, plus
mail/news.

Reproducible: Sometimes
Steps to Reproduce:
1.  Visit the URL above.

Actual Results:  Crash -- talkback ID TB7640337X, TB7603022E

Expected Results:  Testcase should render.

CC'ing stephend for talkback traces.

Comment 1

[timeless]

cvs debug trunk build from the weekend:
nsImageListener::FrameChanged(nsImageListener * const 0x05363728, imgIContainer 
* 0x05229320, nsISupports * 0x04db7840, gfxIImageFrame * 0x052bb7c0, nsRect * 
0x0012fd28) line 2383 + 36 bytes
imgRequestProxy::FrameChanged(imgIContainer * 0x05229320, gfxIImageFrame * 
0x052bb7c0, nsRect * 0x0012fd28) line 295
imgRequest::FrameChanged(imgRequest * const 0x04f99f4c, imgIContainer * 
0x05229320, nsISupports * 0x00000000, gfxIImageFrame * 0x052bb7c0, nsRect * 
0x0012fd28) line 336
imgContainer::Notify(imgContainer * const 0x05229324, nsITimer * 0x04ef7d68) 
line 460
nsTimerImpl::Fire() line 343
nsTimerManager::FireNextIdleTimer(nsTimerManager * const 0x0122df60) line 588
nsAppShell::Run(nsAppShell * const 0x00d17c48) line 134
nsAppShellService::Run(nsAppShellService * const 0x00d18560) line 458
main1(int 4, char * * 0x00304410, nsISupports * 0x00000000) line 1456 + 32 
bytes
main(int 4, char * * 0x00304410) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8d326()

mFrame was deleted -- dupe.
-	mFrame	0x04f99040
+	nsSplittableFrame	{...}
+	nsIImageFrame	{...}
+	mImageMap	0xdddddddd
+	mListener	{...}
+	mLoads	0x04f99080
+	mComputedSize	{...}
+	mIntrinsicSize	{...}
	mSizeConstrained	221 'Ý'
	mGotInitialReflow	221 'Ý'
	mInitialLoadCompleted	221 'Ý'
	mCanSendLoadEvent	221 'Ý'
	mImageBlocked	221 'Ý'
	mFailureReplace	221 'Ý'
+	mBorderPadding	{...}
	mNaturalImageWidth	3722304989
	mNaturalImageHeight	3722304989
+	mIconLoad	0x05260148
	newframe	0x052bb7c0

Comment 2

[timeless]

bug 138392, i'm on w2k

Comment 3

[Alex Vincent [:WeirdAl]]

correction:  bug 138292

Comment 4

[Alex Vincent [:WeirdAl]]

Bugzilla data loss on reloading, sorry for the spam.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Duplicate of bug 144315?

Comment 6

[Alex Vincent [:WeirdAl]]

timeless agrees:  duping

*** This bug has been marked as a duplicate of 144315 ***

Comment 7

[timeless]

vrfy