165422 - Crash after some browsing in this site

Status: RESOLVED DUPLICATE of bug 146027

(Core Graveyard :: GFX, defect)

Description

[Juha Luoma]

See also comments in
<http://www.mozillazine.org/talkback/read.php?f=2&i=2368&t=2368>. My talkback id
is TB10034541H. I'm running moz 1.1 on W2k.

Comment 1

[Ian Neal]

Using BuildID 2002082608 on WinXP
Steps to reproduce
1. Go to above URL
2. Click through several links

Actual Results
Crash

Expected Results
No Crash

TBID TB10038289M

Comment 2

[Ian Neal]

Also happens on buildid 2002082814 on WinXP

TBID TB10038618M

Comment 3

[Ian Neal]

Doesn't seem to cause a crash in BuildID 2002082008 on WinXP, adding regression
keyword

Comment 4

[Ian Neal]

Works using BuildID 2002082508 on WinXP too

Comment 5

[Sam J. Fleet]

BuildID# 2002-08-29-04 had crashed when browsing around.  

Instead of having to play around to find the top cause of the crash, I found 
that all you can do is to click on the "PlayStation 2" hyperlink a couple of 
times.  Wait for the webpage to load then click it again.  That hyperlink is 
found under the "MobySites:" menu at the upper left corner.  At least it is 
reproductable in my case.

Haven't found the talkback id.  How do you find the talkback id on the Feedback 
Agent?

Comment 6

[Ian Neal]

Run <mozdir>/components/talkback.exe and it should list talkback ID for crashes
in that build.

Comment 7

[Ian Neal]

This crashes in gklayout.dll according to the MS feedback report (similar to bug
165416)

Comment 8

[Phil Miller]

I'm seeing this w/ build 2002-08-28 on Win98. TBID: TB10058267Q
This seems related to bug 165416 very closely.
Also, I reproduced simply by reloading the page multiple times, letting it load
each time. It crashed on the 3rd reload.

Comment 9

[Gavin Sinclair]

TB 10058246Z - crash in windows XP using steps in comment 5.
Using an older build than suggested regression in comment 3. (2002081419)

Comment 10

[Ian Neal]

Ok just tested using BuildID 2002080508 on Linux (RH7.3) and crashes on first
link click.
TB10060531E

Setting OS to all and removing regression keyword for the moment

Comment 11

[Gavin Sinclair]

I suspect the cause relates to the content of the top banner ad. It seems to
have a content from some server side randomised iframe.

The iframe can load a page which loads a further iframe with the ad image /
flash content or can load a further iframe with javascript randomisation of
content. 

I've had crashes where loading just the second iframe will push mozilla to 100%
cpu usage and ever eating memory until unusable - not as quick or dramatic a
crash as the one in comment 5 - but this seems to be where the problem lies. 
Still not sure if it is more prevalent if theres flash involvement / two levels
of randomisation / some ad server doing something different.........

Comment 12

[Boris Zbarsky [:bzbarsky]]

All the talkbacks are:

nsImageBoxListener::OnStopDecode
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp, line 876]
imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 295]
imgRequest::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 339]
imgContainer::Notify
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgContainer.cpp, line 460]
nsTimerImpl::Fire [c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 350]
nsTimerManager::FireNextIdleTimer
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp, line 579]
nsAppShell::Run [c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp,
line 156]
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 452]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1523]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1874]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1892]
WinMainCRTStartup()
kernel32.dll + 0x1eb69 (0x77e7eb69) 

*** This bug has been marked as a duplicate of 146027 ***