Embedding an MNG image crashes Mozilla if an href="link.htm" attribute is set as part of the embedded object [@ il_mng_refresh]




Event Handling
16 years ago
14 years ago


(Reporter: liquid_net, Assigned: saari (gone))


({crash, testcase})

crash, testcase

Firefox Tracking Flags

(Not tracked)


(crash signature, URL)


(5 attachments)



16 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.1) Gecko/20020826
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.1) Gecko/20020826

The following lines of code will crash mozilla every time, this includes the
newest 1.2a build and 1.1 release.  The crash occurs only if you add an href
attribute to the embed object.  Also, 1.2a build crashes every time you try to
load the page with the embedded object even if it does not have an href attribute.

<EMBED TYPE="video/x-mng" SRC="images/animations/newsflash/ogg_vorbis.mng"
href="ogg_vorbis.php" WIDTH=300 HEIGHT=60>

Reproducible: Always

Steps to Reproduce:
1.  Place code snippet in page which includes an mng animation and an href attribute
2.  Load Browser
3.  Crash!

Actual Results:  
Big Badda Boom!

Expected Results:  
Displayed an MNG image that is also a link to a page advertised.

This crash seems to occur only under WindowsXP in my testing

Comment 1

16 years ago
Created attachment 99310 [details]
Crash Log from Windows XP debug

This is the entire debug file generated by Windows XP at the time of crash

Comment 2

16 years ago
Created attachment 99316 [details]
Reproducing the Crash under Windows 2000

This attachment outlines the steps to crash mozilla under win2k using embedded
MNG with href attribute.


16 years ago
Keywords: crash, stackwanted

Comment 3

16 years ago
Created attachment 99324 [details]
HTML workaround for EMBED bug, temporary and cumbersome

The workaround is to use the IMG tag instead of EMBED to load the MNG graphic. 
This will break IE compatibility and requires scripting to differentiate
between browsers.. very messy.

Comment 4

16 years ago
can you attach testcase ?

Comment 5

16 years ago
Created attachment 106770 [details]
test case

Comment 6

16 years ago
testcase wfm using Mozilla 2002111804 on Win2k.
Is anyone crashing using latest 1.2 or latest build ?
Keywords: testcase

Comment 7

16 years ago

I crashed on the testcase when clicking on the "Standards Compliant Object"
using 20021205 on WinXP.


Ever confirmed: true
Whiteboard: TB14824930K


16 years ago
Blocks: 185584
Created attachment 109593 [details]
win2k stack trace from the testcase
I got this assertions :
###!!! ASSERTION: attribute encountered -- this shouldn't happen unless the attr
ibute was not part of a start tag!: 'Error', file d:/moz_source/gmake/mozilla/ht
mlparser/src/CNavDTD.cpp, line 2234
WARNING: Droping timer event because thread is dead, file d:/moz_source/gmake/mo
zilla/xpcom/threads/nsTimerImpl.cpp, line 499
-> Events (?)
Assignee: asa → saari
Component: Browser-General → Event Handling
Keywords: stackwanted
QA Contact: asa → rakeshmishra
Whiteboard: TB14824930K
No longer blocks: 185584

Comment 11

15 years ago
Reproduced using FizzillaMach/2003022103, crashing at il_mng_refresh after
clicking the "Shannon & Me" link at the given URL and generating TB179369M.
Setting All/All.

(Is this another dependency on bug 181676?)
OS: Windows XP → All
Hardware: PC → All
Summary: Embedding an MNG image crashes mozilla if an href="link.htm" attribute is set as part of the embedded object → Embedding an MNG image crashes Mozilla if an href="link.htm" attribute is set as part of the embedded object [@ il_mng_refresh]

Comment 12

15 years ago
No longer crashes for me using Mozilla 1.3 on WinXP.

Can anyone else confirm this bug WFM?

Comment 13

15 years ago
URL still crashes Mozilla 20030314 (trunk) on Win2k.

Comment 14

14 years ago
I could get neither the link nor the testcase to crash (I do not have any MNG
plugin--was the crashing when Moz still had MNG?)

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040316

Comment 15

14 years ago
Has this bug been "fixed" since MNG was removed? Can someone who saw the crash
before test again?

Comment 16

14 years ago
I'm using the extension which adds the libmng 1.0.8 to mozilla, and I can see
the MNG without any crash.
[Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040421]

Comment 17

14 years ago
Setting WORKSFORME based on comments; last crash seen was over a year ago.

Reporter, please reopen this bug if you can reproduce it with a recent nightly
Last Resolved: 14 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ il_mng_refresh]
You need to log in before you can comment on or make changes to this bug.