182063 - crashing when clicking fast the back/forward buttons [@ nsImageBoxListener::OnStopDecode ]

Status: RESOLVED WORKSFORME

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Frank Wein [:mcsmurf]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021124
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021124

When you go to this page and click some links and then press fast the back
button, it simply crashes (see steps to reproduce)

Reproducible: Always

Steps to Reproduce:
1.Go to that site (URL)
2.Click on the image with label "Superstar"
3.Click on the link "Die Jury"
4.Click on the link "Die Show" (close ad popup)
5.Press fast the back button (and if necessary fast the forward button)
Actual Results:  
Mozilla crashes

Expected Results:  
Not to crash :)

TB Ids to this are TB14370042Q, TB14372619Y

Stack to TB14370042Q:
  0x00000000   
     nsImageBoxListener::OnStopDecode
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp, line 887]
     imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 301]
     imgRequest::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 342]
     imgContainerGIF::Notify
[c:/builds/seamonkey/mozilla/modules/libpr0n/decoders/gif/imgContainerGIF.cpp,
line 496]
     nsTimerImpl::Fire
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp, line 380]
     nsTimerManager::FireNextIdleTimer
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp, line 595]
     nsAppShell::Run
[c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp, line 177]
     nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 472]
     main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1557]
     main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1905]
     WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1925]
     WinMainCRTStartup()  
     KERNEL32.DLL + 0x1ca90 (0x77e8ca90)  
Registers:
EAX: 065fbbf0 EBX: 00000002 ECX: 065fbc94 EDX: 00000000
ESI: 02cbd3d0 EDI: 00000000 ESP: 0012fce8 EBP: 0012fd10
EIP: 00000000 cf PF af ZF sf of IF df nt RF vm   IOPL: 0
CS: 001b DS: 0023 SS: 0023 ES: 0023 FS: 0038 GS: 0000


So it crashes at
 return rv;

complete funtion is

NS_IMETHODIMP nsImageBoxListener::OnStopDecode(imgIRequest *request, nsISupports
*cx, nsresult status, const PRUnichar *statusArg)
{
  if (!mFrame)
    return NS_ERROR_FAILURE;

  nsCOMPtr<nsIPresContext> pc(do_QueryInterface(cx));
  nsresult rv = mFrame->OnStopDecode(request, pc, status, statusArg);

  return rv;
}

dbradley's guess was that while OnStopDecode is executed, cx has changed or that
mFrame is trashed or deleted (it's not null, because we jump to 0x0). But he
thinks it's probably mFrame (also he cant verify that)

Comment 1

[Olivier Cahagne]

confirming using Linux debug build 20021123, will attach stack trace.

Comment 2

[Olivier Cahagne]

Attachment: Stack trace (and assertion) on Linux 20021123

Comment 3

[Matthias Versen [:Matti]]

*** Bug 182259 has been marked as a duplicate of this bug. ***

Comment 4

[Frank Wein [:mcsmurf]]

Resolving Wfm
I cant get it to crash with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.3b) Gecko/20030114 anymore