18571 - crash in nsImageGroup clicking on links in demo 9

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P3)

Description

[buster]

open demo 9 (I was using apprunner)
I clicked several times on the links at the top of the page that fill the frames
with different urls.  Eventually, I got the crash below.  "mListenerRequest" was
garbage when dereferenced.

ReconnectHack(void * 0x02ef3670, nsIStreamListener * 0x02c6a070) line 161 + 9
bytes
ImageNetContextImpl::GetURL(ilIURL * 0x02c6a340, NET_ReloadMethod
NET_CACHE_ONLY_RELOAD, ilINetReader * 0x02c6a0d0) line 551 + 26 bytes
il_image_complete(il_container_struct * 0x02ef6d50) line 1548
ImgDCallbk::ImgDCBHaveImageAll(ImgDCallbk * const 0x02ef6b30) line 185 + 12
bytes
process_buffered_gif_input_data(gif_struct * 0x03107d80) line 693
gif_delay_time_callback(void * 0x02ef6d50) line 712 + 9 bytes
timer_callback(nsITimer * 0x02c6a2e0, void * 0x02c6a260) line 71 + 12 bytes
TimerImpl::Fire(unsigned long 666606156) line 312 + 17 bytes
TimerImpl::ProcessTimeouts(unsigned long 666606156) line 191
FireTimeout(HWND__ * 0x00000000, unsigned int 275, unsigned int 2352, unsigned
long 666606156) line 105 + 9 bytes
USER32! 77e7185c()
nsAppShellService::Run(nsAppShellService * const 0x013aebd0) line 484
main1(int 2, char * * 0x01004990) line 580 + 12 bytes
main(int 2, char * * 0x01004990) line 670 + 13 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 1

[troy]

Why did you assign this to layout? It clearly doesn't have layout on the
stack...

Comment 2

[buster]

there is no "gfx" component.  Asked a few people, consensus was "layout"
assigning to rickg to find the right owner.  Sorry, Rick, nobody seems to know
what component this should be.

Comment 3

[troy]

How can the consensus be layout, we have nothing to do with that code...

Rick, it's absolutely the case that we need a gfx component

Comment 4

[Mats Palmgren (inactive)]

This looks like a duplicate of bug 12722.

Comment 5

[rickg]

This works for me.

Comment 6

[buster]

it might be more correct to mark this a dup of 12722, which is not marked
"worksforme"  reading the description of that bug, they sound like the same
thing.  unfortunately, it seems possible to get different crashes based on the
same general action, in a difficult-to-reproduce fashion.

Comment 7

[Chris Petersen]

With the Dec 09 th builds (Win 98, Linux and Mac), I can't reproduce this crash.