19394 - [DOGFOOD][talkback] top 1 in M11. - crash in il_image_abort 3815b27f

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P1)

Description

[Shiva Thirumazhusai]

HIGHLY REPRODUCIBLE

Was at http://www.slashdot.org and then I hand typed
http://www.bluesnews.com into the location bar and hit the
enter key. Blues News started to load (I saw the layout and
some gfx and such) and then M11 crashed.


il_image_abort [d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line
1255]
IL_StreamAbort [d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line
1595]
NetReaderImpl::StreamAbort
[d:\builds\seamonkey\mozilla\modules\libimg\src\ilNetReader.cpp, line 114]
ImageConsumer::OnDataAvailable
[d:\builds\seamonkey\mozilla\gfx\src\nsImageNetContextAsync.cpp, line 217]
nsChannelListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1405]
nsChannelListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1405]
nsHTTPResponseListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 184]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
417]
nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
174]
PL_HandleEvent [plevent.c, line 538]
PL_ProcessPendingEvents [plevent.c, line 499]
_md_EventReceiverProc [plevent.c, line 976]
USER32.dll + 0x1820 (0x77e71820)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 484]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 586]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 677]
mainCRTStartup()
KERNEL32.dll + 0x1ba06 (0x77f1ba06)

Comment 1

[Eli Goldberg]

I believe pnunn is on vacation. CC:ing dp.

Comment 2

[Suresh Duddi (gone)]

She will be back monday.

Comment 3

[pnunn]

Ok. I'm on it.

Comment 4

[leger]

Putting on PDT+ radar.

Comment 5

[pnunn]

I have a simpler test. I had a hard time getting the crash to
work consistantly. It would go through a phase of crashing and then
a phase of not. Finally I was getting the crash without even going
to bluesnews.com. It was confined to slashdot.org.

I isolated to one banner ad redirect:
http://mojofarm.sjc.mediaplex.com/adserver/banner_request/505-1403-1233

Viewing this image with view image will not create the crash, but
putting the image in an html page will.
I have the test url at http://jazz/users/pnunn/publish/aredirect.html

I think something is wacky with this banner delivery site. But that is
not the real bug. The bug seems to be with how a IC_INCOMPLETE state is
handled. I'll be tracing this path.

-pn

Comment 6

[pnunn]

I just checked in a fix for this bug.

This test case only seems to trigger the
error condition on windows. but the fix is
correct for the error condition.
-pn

hey! do I get a trip to Hawaii?

Comment 7

[pnunn]

*** Bug 18090 has been marked as a duplicate of this bug. ***

Comment 8

[pnunn]

*** Bug 19387 has been marked as a duplicate of this bug. ***

Comment 9

[Eli Goldberg]

The bug as written is technically fixed, in the 1999113008 Mac OS, 1999120108
Win32 (NT 4.0 SP5) and 1999120109 Linux (RH 6.0/GNOME) builds, using Pam's test
case on jazz.

On Win32-only, however, I'm seeing a separate issue, in which the throbber does
not stop throbbing after the ALT text displays. (There was a crash reproducible
in yesterday's build, but not today's.)

E-mailing Judson & Warren to see if they'd like a separate bug.

Comment 10

[Eli Goldberg]

[per valeski e-mail, I broke the side-issue into 20490.]