197573 - crash if MozOpacity is called for an image object before it has been created - M130 [@ DoDeletingFrameSubtree ]

Status: VERIFIED DUPLICATE of bug 192469

(Core :: Layout, defect)

Description

[mark bokil]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312

In the page http://bokil.com/index.php?content=portabella, the image at the
bottom which has javascript attached to it to change the opacity of the image
can cause Mozilla to crash if the user rolls over the image before the image has
fully downloaded. To see this behavior restrict the bandwidth to a 56K modem
level and as the image renders on the screen roll over it. Mozilla crashes. 

Reproducible: Always

Steps to Reproduce:
1. Go to the page http://bokil.com/index.php?content=portabella using a 56K modem
2. Rollover the image portabell-01.jpg at the bottom of the page before the
image has fully loaded.
3. Fatal crash takes down Mozilla. 

Actual Results:  
Fatal Mozilla crash. Talkback appeared asking for bug info. Mozilla had to be
restarted.

Expected Results:  
A javascript error should have been caught indicating the referenced image
object was null. From the UI the standard javascript error dialog box should
appear indicating the ID of the null object referened.

This bug is easier to see on a reduced bandwidth connection. I could trigger the
crash everytime using a 56K modem and clearing out the cache first.

Comment 1

[mark bokil]

The offending javascript that caused the crash on the page was:
// lightup crossbrowser image opacity changer
function lightup(imageobject, opacity) {
    if (navigator.appName.indexOf("Netscape") !=-1 &&
parseInt(navigator.appVersion)>=5) {
        document.getElementById(imageobject).style.MozOpacity=opacity+'%';
    } else if (navigator.appName.indexOf("Microsoft") != -1 &&
parseInt(navigator.appVersion)>=4) {
        // gota luv that M$ syntax for opacity, eh?
        document.getElementById(imageobject).style.filter =
"progid:DXImageTransform.Microsoft.Alpha(opacity="+opacity+")";
    }
}

Comment 2

[Matthias Versen [:Matti]]

Please provide a talkback ID from that crash.

Comment 3

[mark bokil]

Talkback ID: TB18103121H

Comment 4

[Olivier Cahagne]

could be dupe of bug 192469.

Comment 5

[Jay Patel [:jay]]

Incident ID 18103121
Stack Signature 	DoDeletingFrameSubtree 1a034e91
Email Address 	[e-mail]
Product ID 	MozillaBranch
Build ID 	2003031211
Trigger Time 	2003-03-15 09:30:16
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	gklayout.dll
URL visited 	http://bokil.com/index.php?content=portabella
User Comments 	I mouseovered an image that had javascript which was changing the
opacity of the image. Apparently the image was not yet fully loaded and a fatal
exception was not caught. In javascript if an image object is not yet loaded you
should get an object is null error in a dialog box. Currently it takes down
Mozilla -- not good.
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
Trigger Line No. 	9525
Stack Trace 	
DoDeletingFrameSubtree
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9525]
DoDeletingFrameSubtree
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9542]
DoDeletingFrameSubtree
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9542]
DeletingFrameSubtree
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9588]
nsCSSFrameConstructor::ContentRemoved
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9893]
nsCSSFrameConstructor::RecreateFramesForContent
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 12155]
nsCSSFrameConstructor::ProcessRestyledFrames
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10393]
PresShell::ReconstructStyleData
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5418]
PresShell::StyleSheetApplicableStateChanged
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5485]
nsDocument::SetStyleSheetApplicableState
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 1691]
CSSStyleSheetImpl::SetDisabled
[c:/builds/seamonkey/mozilla/content/html/style/src/nsCSSStyleSheet.cpp, line 2713]
nsHTMLLinkElement::SetDisabled
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLLinkElement.cpp,
line 309]
XPTC_InvokeByIndex
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2025]
XPC_WN_GetterSetter
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1317]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 845]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936]
js_SetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2640]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2656]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 861]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936]
JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3433]
nsJSContext::CallEventHandler
[c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1043]
nsJSEventListener::HandleEvent
[c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 183]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1217]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1901]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 805]
DocumentViewerImpl::LoadComplete
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 963]
nsDocShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4277]
nsWebShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp, line 776]
nsDocShell::OnStateChange
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4211]
nsDocLoaderImpl::FireOnStateChange
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1213]
nsDocLoaderImpl::doStopDocumentLoad
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 867]
nsDocLoaderImpl::DocLoaderIsEmpty
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 765]
nsDocLoaderImpl::OnStopRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 695]
nsLoadGroup::RemoveRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 703]
imgRequestProxy::OnStopRequest
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 397]
imgRequest::RemoveProxy
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 142]
imgRequestProxy::Cancel
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 191]
nsImageFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsImageFrame.cpp, line 273]
nsFrameList::DestroyFrame
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 218]
nsBlockFrame::RemoveFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5020]
0x02ae9f8c
0x0224d338
0x0224d6fc
0x02ae9d48
0x02ae9dbc
0x02ae9e30
0x02ae9ea4
0x02ae9f18
0x02ae9f8c
0x0224d338
0x0224d6fc
0x02ae9d48
0x02ae9dbc
0x02ae9e30
0x02ae9ea4
0x02ae9f18
0x02ae9f8c
0x0224d338
0x0224d6fc
0x02ae9d48
0x02ae9dbc
0x02ae9e30

Comment 6

[Olivier Cahagne]

couldn't get Mozilla to crash on Linux (20030323 CVS).

Comment 7

[Olivier Cahagne]

crashes trunk build (2003032404) on Win2k. So far, only 1.3 branch crashes had
been reported.

Comment 8

[Matthias Versen [:Matti]]

-> Layout

Comment 9

[José Jeria]

Maybe this is a dupe of Bug 192469, a bug that was fixed after 1.3.

Comment 10

[Jay Patel [:jay]]

Mark:  Are you able to reproduce this with a recent Mozilla nightly?  This
problem was most likely fixed after the release of Mozilla 1.3.  Please let us
know if this still crashes for you with a newer build or release (try Mozilla
1.4 Alpha).

I'm going to mark this a dup of bug 192469 for now.  Please reopen if anyone
disagrees.  I don't see any crashes like this in recent MozillaTrunk Talkback data.

*** This bug has been marked as a duplicate of 192469 ***

Comment 11

[mark bokil]

I dont' see the crash anymore with the latest nightly build. But the dhtml I was
using to change the opacity of the image no longer seems to work at all. doing
document.getElementById(imageobject).style.MozOpacity=opacity triggered by a
mouse event has no effect. 

Comment 12

[Jay Patel [:jay]]

Mark:  Since the crash is gone, let's leave this bug as a dup.  Please log
another bug for the other issues you are seeing now.  Thanks.

v.dup