Closed
Bug 197573
Opened 21 years ago
Closed 21 years ago
crash if MozOpacity is called for an image object before it has been created - M130 [@ DoDeletingFrameSubtree ]
Categories
(Core :: Layout, defect)
Tracking
()
VERIFIED
DUPLICATE
of bug 192469
People
(Reporter: mbokil, Unassigned)
References
()
Details
(Keywords: crash)
Crash Data
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312 In the page http://bokil.com/index.php?content=portabella, the image at the bottom which has javascript attached to it to change the opacity of the image can cause Mozilla to crash if the user rolls over the image before the image has fully downloaded. To see this behavior restrict the bandwidth to a 56K modem level and as the image renders on the screen roll over it. Mozilla crashes. Reproducible: Always Steps to Reproduce: 1. Go to the page http://bokil.com/index.php?content=portabella using a 56K modem 2. Rollover the image portabell-01.jpg at the bottom of the page before the image has fully loaded. 3. Fatal crash takes down Mozilla. Actual Results: Fatal Mozilla crash. Talkback appeared asking for bug info. Mozilla had to be restarted. Expected Results: A javascript error should have been caught indicating the referenced image object was null. From the UI the standard javascript error dialog box should appear indicating the ID of the null object referened. This bug is easier to see on a reduced bandwidth connection. I could trigger the crash everytime using a 56K modem and clearing out the cache first.
Reporter | ||
Comment 1•21 years ago
|
||
The offending javascript that caused the crash on the page was: // lightup crossbrowser image opacity changer function lightup(imageobject, opacity) { if (navigator.appName.indexOf("Netscape") !=-1 && parseInt(navigator.appVersion)>=5) { document.getElementById(imageobject).style.MozOpacity=opacity+'%'; } else if (navigator.appName.indexOf("Microsoft") != -1 && parseInt(navigator.appVersion)>=4) { // gota luv that M$ syntax for opacity, eh? document.getElementById(imageobject).style.filter = "progid:DXImageTransform.Microsoft.Alpha(opacity="+opacity+")"; } }
Reporter | ||
Comment 3•21 years ago
|
||
Talkback ID: TB18103121H
Updated•21 years ago
|
Keywords: stackwanted
Whiteboard: TB18103121H
Comment 4•21 years ago
|
||
could be dupe of bug 192469.
Comment 5•21 years ago
|
||
Incident ID 18103121 Stack Signature DoDeletingFrameSubtree 1a034e91 Email Address mbokil@bokil.com Product ID MozillaBranch Build ID 2003031211 Trigger Time 2003-03-15 09:30:16 Platform Win32 Operating System Windows NT 5.0 build 2195 Module gklayout.dll URL visited http://bokil.com/index.php?content=portabella User Comments I mouseovered an image that had javascript which was changing the opacity of the image. Apparently the image was not yet fully loaded and a fatal exception was not caught. In javascript if an image object is not yet loaded you should get an object is null error in a dialog box. Currently it takes down Mozilla -- not good. Trigger Reason Access violation Source File Name c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp Trigger Line No. 9525 Stack Trace DoDeletingFrameSubtree [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 9525] DoDeletingFrameSubtree [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 9542] DoDeletingFrameSubtree [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 9542] DeletingFrameSubtree [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 9588] nsCSSFrameConstructor::ContentRemoved [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 9893] nsCSSFrameConstructor::RecreateFramesForContent [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 12155] nsCSSFrameConstructor::ProcessRestyledFrames [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp, line 10393] PresShell::ReconstructStyleData [c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5418] PresShell::StyleSheetApplicableStateChanged [c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5485] nsDocument::SetStyleSheetApplicableState [c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 1691] CSSStyleSheetImpl::SetDisabled [c:/builds/seamonkey/mozilla/content/html/style/src/nsCSSStyleSheet.cpp, line 2713] nsHTMLLinkElement::SetDisabled [c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLLinkElement.cpp, line 309] XPTC_InvokeByIndex [c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102] XPCWrappedNative::CallMethod [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2025] XPC_WN_GetterSetter [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1317] js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 845] js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936] js_SetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2640] js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2656] js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 861] js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936] JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3433] nsJSContext::CallEventHandler [c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1043] nsJSEventListener::HandleEvent [c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 183] nsEventListenerManager::HandleEventSubType [c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line 1217] nsEventListenerManager::HandleEvent [c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line 1901] GlobalWindowImpl::HandleDOMEvent [c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 805] DocumentViewerImpl::LoadComplete [c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 963] nsDocShell::EndPageLoad [c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4277] nsWebShell::EndPageLoad [c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp, line 776] nsDocShell::OnStateChange [c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4211] nsDocLoaderImpl::FireOnStateChange [c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1213] nsDocLoaderImpl::doStopDocumentLoad [c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 867] nsDocLoaderImpl::DocLoaderIsEmpty [c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 765] nsDocLoaderImpl::OnStopRequest [c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 695] nsLoadGroup::RemoveRequest [c:/builds/seamonkey/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 703] imgRequestProxy::OnStopRequest [c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 397] imgRequest::RemoveProxy [c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 142] imgRequestProxy::Cancel [c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 191] nsImageFrame::Destroy [c:/builds/seamonkey/mozilla/layout/html/base/src/nsImageFrame.cpp, line 273] nsFrameList::DestroyFrame [c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 218] nsBlockFrame::RemoveFrame [c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5020] 0x02ae9f8c 0x0224d338 0x0224d6fc 0x02ae9d48 0x02ae9dbc 0x02ae9e30 0x02ae9ea4 0x02ae9f18 0x02ae9f8c 0x0224d338 0x0224d6fc 0x02ae9d48 0x02ae9dbc 0x02ae9e30 0x02ae9ea4 0x02ae9f18 0x02ae9f8c 0x0224d338 0x0224d6fc 0x02ae9d48 0x02ae9dbc 0x02ae9e30
Summary: crash if MozOpacity is called for an image object before it has been created → crash if MozOpacity is called for an image object before it has been created - [@ DoDeletingFrameSubtree]
Comment 6•21 years ago
|
||
couldn't get Mozilla to crash on Linux (20030323 CVS).
Keywords: stackwanted
Summary: crash if MozOpacity is called for an image object before it has been created - [@ DoDeletingFrameSubtree] → crash if MozOpacity is called for an image object before it has been created - [@ DoDeletingFrameSubtree ]
Whiteboard: TB18103121H
Comment 7•21 years ago
|
||
crashes trunk build (2003032404) on Win2k. So far, only 1.3 branch crashes had been reported.
Comment 8•21 years ago
|
||
-> Layout
Assignee: asa → other
Component: Browser-General → Layout
QA Contact: asa → ian
Comment 9•21 years ago
|
||
Maybe this is a dupe of Bug 192469, a bug that was fixed after 1.3.
Comment 10•21 years ago
|
||
Mark: Are you able to reproduce this with a recent Mozilla nightly? This problem was most likely fixed after the release of Mozilla 1.3. Please let us know if this still crashes for you with a newer build or release (try Mozilla 1.4 Alpha). I'm going to mark this a dup of bug 192469 for now. Please reopen if anyone disagrees. I don't see any crashes like this in recent MozillaTrunk Talkback data. *** This bug has been marked as a duplicate of 192469 ***
Status: UNCONFIRMED → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
Summary: crash if MozOpacity is called for an image object before it has been created - [@ DoDeletingFrameSubtree ] → crash if MozOpacity is called for an image object before it has been created - M130 [@ DoDeletingFrameSubtree ]
Reporter | ||
Comment 11•21 years ago
|
||
I dont' see the crash anymore with the latest nightly build. But the dhtml I was using to change the opacity of the image no longer seems to work at all. doing document.getElementById(imageobject).style.MozOpacity=opacity triggered by a mouse event has no effect.
Comment 12•21 years ago
|
||
Mark: Since the crash is gone, let's leave this bug as a dup. Please log another bug for the other issues you are seeing now. Thanks. v.dup
Status: RESOLVED → VERIFIED
Updated•13 years ago
|
Crash Signature: [@ DoDeletingFrameSubtree ]
You need to log in
before you can comment on or make changes to this bug.
Description
•