198591 - MNG example crashes Mozilla

Status: RESOLVED DUPLICATE of bug 156540

(Core :: Graphics: ImageLib, defect)

Description

[Mark Tranchant]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312

Loading up the referenced URL reliably crashes Mozilla 1.3/Win2k.

Reproducible: Always

Steps to Reproduce:
1. Load up the URL
2. Wait a couple of seconds

Actual Results:  
Crash ("mozilla.exe has generated errors...")

Expected Results:  
Shown the image, or at least not crashed.

I don't believe this is a duplicate of <a
href="http://bugzilla.mozilla.org/show_bug.cgi?id=196670">196670</a> as I can
see those images with no problem.

Comment 1

[Mark Tranchant]

Also crashes on any of the delta <IMG> MNG examples at
http://www.libmng.com/MNGsuite/

Comment 2

[Jo Hermans]

Confirmed on Windows NT with Mozilla 1.3
Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3) Gecko/20030312

Talkback-ID : TB 1832159K

Is this bug 156540 ?

Comment 3

[Mark Tranchant]

That bug claims to be fixed, so I would hope not—although the movie.mng
link in one of the comments on that bug report also crashes here.

Comment 4

[Adam Hauner]

Problematic image:
http://www.libmng.com/MNGsuite/images/Delta-rgb-a8b.mng

20030308/1.3branch/W2K -> TB18330784H, TB18330826G
2003031408/trunk/W2K -> WFM

Comment 5

[Olivier Cahagne]

Doesn't crash on Linux trunk 2003032108.

Comment 6

[Jo Hermans]

worksforme in build 2003032108 (trunk) on Mac OS X - it seems that the recent
MNG 1.0.5 checkin has fixed this.

Comment 7

[Hermann Schwab]

confirming crash with Mozilla 1.3 on Win98 SP1: TB18340504H
not crashing with Trunk Build ID 2003031708

Comment 8

[David Bradley]

Attachment: Talkback stack ID18330826

Looks like heap corruption or freeing of a pointer that wasn't allocated by the
heap.

Comment 9

[Christian :Biesinger (don't email me, ping me on IRC)]

stack is basically the same as attachment 107243 [details] which is part of bug 156540,
and given that this was only reproduced on 1.3final it looks like the mng 1.0.5
checkin fixed this.

*** This bug has been marked as a duplicate of 156540 ***

Comment 10

[Glenn Randers-Pehrson]

I'm not sure it is a dupe of bug #156540, which wfm on W95 Moz 1.3 20030312
This one gave me a horrific crash.  First I got the "X This program has
performed an illegal operation" window overlaid on the Talkback window,
but the cursor was a nonresponsive hourglass.  After a while I issued
CTRL-ALT-DEL and got a BSOD followed by a scrambled unreadable screen
which remained until I issued a double CTRL-ALT-DELETE.

Comment 11

[Jim Dunn]

This wfm on win2k using build 2003042204 build.
I am assuming 1.4 a/b-ish builds also have this fix.
However this is all moot now since bug 195280
removed MNG support.  There is a way to apply MNG
support to a trunk build but it won't be present in
typical mozilla builds.

Leaving DUP fixed

Comment 12

[Glenn Randers-Pehrson]

WFM also, with Moz 1.4b 2003051014 on W95. Added dependency on bug #18540.  I
think it should be marked RESOLVED FIXED not RESOLVED DUPE, although I'm not
sure what the fix was, exactly.

Comment 13

[Glenn Randers-Pehrson]

typo in previous comment, should be bug # 18574.