[FIXr]renaming image referenced in css and browser crashes upon reload

VERIFIED FIXED in mozilla1.4beta

Status

()

Core
ImageLib
P1
critical
VERIFIED FIXED
15 years ago
15 years ago

People

(Reporter: Ralf Hauser, Assigned: bz)

Tracking

Trunk
mozilla1.4beta
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(4 attachments)

(Reporter)

Description

15 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030331
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030331

I took Eric's demo and adapted the css as follows: 
div#content {
    position: absolute;
    color: inherit; /* http://jigsaw.w3.org/css-validator wants this */
    background: rgb(233,233,233)
      url(hands-grey.gif) 0.0cm 2.4cm no-repeat fixed;
...

Reproducible: Always

Steps to Reproduce:
1. load a page based on the css (I do that on my harddrive as file:// not http://)
2. rename hands-grey.gif to hands-grey0.gif in the file explorer
3. click on reload (a few times e.g. 3)
Actual Results:  
the browser crashes

Expected Results:  
the background image would disappear or an error would be displayed
Any chance of attaching your modified HTML/CSS, with the URL to modify
clearly marked, to this bug?
(Reporter)

Comment 2

15 years ago
Created attachment 118957 [details]
i.html

a css and the jpg to follow
(Reporter)

Comment 3

15 years ago
Created attachment 118958 [details]
h.css
(Reporter)

Comment 4

15 years ago
Created attachment 118959 [details]
h.jpg

once you have loaded the page consisting of all three elements, rename the
h.jpg to h1.jpg and reload --> today's build of Mozilla dies
Taking bug... 
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Windows 2000 → All
Priority: -- → P1
Hardware: PC → All
Summary: renaming image referenced in css and browser crashes upon reload → [FIX]renaming image referenced in css and browser crashes upon reload
Target Milestone: --- → mozilla1.4beta
Component: Layout → ImageLib
QA Contact: ian → tpreston
Created attachment 118987 [details] [diff] [review]
Proposed patch
Comment on attachment 118987 [details] [diff] [review]
Proposed patch

So the problem is that if in LoadImage we have a cached request and this has no
validator _and_ the AsyncOpen fails (which it apparently does in this case...)
then the validator will be destroyed without ever getting an OnStartRequest
call.  The request will then be pointing to a stale mValidator and a crash will
ensue the next time we enter that codepath.

The fix is to have the imgCacheValidator destructor properly clear the
mValidator pointer on its mRequest (the other two changes are just random
cleanup).
Attachment #118987 - Flags: superreview?(jst)
Attachment #118987 - Flags: review?(pavlov)
taking, even...
Assignee: other → bzbarsky
Comment on attachment 118987 [details] [diff] [review]
Proposed patch

sr=jst
Attachment #118987 - Flags: superreview?(jst) → superreview+

Comment 10

15 years ago
Comment on attachment 118987 [details] [diff] [review]
Proposed patch

r=pavlov
Attachment #118987 - Flags: review?(pavlov) → review+
Summary: [FIX]renaming image referenced in css and browser crashes upon reload → [FIXr]renaming image referenced in css and browser crashes upon reload
Fix checked in for 1.4b.  Thanks for the testcase, Ralf!
Status: NEW → RESOLVED
Last Resolved: 15 years ago
Resolution: --- → FIXED

Comment 12

15 years ago
Verified in the 2003-04-23-03 Macho and 2003-04-22-08 Win32 trunk builds.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.