27249 - crash when going from slashdot to freshmeat using back context menu

Status: VERIFIED DUPLICATE of bug 28781

(Core :: DOM: Navigation, defect, P3)

Description

[a-huntwork]

This is using a build pulled 2-10-00, but it also occurred in a 2-08/09-00
build.  It's completely reproducible for me.

If you go to my.netscape.com, then go to another site, then use the back option
on the context menu, mozilla crashes.  More specifically, my.netscape.com is my
homepage.  It contains a link to freshmeat.net.  If I click on that link, wait
for freshmeat to load, then right click on the page and choose the "back"
option, the browser crashes.  This also works navigating to linuxtoday.com.

Comment 1

[a-huntwork]

I get this crash every time I go to slashdot.org from freshmeat.net using the
link on freshmeat.net.  I clobbered and pulled 2/27.  If I can help diagnose
this bug any more, just tell me how.  It's my least favorite bug around.  Here's
a bt:
#0  0x4134dfb1 in nsFrameImageLoader::DamageRepairFrames (this=0x8d9d778,
    aDamageRect=0xbffff634) at nsFrameImageLoader.cpp:558
#1  0x4134dbda in nsFrameImageLoader::Notify (this=0x8d9d778,
    aImageRequest=0x8d9d7d8, aImage=0x8e4f5c0,
    aNotificationType=nsImageNotification_kPixmapUpdate, aParam1=0, aParam2=0,
    aParam3=0xbffff678) at nsFrameImageLoader.cpp:419
#2  0x4002f3fe in ns_observer_proc (aSource=0x8d9d850, aMsg=4,
    aMsgData=0xbffff6fc, aClosure=0x8d9d7d8) at nsImageRequest.cpp:95
#3  0x40040ade in XP_NotifyObservers (inObserverList=0x8c446d0, inMessage=4,
    ioData=0xbffff6fc) at obs.c:259
#4  0x4003693b in il_pixmap_update_notify (ic=0x8d9d898) at if.cpp:307
#5  0x4003eac3 in il_flush_image_data (ic=0x8d9d898) at scale.cpp:218
#6  0x40036527 in ImgDCallbk::ImgDCBFlushImage (this=0x8c25478) at if.cpp:162
#7  0x415c7127 in il_gif_write (ic=0x8d9d898, buf=0x415c8cd3 "", len=0)
    at gif.cpp:1500
#8  0x415c4ee0 in process_buffered_gif_input_data (gs=0x8e4ef50) at gif.cpp:669
#9  0x415c5090 in gif_delay_time_callback (closure=0x8d9d898) at gif.cpp:725
#10 0x400300bc in timer_callback (aTimer=0x87caec0, aClosure=0x8da81f8)
    at nsImageSystemServices.cpp:71
#11 0x40786665 in nsTimerGtk::FireTimeout (this=0x87caec0) at nsTimerGtk.cpp:58
#12 0x40786be6 in nsTimerExpired (aCallData=0x87caec0) at nsTimerGtk.cpp:175
#13 0x407cea04 in g_timeout_dispatch () from /usr/lib/libglib-1.2.so.0
#14 0x407cdbe6 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#15 0x407ce1a1 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#16 0x407ce341 in g_main_run () from /usr/lib/libglib-1.2.so.0
#17 0x40a12339 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#18 0x40935d07 in nsAppShell::Run (this=0x8131248) at nsAppShell.cpp:304
#19 0x4064caad in nsAppShellService::Run (this=0x812ac28)
    at nsAppShellService.cpp:399
#20 0x804e60e in main1 (argc=1, argv=0xbffffc04, splashScreen=0x0)
    at nsAppRunner.cpp:763
#21 0x804eba0 in main (argc=1, argv=0xbffffc04) at nsAppRunner.cpp:883

Comment 2

[Kevin Puetz]

Confirmed slashdot -> freshmeat and back to freshmeat via the contextual menu

segfaults (linux/powerpc).

Comment 3

[a-huntwork]

In my previous comment, it's not going to slashdot that causes segfault, it's
going back from there.  Sorry for the misinformation.  According to puetzk, this
also manifests itself as other context menu crashes, based on the stack trace.

Comment 4

[Kevin Puetz]

I've seen this crasher in other situations as well involving the contextual
menus (save as, open in new window) now that I look at the stack trace more
closely. However, it stopped being repeatable the next day (new build, changes
to the sites, I don't know what) so I assumed it was fixed. Apparently not.

I would say it's probably a layout crash, not a history crash...

Comment 5

[a-huntwork]

*** This bug has been marked as a duplicate of 28781 ***

Comment 6

[Claudius Gayle]

that's the bug I was looking for! good umm, huntwork. VERIFIED Dupe.