279612 - Corrupt jpeg image causes firefox to segfault [@ nsGenericElement::InsertChildAt ]

Status: RESOLVED DUPLICATE of bug 240592

(Firefox :: General, defect)

Description

[Thom May]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.5) Gecko/20050123 Firefox/1.0 (Ubuntu) (Ubuntu package 1.0+dfsg.1-2ubuntu3)
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.5) Gecko/20050123 Firefox/1.0 (Ubuntu) (Ubuntu package 1.0+dfsg.1-2ubuntu3)

Attempting to load the page causes firefox to crash reproducibly.

Reproducible: Always

Steps to Reproduce:
1.Load page
2.
3.

Actual Results:  
Browser segfaults

Expected Results:  
rendered jpeg correctly.

Comment 1

[Olivier Cahagne]

Confirming crash FF 1.0 WinXP, TB3261244H:

nsGenericElement::InsertChildAt 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2521]
nsGenericElement::doInsertBefore 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2888]
nsHTMLFrameSetElement::AppendChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLFrameSetElement.cpp,
line 61]
txEndElement::execute 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/extensions/transformiix/source/xslt/txInstructions.cpp,
line 487]
txXSLTProcessor::execute 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/extensions/transformiix/source/xslt/txXSLTProcessor.cpp,
line 99]
txMozillaXSLTProcessor::setStylesheet 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/extensions/transformiix/source/xslt/txMozillaXSLTProcessor.cpp,
line 667]

by way of bug 266888

*** This bug has been marked as a duplicate of 240592 ***