Crash [@ imgContainerGIF::GetFrameAt ] trying to "copy image" on the error message from an image with errors.

VERIFIED DUPLICATE of bug 329889

Status

()

--
critical
VERIFIED DUPLICATE of bug 329889
13 years ago
13 years ago

People

(Reporter: bjcffnet, Assigned: pavlov)

Tracking

({crash, regression, testcase})

Trunk
x86
All
crash, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

13 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

If you right on the error message given by an image with errors, (The image "..." cannot be displayed, because it contains errors.) you get an option in the menu that comes up to "Copy Image." If you click on that, firefox crashes.

Reproducible: Always

Steps to Reproduce:
1. Visit http://bjcffnet.5gigs.com/notagif.gif (Or another corruped image)
2. Right click on the error message (This image cannot be displayed ...)
3. Click on Copy Image
Actual Results:  
Firefox crashes

Expected Results:  
An error message, since you can't copy an image with errors.

It only seems to crash with corrupted gif images, but I didn't really test that much with png/jpg files.
Talkback ID: TB13065000Q

Stack Signature	 imgContainerGIF::GetFrameAt 0e306ef7
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2005-12-17 14:32:33.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (000f1a53)
URL visited	
User Comments	
Since Last Crash	10320 sec
Total Uptime	1058064 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/modules/libpr0n/decoders/gif/imgContainerGIF.cpp, line 142
Stack Trace 	
imgContainerGIF::GetFrameAt  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/modules/libpr0n/decoders/gif/imgContainerGIF.cpp, line 142]
nsCopySupport::ImageCopy  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsCopySupport.cpp, line 435]
DocumentViewerImpl::CopyImage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 2364]
nsClipboardImageCommands::DoClipboardCommand  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindowCommands.cpp, line 615]
nsClipboardBaseCommand::DoCommand  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindowCommands.cpp, line 454]
nsControllerCommandTable::DoCommand  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/embedding/components/commandhandler/src/nsControllerCommandTable.cpp, line 191]
nsBaseCommandController::DoCommand  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp, line 132]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2139]
XPC_WN_CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4158]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1411]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1685]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1786]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2153]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1982]
PresShell::HandleDOMEventWithTarget  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6466]
nsMenuFrame::Execute  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1641]
nsMenuFrame::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 452]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6408]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6203]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1252]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 5982]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6233]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1434]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)
Status: UNCONFIRMED → NEW
Component: General → ImageLib
Ever confirmed: true
Product: Firefox → Core
Summary: crash trying to "copy image" on the error message from an image with errors. → Crash [@ imgContainerGIF::GetFrameAt ] trying to "copy image" on the error message from an image with errors.
Version: unspecified → 1.8 Branch
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20051111 Firefox/1.5 ID:2005111116
I see this too.
TBID TB13065096K
Assignee: nobody → pavlov
QA Contact: general
Does not occur with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Keywords: regression
Created attachment 206200 [details]
testcase from reporter's URL

Updated

13 years ago
Keywords: testcase

Comment 5

13 years ago
this is probably a "regression" from the copy-image-location => copy-image switch.
OS: Windows XP → All
Version: 1.8 Branch → Trunk
Flags: blocking1.8.1?

Comment 6

13 years ago
Created attachment 221069 [details] [diff] [review]
Add extra check

This extra check fixes the crash.
Attachment #221069 - Flags: review?

Updated

13 years ago
Attachment #221069 - Flags: review? → review?(pavlov)

Comment 7

13 years ago
This looks like a duplicate of bug 329889, which has been fixed on trunk and all branches.

Peter: I commited a very similar patch.

*** This bug has been marked as a duplicate of 329889 ***
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → DUPLICATE

Comment 8

13 years ago
v dupe

(I just don't understand why cvs diff didn't show me the existing change in the tree?!)
Status: RESOLVED → VERIFIED

Updated

13 years ago
Flags: blocking1.8.1?
Crash Signature: [@ imgContainerGIF::GetFrameAt ]
You need to log in before you can comment on or make changes to this bug.