41630 - [crash] Clicking links causes Mozilla to crash

Status: VERIFIED WORKSFORME

(Core :: Graphics: ImageLib, defect, P3)

Description

[WD]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.12-20 i586; en-US; m16) Gecko/20000605
BuildID:    2000060508

When clicking the links above the streaming webcam picture, mozilla crashes.
 The links are just regular hyperlinks.  They are in a frame and they should
cause the appropriate page to appear in the main frame, below the links.

Reproducible: Always
Steps to Reproduce:
1.Visit :  http://dormcam.mine.nu:8080/index1.shtml
2.Click one of the links above the picture.   (such as "Photo Gallery")
3.

Actual Results:  Mozilla Crashes	

Expected Results:  The page comes up	

Perhaps the crash has to do with the webcam code in the main frame that allows
the video feed to work?   (JavaScript)

Comment 1

[John Dobbins]

Tested with build 2000060508 on Win 98 SE
All links work in Windows, NO Crash.
Linux Only?

Comment 2

[WD]

It happens every time with my Linux system.    It also happened each time with 
my Win98SE system at work.      It happened earlier this evening on my Win95 
system.        I just tried it now, but it did work.   (didn't change Mozilla 
build or anything)   I'll try to see if I can figure out some sort of pattern to 
what causes it....

On my linux system, when it crashes, the last thing it displays in the terminal 
window is:    *** check number of frames in content area

Comment 3

[Asa Dotzler [:asa]]

adding keyword crash

Comment 4

[Asa Dotzler [:asa]]

Sorry for the spam.  New QA Contact for Browser General.  Thanks for your help
Joseph (good luck with the new job) and welcome aboard Doron Rosenberg

Comment 5

[WD]

Note:   I run a website with the address http://dormcam.mine.nu:8080
The machine's alias is called "dickey"     (127.0.0.1)

When I type in http://dormcam.mine.nu:8080 , it seems to work ok
When I type in http://dickey   , it'll crash when I click on the links.

Comment 6

[WD]

Ok.  sorry for the spam.
As it turns out, the URL whether or not I use the alias or full name does *not*
matter.   It will crash either way.   The thing is, it doesn't happen every
time.   Perhaps about 1/3 of the time?       If it doesn't crash for you, re-
load the page and try clicking "Photo gallery" again.

Comment 7

[Asa Dotzler [:asa]]

[e-mail] can you give us a stack trace or grab M16 with Talkback 
and try to reproduce the crash.  If talkback works I can get the stacktrace and 
we can try to get this assigned.  

Comment 8

[John Dobbins]

Tested with build 2000061708 (talkback)on Win 98 SE
This time it DID crash on me, when I went to the page. I didn't even get a 
chance to try the link. No talkback was generated. crash 3 times in a row as 
soon as page loaded.

Win reports
MOZILLA caused an invalid page fault in
module GKHTML.DLL at 017f:602b09f9.
Registers:
EAX=00000000 CS=017f EIP=602b09f9 EFLGS=00010246
EBX=02af4ce4 SS=0187 ESP=0068e304 EBP=0068e324
ECX=00000000 DS=0187 ESI=00000000 FS=7dc7
EDX=602ebfb4 ES=0187 EDI=029c8510 GS=0000
Bytes at CS:EIP:
8b 01 ff 50 14 8b 4d f4 89 45 f4 3b ce 74 06 8b 
Stack dump:
029c8510 00000003 00000000 00000002 41700000 00000000 00000000 00000000 0068e4b8 
601c0626 02aef570 02af4ce4 027117b0 60cdbe7c 02aef570 0068e4ac 

Comment 9

[WD]

I get no talkback with the crash, but here's what Win95/Norton Crashguard tells 
me:

Windows 95 Version 4.00.1212
MOZILLA.EXE caused fault #c0000005 in GKHTML.DLL at address 017f:602b09f9

Registers:
EAX=00000000 CS=017f EIP=602b09f9 EFLGS=00010246
EBX=01a18644 SS=0187 ESP=0068e020 EBP=0068e040
ECX=00000000 DS=0187 ESI=00000000 FS=697f
EDX=602ebfb4 ES=0187 EDI=028a96b0 GS=0000

Bytes at CS:EIP:
8b 01 ff 50 14 8b 4d f4 89 45 f4 3b ce 74 06 8b

Stack dump:
028a96b0 00000003 00000000 00000002 41700000 00000000 00000000 00000000 0068e1d4 
601c0626 01a1fe30 01a18644 02849e10 60cdbe7c 01a1fe30 0068e1c8

Comment 10

[Asa Dotzler [:asa]]

OK< I got this to crash. Reloading the main page about three times produced a
crash with a talkback report. Stack trace from Talkback below.  reassigning and
setting default owner.


   ImageConsumer::OnDataAvailable

[d:\builds\seamonkey\mozilla\gfx\src\nsImageNetContextAsync.cpp, line 370]

   nsMultiMixedConv::SendData

[d:\builds\seamonkey\mozilla\netwerk\streamconv\converters\nsMultiMixedConv.cpp,
line 434]

   nsMultiMixedConv::OnDataAvailable

[d:\builds\seamonkey\mozilla\netwerk\streamconv\converters\nsMultiMixedConv.cpp,
line 199]

   nsDocumentOpenInfo::OnDataAvailable

[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 252]

   nsHTTPFinalListener::OnDataAvailable

[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp,
line 1232]

   InterceptStreamListener::OnDataAvailable

[d:\builds\seamonkey\mozilla\netwerk\cache\mgr\nsCachedNetData.cpp, line 1165]

   nsHTTPServerListener::OnDataAvailable

[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp,
line 557]

   nsOnDataAvailableEvent::HandleEvent

[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 407]

   nsStreamListenerEvent::HandlePLEvent

[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 106]

   PL_HandleEvent

[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 588]

   PL_ProcessPendingEvents

[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 547]

   _md_EventReceiverProc

[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1045]

   USER32.dll + 0x1820 (0x77e71820)

Comment 11

[pnunn]

I get a crash in a different place. BodyFixupRule::MapStyleInto() in
nsHTMLBodyElement.cpp in layout/html/content/src

I'll take a look and reassign if necessary.
-p

Comment 12

[pnunn]

This works for me with yesterday's build on nt and monday's linux
build.
I'm marking works for me. Reopen if your mileage differs.

-p

Comment 13

[Paul Wyskoczka]

Verified