52494 - crash when being redirected to the members page

Status: VERIFIED DUPLICATE of bug 53317

(Core :: Layout, defect, P2)

Description

[mozilla]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; m18) Gecko/20000913
BuildID:    2000091308

when i load the hotlinks page i get a request to auto-fill my account date (i
have 2 accounts)
after this i get redirected to the members page at that time mozilla allways
crashes when the page loading completes
error message bellow:
MOZILLA caused an invalid page fault in
module <unknown> at 0000:00af1e6a.
Registers:
EAX=017c2b43 CS=017f EIP=00af1e6a EFLGS=00010207
EBX=023c7cd0 SS=0187 ESP=0068fab4 EBP=0068fafc
ECX=026c4160 DS=2b6c ESI=01c0aab0 FS=1bef
EDX=0068f928 ES=0187 EDI=016acaf6 GS=0000
Bytes at CS:EIP:
d2 60 36 47 d2 60 30 6a af 00 00 00 00 00 70 1f
Stack dump:
026b0bc0 023c7cd0 00af1e8c 01c0aab8 00000003 00000002 023c7cd4 00000000 016aca98
00000000 023c3580 00000000 0068fb80 00000000 00000000 00000000

Reproducible: Always
Steps to Reproduce:
1.start mozilla
2.go to http://www.hotlinks.com
3.popup comes up asking for which username to auto fill-in
4.you get redirected to the member page
5.page load completes followed by crash

Actual Results:  crash

Expected Results:  page displayed and no crash

Comment 1

[Tom Everingham]

confirming and re-assigning 

Adding talkback rpt:

Call Stack:    (Signature = 0x1bd59790 8810b280) 
0x1bd59790 
ns_observer_proc 
[d:\builds\seamonkey\mozilla\gfx\src\nsImageRequest.cpp, line 135]
XP_NotifyObservers 
[d:\builds\seamonkey\mozilla\modules\libutil\src\obs.c, line 260]
il_image_complete_notify 
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 329]
il_image_complete 
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 1653]
ImgDCallbk::ImgDCBHaveImageAll 
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 191]
process_buffered_gif_input_data 
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp, line 694]
gif_delay_time_callback 
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp, line 728]
timer_callback 
[d:\builds\seamonkey\mozilla\gfx\src\nsImageSystemServices.cpp, line 72]
nsTimer::Fire 
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 196]
nsAppShell::Run 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp, line 116]

Comment 2

[Tom Everingham]

.

Comment 3

[Asa Dotzler [:asa]]

also seeing the crash with that same stack plus gettign a little further: 
nsFrameImageLoader::NotifyFrames
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp,line567]
nsFrameImageLoader::Notify
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp,line537]
ns_observer_proc
[d:\builds\seamonkey\mozilla\gfx\src\nsImageRequest.cpp,line135]
XP_NotifyObservers
[d:\builds\seamonkey\mozilla\modules\libutil\src\obs.c,line260]
il_image_complete_notify
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp,line329]
il_image_complete
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp,line1653]
ImgDCallbk::ImgDCBHaveImageAll
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp,line191]
process_buffered_gif_input_data
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp,line694]
gif_delay_time_callback
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp,line728]
timer_callback
[d:\builds\seamonkey\mozilla\gfx\src\nsImageSystemServices.cpp,line72]
nsTimer::Fire
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,line196]
nsAppShell::Run
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp,line116]

Comment 4

[buster]

I just got this same crash.  Mentioning it just to help determine frequency, I
was surfing and I don't know the exact URL, though it was on
http://www.quote.com somewhere.  Suggest this be bumped up to a P2 at least.  I
am running debug bits from 9/17/00 on WinNT.

Comment 5

[Gagan]

*** Bug 23882 has been marked as a duplicate of this bug. ***

Comment 6

[pnunn]

Attinasi:
  I'm not sure but I think this one may be in your area. I don't see the
  gif timer in my call stack. I see something odd with the image frames.

  I'll attach my call stack. Before the crash I get an assert about the
  mChannels count and mForegroundcount being 11 instead of 0. 

  Going on to the final crash I see the following:
If you take a look at 
http://lxr.mozilla.org/seamonkey/source/layout/base/src/nsFrameImageLoader.cpp#5
61
nsFrameImageLoader:: NotifyFrames() om nsFrameImageLoader.cpp

mFrames is good with the following values:
   -	mFrames	0x04078aa0
+	mNext	0x04072de0
+	mFrame	0x01247060
	mCallBack	0x02321ce0 nsHTMLImageLoader::ImageLoadCB(nsIPresContext 
*, nsIFrameImageLoader *, nsIFrame *, void *, unsigned int)
	mClosure	0x0124708c
	mKey	0x01247060
	mNeedSizeUpdate	0

when you set pfdp = &mFrames, pfdp doesn't point to anything reasonable:
-	pfdp	0x0406af20
+		0xdddddddd

Since pfd is what's in pfdp, it is now pointing to 0xdddddddd. This eventually
causes a crash when its dereferenced.

If you continue to see the gif timer create a crash, let me know. In the past,
I have seen it crash when frames are not successfully released.

-P

Comment 7

[pnunn]

Attachment: callstack

Comment 8

[pnunn]

fyi, the image data looks fine through il_image_complete
and il_image_complete_notify.
The image in question is 
"http://www.hotlinks.com/homepage/1pixel_blue.gif"

Comment 9

[pnunn]

*** Bug 53434 has been marked as a duplicate of this bug. ***

Comment 10

[Marc Attinasi]

Yes, I see the crash too. Accepting; I'll check it out. Also, updating the
priority and platform/os fields (saw it on NT).

Comment 11

[Jay Patel [:jay]]

based on asa's comments from 9/13...might this bug be a dup of 53317?

Comment 12

[Marc Attinasi]

Yes, it looks exactly like bug 53317, and that bug has a patch attached too.

Marking as a dup - please verify when 53317 is fixed.


*** This bug has been marked as a duplicate of 53317 ***

Comment 13

[David :Bienvenu]

my patch fixes this crash too.