52796 - Crash after viewing webpage

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Biswapesh Chatterjee]

Build: Nightly build of 20000914 on WinNT4 SP6
Description: Mozilla becomes unstable after visiting 
http://www.msnbc.com/news/459031.asp?0na=2302230 .
Steps to reproduce:
1) Go to above URL.
2) Try to scroll down to the bottom of the page and vote.
3) See vote results.
4) Repeat.
Expected result : No crash.
Actual result: Crash
Reproducible: Intermittently.
Error: Exception: privileged instruction (0xc0000096), address 0x01a51a40.
Further infofrom Dr. Watson:
-----------------------------------------------------------------
State Dump for Thread Id 0xa7

eax=01a51a3c ebx=02450a70 ecx=02276590 edx=0012fab0 esi=01a56b6c edi=01a51a40
eip=01a51a40 esp=0012fc38 ebp=0012fc84 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206


function: <nosymbols>
        01a51a3e 0000             add     [eax],al                     
ds:01a51a3c=5c
FAULT ->01a51a40 6c               insb
        01a51a41 6ba50124542301   imul  esp,[ebp+0x23542401],0x1 
ss:23672085=????????
        01a51a48 b33e             mov     bl,0x3e
        01a51a4a 2160b0           and     [eax-0x50],esp         
ds:02950442=????????
        01a51a4d 6838018868       push    0x68880138
        01a51a52 3801             cmp     [ecx],al                     
ds:02276590=30
        01a51a54 0000             add     [eax],al                     
ds:01a51a3c=5c
        01a51a56 0000             add     [eax],al                     
ds:01a51a3c=5c
        01a51a58 2000             and     [eax],al                     
ds:01a51a3c=5c
        01a51a5a 0000             add     [eax],al                     
ds:01a51a3c=5c
        01a51a5c 3100             xor     [eax],eax              
ds:01a51a3c=0000005c
        01a51a5e 0000             add     [eax],al                     
ds:01a51a3c=5c

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0012fc84 60aa40c3 02450170 01a13b10 00000007 00000000 <nosymbols> 
0012fcc8 60af64f1 00000000 00000007 0012fd08 00000001 gkgfxwin!
NS_NewImageRenderer 
0012fcf0 60af23f3 02450130 00000007 0012fd08 02451f00 img3250!<nosymbols> 
0012fd2c 60af3439 02451f00 01a10750 02450010 0012fde0 img3250!<nosymbols> 
0012fd44 60af22d4 00000000 606b13ef 02450010 009004e0 img3250!IL_Type  (FPO: 
[EBP 0x01a10750] [1,0,4])
0012fd4c 606b13ef 02450010 009004e0 01a10750 606b1381 img3250!<nosymbols>  
(FPO: [1,0,0])
0012fd5c 606b1381 01a10750 01a11dc0 60aa4515 02451f00 nsgif!<nosymbols>  (FPO: 
[1,0,2])
0012fd68 60aa4515 02451f00 01a17190 60ae0b56 01a17190 nsgif!<nosymbols>  (FPO: 
[1,0,1])
0012fd74 60ae0b56 01a17190 01a11dc0 01a17190 60ae0681 gkgfxwin!
NS_NewImageRenderer  (FPO: [2,0,1])
0012fd84 60ae0681 00000000 77e7198f 60adcfc4 009004e0 gkwidget!
nsGetInterface::operator=  (FPO: [0,0,1])
0012fd90 60adcfc4 009004e0 00000000 00000000 80000000 gkwidget!
nsGetInterface::operator=  (FPO: [2,0,2])
01a10750 012343fc 00000010 00000051 01a63bc4 00000000 gkwidget!
nsGetInterface::operator= 
------------------------------------------------------------------

Comment 1

[Biswapesh Chatterjee]

Adding keyword. This URL has some problems with other browsers as well - there 
seems to be some missing closing tags as well - might be related to the 
unclosed tag crash bug (which I thought was already fixed ?)

Comment 2

[Doron Rosenberg (IBM)]

no crash on win98 2000091505

Comment 3

[Asa Dotzler [:asa]]

I see the crash. stack trace coming.

Comment 4

[Asa Dotzler [:asa]]

nsFrameImageLoader::NotifyFrames
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp,line571]
ntdll.dll+0x5066(0x77f65066)
ns_observer_proc
[d:\builds\seamonkey\mozilla\gfx\src\nsImageRequest.cpp,line135]
XP_NotifyObservers
[d:\builds\seamonkey\mozilla\modules\libutil\src\obs.c,line260]
il_image_complete_notify
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp,line329]
il_image_complete
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp,line1653]
ImgDCallbk::ImgDCBHaveImageAll
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp,line191]
process_buffered_gif_input_data
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp,line694]
gif_delay_time_callback
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp,line728]
timer_callback
[d:\builds\seamonkey\mozilla\gfx\src\nsImageSystemServices.cpp,line72]
nsTimer::Fire
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,line196]
nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp,line117]
nsAppShell::Run
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp,line116]

Comment 5

[Asa Dotzler [:asa]]

Confirmed with 091508 mozilla win32 build on NT.  Over to Layout.

Comment 6

[Kevin McCluskey (gone)]

Dividing up claytons bugs to triage.

Comment 7

[rods (gone)]

I can't get the page to load. I anot sure where to send it.

Comment 8

[rods (gone)]

I got it to load, something was horked so I restarted mozilla. marking works 
for me - because I can't duplicate the bug.

Comment 9

[Biswapesh Chatterjee]

I am still getting Mozilla to crash quite reliably on this page (Build 
2000091508 on WinNT4 SP6 - you just have to mess around a bit. Also, notice 
that the top banner loads thrice and the UI freezes during that period. Also, 
at least another person (see below) has been able to reproduce this.

Reopening.

Comment 10

[Roy Yokoyama]

I can't dup this bug on my W2K-JA.  Doesn't crush after voting.
Need more info.

Comment 11

[Darin Fisher]

Can the reporter please verify that this is still a crasher with a recent build.
Thanks!

Comment 12

[Biswapesh Chatterjee]

It doesn't crash any more - however I can't get the top banner to load either. 
Marking WORKSFORME since this is a different problem now.

Build 2000112120 WinNT4 SP6

Comment 13

[Darin Fisher]

added keyword verifyme.

Comment 14

[Biswapesh Chatterjee]

Verified WORKSFORME