55493 - crash when clicking in a image to make it bigger

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Jose Manuel Román Ramírez]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.14-5.0 i586; en-US; m18) Gecko/20001005
BuildID:    2000100521

The browser crashes when trying to open an image at '
http://www.worldonline.es/channels/noc/index.php3?idcanal=noc&sub=39&sec=30&art=52878',
to make the picture bigger. The page uses JavaScript to create another window
and display the image there.					

Reproducible: Always
Steps to Reproduce:
The browser crashes when trying to open an image at '
http://www.worldonline.es/channels/noc/index.php3?idcanal=noc&sub=39&sec=30&art=52878',
to make the picture bigger. The page uses JavaScript to create another window
and display the image there. 	

Actual Results:  the navigator crashed...					

Expected Results:  Open a photo...

Comment 1

[R.K.Aa.]

*** Bug 55494 has been marked as a duplicate of this bug. ***

Comment 2

[Phil Schwartau]

Confirming crash using WinNT debug MN6 branch build pulled 2000-10-16.
Stack trace: 


PresShell::~PresShell() line 1281 + 15 bytes
PresShell::`scalar deleting destructor'() + 15 bytes
PresShell::Release(PresShell * const 0x03419410) line 1199 + 158 bytes
nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 490
ReflowEvent::HandleEvent() line 4581 + 8 bytes
HandlePLEvent(ReflowEvent * 0x039c9090) line 4589
PL_HandleEvent(PLEvent * 0x039c9090) line 580 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00ac3c00) line 513 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x076f0148, unsigned int 49369, unsigned int 0, 
long 11287552) line 1049 + 9 bytes
USER32! 77e71820()
00ac3c00()



WHERE THE DEBUGGER WAS POINTING TO IN PresShell():

 if (mViewManager) {
    // Disable paints during tear down of the frame tree
    mViewManager->DisableRefresh();  <<<<<<<<<<<<<<<<<<<<<< STOPPED HERE
    mViewManager = nsnull;
  }


SOME MEMORY ADDRESSES AT THIS POINT:

mHistoryState	0x00000000

mViewManager	0x03407390
    nsISupports	{...}
       __vfptr	0xdddddddd

Comment 3

[rickg]

I see the same stack trace on win2K. The view manager has already been released 
(it's memory is filled with 0xddddddd). 

Comment 4

[Phil Schwartau]

NOTE: even before you click on a photo and crash, the layout of the
      photos is evidently wrong. They are distributed unevenly on the
      page (compare in NN4.x). Some photos even overlap each other...


Reassigning to Layout for further triage -

Comment 5

[karnaze (gone)]

Reassigning to Kevin for further inspection.

Comment 6

[Kevin McCluskey (gone)]

Added crash keyword. 

Comment 7

[Kevin McCluskey (gone)]

Vidur: Weren't you looking at the issue of who own's the view manager and
controls it's lifetime? This is a case where the viewmanager is destroyed by the
DocumentViewer when it goes away, later the nsPresShell is destroyed. The
presShell has only a weak reference to the viewmanager so it accesses a stale
mViewManager pointer in the nsPresShell's destructor.

Comment 8

[Kevin McCluskey (gone)]

No longer crashes in todays branch build on WINNT. Someone must have checked in
a fix which guarantees that the PresShell goes away before the document viewer.
Marking WORKSFORME.

Comment 9

[Chris Petersen]

Marking works for me in the Oct 25th builds.