61591 - crash stack: il_delete_client

Status: VERIFIED DUPLICATE of bug 61756

(Core :: Graphics: ImageLib, defect, P3)

Description

[timtas]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.18pre24 i686; en-US; m18) Gecko/20001129
BuildID:    20000112921

If I choose this URL, the Browser crashes. The page is known to work with IE5
and NS4 on Windows and NS4 on Linux at least.

Reproducible: Always
Steps to Reproduce:
Type the URL in the location bar and press enter.

Actual Results:  The page starts to appear and then the browser crashes.


Expected Results:  Display the page

On stderr, I get:
/opt/mozilla/package/run-mozilla.sh: line 72: 11843 Segmentation fault
$prog ${1+"$@"}

Comment 1

[Andreas Franke (gone)]

*** Bug 61592 has been marked as a duplicate of this bug. ***

Comment 2

[Boris Zbarsky [:bzbarsky]]

No crash with source pulled from CVS at 12:51pm on 2000-11-29.

Comment 3

[Ian Eure]

doesn't crash for me; build 2000113008 on linux

Comment 4

[Asa Dotzler [:asa]]

Worksforme with 113006 mozilla linux build on RedHat 6.1

Comment 5

[R.K.Aa.]

WFM on RH6.2 2000113006 as well.

Reporter: Would you mind trying a newer build, delete disk-cache from prefs and
then try the site again.

Comment 6

[robin shaw]

seeing this crash also, linux 2000120608 

Comment 7

[timtas]

Tried the newest build (2000120721) and it still crashes.
glibc is 2.1.3
xfree is 3.3.5
kernel is 2.2.17 and 2.2.18pre24

Comment 8

[timtas]

By the way the crash seems to happen because of an img src on the page. The URL
of the image is something like http://y.extreme-dm.com/s/?tag=antixx . If I
enter this, the page crashes as well all the time.

Comment 9

[robin shaw]

here's a talkback #tb22612099w, i've seen this with 2000120608 sea, and
2000120808 talkback. confirming bug.

Comment 10

[Asa Dotzler [:asa]]

talkback looks like this:

 il_delete_client()
     IL_DestroyImage()
     ImageRequestImpl::~ImageRequestImpl()
     ImageRequestImpl::Release()
     nsFrameImageLoader::StopImageLoad()
     nsPresContext::Stop()
     DocumentViewerImpl::Stop()
     nsDocShell::SetupNewViewer()
     nsWebShell::SetupNewViewer()
     nsDocShell::Embed()
     nsWebShell::Embed()
     nsDocShell::CreateContentViewer()
     nsDSURIContentListener::DoContent()
     nsDocumentOpenInfo::DispatchContent()
     nsDocumentOpenInfo::OnStartRequest()
     nsHTTPFinalListener::OnStartRequest()
     nsHTTPCacheListener::OnStartRequest()
     nsDiskCacheRecordChannel::OnStartRequest()
     nsOnStartRequestEvent::HandleEvent()
     nsStreamListenerEvent::HandlePLEvent()
     PL_HandleEvent()
     PL_ProcessPendingEvents()
     nsEventQueueImpl::ProcessPendingEvents()
     event_processor_callback()
     our_gdk_io_invoke()
     libglib-1.2.so.0 + 0xf943 (0x404b3943)

Comment 11

[Asa Dotzler [:asa]]

looks like imagelib.

Comment 12

[jmcbray]

<p>
I can confirm this; lots of online comics at KeenSpot crash Mozilla through
this.  A couple more sample URLs: http://u0.extreme-dm.com/0.gif?tag=clancats&j=n
(from <a href="http://www.clanofthecats.com/">Clan of the Cats</a> and
http://y1.extreme-dm.com/z/?tag=musepimp&j=n from <a
href="http://www.sinfest.net">Sinfest</a>.  Sometimes they only cause a crash
when you <em>leave</em> the page, not when it is first loaded.  Buh?</p>

<p>I've been seeing this for weeks; my current build is 2000121208, built from
CVS on RedHat Linux 6.2.</p>

Comment 13

[pnunn]

changing summary.

Comment 14

[pnunn]

*** Bug 63384 has been marked as a duplicate of this bug. ***

Comment 15

[pnunn]

dupe of 61756.

*** This bug has been marked as a duplicate of 61756 ***

Comment 16

[Diego]

Verified dupe (same stack) of bug 61756: "crash stack: il_delete_container"
This bug has a fix