62973 - crash stack: il_delete_container

Status: VERIFIED DUPLICATE of bug 61756

(Core :: Graphics: ImageLib, defect, P3)

Description

[pnunn]

This bug report covers the bug on 
http://clubs.yahoo.com/clubs/israelishoppingclub

that have the followin stack trace:
abort() line 44 + 7 bytes
PR_Assert(const char * 0x015c4470, const char * 0x015c443c, int 0x00000288) line 
479
il_delete_container(il_container_struct * 0x0411e440) line 648 + 42 bytes
IL_NetRequestDone(il_container_struct * 0x0411e440, ilIURL * 0x0411bb10, int 
0xffffff37) line 1188 + 9 bytes
NetReaderImpl::NetRequestDone(NetReaderImpl * const 0x04118c90, ilIURL * 
0x0411bb10, int 0xffffff37) line 141 + 20 bytes
ImageConsumer::OnStopRequest(ImageConsumer * const 0x0411ba20, nsIChannel * 
0x0411a650, nsISupports * 0x00000000, unsigned int 0x80004004, const unsigned 
short * 0x100a56c8 gCommonEmptyBuffer) line 552
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x04119460, 
nsIChannel * 0x0411a650, nsISupports * 0x00000000, unsigned int 0x80004004, 
const unsigned short * 0x100a56c8 gCommonEmptyBuffer) line 277
nsHTTPFinalListener::OnStopRequest(nsHTTPFinalListener * const 0x04119300, 
nsIChannel * 0x0411a650, nsISupports * 0x00000000, unsigned int 0x80004004, 
const unsigned short * 0x100a56c8 gCommonEmptyBuffer) line 1159 + 42 bytes
nsHTTPChannel::ResponseCompleted(nsIStreamListener * 0x04119300, unsigned int 
0x80004004, const unsigned short * 0x100a56c8 gCommonEmptyBuffer) line 1923 + 42 
bytes
nsHTTPServerListener::OnStopRequest(nsHTTPServerListener * const 0x041987f0, 
nsIChannel * 0x04152854, nsISupports * 0x0411a650, unsigned int 0x80004004, 
const unsigned short * 0x100a56c8 gCommonEmptyBuffer) line 730
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x0419d610) line 
302
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0419c250) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x0419c250) line 580 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00ac83f0) line 513 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x033602e0, unsigned int 0x0000c0f7, unsigned int 
0x00000000, long 0x00ac83f0) line 1049 + 9 bytes
USER32! 77e71820()
00ac83f0()

Comment 1

[pnunn]

The gif image is somewhat bogus. It is marked as a looping animated gif,
but it only has one frame. This triggers an error in the gif decoder, 
IC_INCOMPLETE. Unfortunately, I think this error is triggered about the
same time as we get the end of stream trigger. Sometimes we clean up the
image container in the correct sequence, sometimes we don't. 

I've tried adding ic->is_aborted to the test is ic->is_url_loading at
the beginning of  il_delete_container() line 635. Still testing...
I'm not yet convinced this is the right fix.
-p

Comment 2

[pnunn]

*** Bug 63135 has been marked as a duplicate of this bug. ***

Comment 3

[pnunn]

*** Bug 60460 has been marked as a duplicate of this bug. ***

Comment 4

[pnunn]

*** Bug 60460 has been marked as a duplicate of this bug. ***

Comment 5

[Diego]

dupe (same stack) of bug 61756: "crash stack: il_delete_container"
This bug has a fix

*** This bug has been marked as a duplicate of 61756 ***

Comment 6

[Terri Preston]

pnunn, it's not clear to me if this is the bug to keep open for crash stack: 
il_delete_container or if there is another one?

Comment 7

[pnunn]

use 61756 for il_delete_container() crashes.
-p

Comment 8

[Terri Preston]

Verified duplicate, thanks pnunn!