69893 - html with embed + onload crashes browser

Status: VERIFIED DUPLICATE of bug 58429

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[shrirang khanzode]

win trunk 0221

Load the attached html file and see the browser crash

Stack :

Call Stack:    (Signature = nsEventListenerManager::HandleEventSubType e6766730) 
     
   nsEventListenerManager::HandleEventSubType 
                                              
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
839]
     
   nsEventListenerManager::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1422]
     
   nsGenericElement::HandleDOMEvent 
                                              
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1426]
     
   PresShell::HandleEventInternal 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4849]
     
   PresShell::HandleEventWithTarget 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4829]
     
   nsImageFrame::UpdateImage 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 333]
     
   nsImageFrame::UpdateImageFrame 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 238]
     
   nsHTMLImageLoader::Update 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLImageLoader.cpp, line 
170]
     
   nsHTMLImageLoader::ImageLoadCB 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLImageLoader.cpp, line 
134]
     
   nsFrameImageLoader::NotifyFrames 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp, line 574]
     
   nsFrameImageLoader::Notify 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp, line 544]
     
   ns_observer_proc 
                                              
[d:\builds\seamonkey\mozilla\gfx\src\nsImageRequest.cpp, line 135]
     
   XP_NotifyObservers 
                                              
[d:\builds\seamonkey\mozilla\modules\libutil\src\obs.c, line 260]
     
   il_image_complete_notify 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 329]
     
   il_image_complete 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 1645]
     
   ImgDCallbk::ImgDCBHaveImageAll 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 191]
     
   process_buffered_gif_input_data 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp, line 694]
     
   gif_delay_time_callback 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp, line 728]
     
   timer_callback 
                                              
[d:\builds\seamonkey\mozilla\gfx\src\nsImageSystemServices.cpp, line 72]
     
   nsTimer::Fire 
                                              
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 196]
     
   nsAppShell::Run 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp, line 118]

Comment 1

[shrirang khanzode]

Attachment: testcase

Comment 2

[shrirang khanzode]

reassigning: dom 0

Comment 3

[Johnny Stenback (:jst)]

This crash is at the end of the event listener manager, the code is:

  if (NS_SUCCEEDED(result)) {
    nsCOMPtr<nsIPrivateDOMEvent> aPrivDOMEvent(do_QueryInterface(aDOMEvent));
    aPrivDOMEvent->SetCurrentTarget(aCurrentTarget);
    result = aListenerStruct->mListener->HandleEvent(aDOMEvent);
    aPrivDOMEvent->SetCurrentTarget(nsnull);
  }

  return result;

and the crash happens becuase aListenerStruct->mListener is 0xdddddddd when
looking at this in the debugger. Over to joki.

Comment 4

[brijonesg]

Reproduced bug using test case provided using Windows XP ( Whister)

Comment 5

[joki (gone)]

I knew I had a dupe of this somewhere.  Marking.

*** This bug has been marked as a duplicate of 58429 ***

Comment 6

[Prashant Desale]

verifie dupe.