html with embed + onload crashes browser

VERIFIED DUPLICATE of bug 58429

Status

()

Core
Event Handling
--
critical
VERIFIED DUPLICATE of bug 58429
17 years ago
17 years ago

People

(Reporter: shrirang khanzode, Assigned: joki (gone))

Tracking

({crash})

Trunk
mozilla0.9.1
x86
Windows NT
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

17 years ago
win trunk 0221

Load the attached html file and see the browser crash

Stack :

Call Stack:    (Signature = nsEventListenerManager::HandleEventSubType e6766730) 
     
   nsEventListenerManager::HandleEventSubType 
                                              
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
839]
     
   nsEventListenerManager::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1422]
     
   nsGenericElement::HandleDOMEvent 
                                              
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1426]
     
   PresShell::HandleEventInternal 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4849]
     
   PresShell::HandleEventWithTarget 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4829]
     
   nsImageFrame::UpdateImage 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 333]
     
   nsImageFrame::UpdateImageFrame 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 238]
     
   nsHTMLImageLoader::Update 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLImageLoader.cpp, line 
170]
     
   nsHTMLImageLoader::ImageLoadCB 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLImageLoader.cpp, line 
134]
     
   nsFrameImageLoader::NotifyFrames 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp, line 574]
     
   nsFrameImageLoader::Notify 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameImageLoader.cpp, line 544]
     
   ns_observer_proc 
                                              
[d:\builds\seamonkey\mozilla\gfx\src\nsImageRequest.cpp, line 135]
     
   XP_NotifyObservers 
                                              
[d:\builds\seamonkey\mozilla\modules\libutil\src\obs.c, line 260]
     
   il_image_complete_notify 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 329]
     
   il_image_complete 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 1645]
     
   ImgDCallbk::ImgDCBHaveImageAll 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 191]
     
   process_buffered_gif_input_data 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp, line 694]
     
   gif_delay_time_callback 
                                              
[d:\builds\seamonkey\mozilla\modules\libimg\gifcom\gif.cpp, line 728]
     
   timer_callback 
                                              
[d:\builds\seamonkey\mozilla\gfx\src\nsImageSystemServices.cpp, line 72]
     
   nsTimer::Fire 
                                              
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 196]
     
   nsAppShell::Run 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp, line 118]
(Reporter)

Comment 1

17 years ago
Created attachment 25967 [details]
testcase
(Reporter)

Comment 2

17 years ago
reassigning: dom 0
Assignee: av → jst
Component: Plug-ins → Event Handling
QA Contact: shrir → desale
This crash is at the end of the event listener manager, the code is:

  if (NS_SUCCEEDED(result)) {
    nsCOMPtr<nsIPrivateDOMEvent> aPrivDOMEvent(do_QueryInterface(aDOMEvent));
    aPrivDOMEvent->SetCurrentTarget(aCurrentTarget);
    result = aListenerStruct->mListener->HandleEvent(aDOMEvent);
    aPrivDOMEvent->SetCurrentTarget(nsnull);
  }

  return result;

and the crash happens becuase aListenerStruct->mListener is 0xdddddddd when
looking at this in the debugger. Over to joki.
Assignee: jst → joki
Keywords: crash

Updated

17 years ago
Keywords: nsbeta1
(Assignee)

Updated

17 years ago
Target Milestone: --- → mozilla0.9.1
Keywords: nsbeta1 → nsbeta1+

Comment 4

17 years ago
Reproduced bug using test case provided using Windows XP ( Whister)
(Assignee)

Comment 5

17 years ago
I knew I had a dupe of this somewhere.  Marking.

*** This bug has been marked as a duplicate of 58429 ***
Status: NEW → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → DUPLICATE

Comment 6

17 years ago
verifie dupe.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.