73859 - Browser crashes after doing SHIFT+Reload twice while webpage loads

Status: VERIFIED WORKSFORME

(Core :: Graphics: ImageLib, defect)

Description

[shrirang khanzode]

Seen on tody's windows trunk 03/28

Steps:
1 Launch the browser
2 Go to the url above
3 Now do SHIFT + RELOAD and while the webpage is loading, again do SHIFT+ RELOAD

The browser should crash. Sending to imagelib since stack trace points to it.

Stack :


nsImageBoxFrame::UpdateImage(nsIPresContext * 0x081c1d00, int & 0) line 
333 + 39 bytes
nsImageBoxFrame::DidSetStyleContext(nsImageBoxFrame * const 0x015d4b44, 
nsIPresContext * 0x081c1d00) line 464
nsFrame::SetStyleContext(nsFrame * const 0x015d4b44, nsIPresContext * 
0x081c1d00, nsIStyleContext * 0x08b589f0) line 476
FrameManager::ReResolveStyleContext(nsIPresContext * 0x081c1d00, 
nsIFrame * 0x015d4b44, nsIStyleContext * 0x08b572c0, nsIContent * 
0x08260d20, int 0, nsIAtom * 0x00000000, nsStyleChangeList & {...}, int 
5, int & 0) line 1637
FrameManager::ReResolveStyleContext(nsIPresContext * 0x081c1d00, 
nsIFrame * 0x015d4ab0, nsIStyleContext * 0x08b57900, nsIContent * 
0x0824ee00, int 0, nsIAtom * 0x00000000, nsStyleChangeList & {...}, int 
5, int & 5) line 1779
FrameManager::ReResolveStyleContext(nsIPresContext * 0x081c1d00, 
nsIFrame * 0x015d4a18, nsIStyleContext * 0x082490f0, nsIContent * 
0x00000000, int 0, nsIAtom * 0x03960c60, nsStyleChangeList & {...}, int 
5, int & 5) line 1779
FrameManager::ComputeStyleChangeFor(FrameManager * const 0x081fbb20, 
nsIPresContext * 0x081c1d00, nsIFrame * 0x015d4a18, int 0, nsIAtom * 
0x03960c60, nsStyleChangeList & {...}, int 3, int & 0) line 2021
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 
0x081fda20, nsIPresContext * 0x081c1d00, nsIContent * 0x0824ee00, int 0, 
nsIAtom * 0x03960c60, int 3) line 9803
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x081fdb50, 
nsIPresContext * 0x081c1d00, nsIContent * 0x0824ee00, int 0, nsIAtom * 
0x03960c60, int -1) line 1272
PresShell::AttributeChanged(PresShell * const 0x081fd698, nsIDocument * 
0x0838c630, nsIContent * 0x0824ee00, int 0, nsIAtom * 0x03960c60, int 
-1) line 4429 + 57 bytes
nsDocument::AttributeChanged(nsDocument * const 0x0838c630, nsIContent * 
0x0824ee00, int 0, nsIAtom * 0x03960c60, int -1) line 1686 + 32 bytes
nsHTMLDocument::AttributeChanged(nsHTMLDocument * const 0x0838c630, 
nsIContent * 0x0824ee00, int 0, nsIAtom * 0x03960c60, int -1) line 1370
nsXULElement::UnsetAttribute(nsXULElement * const 0x0824ee00, int 0, 
nsIAtom * 0x03960c60, int 1) line 3343
nsGfxScrollFrameInner::SetScrollbarVisibility(nsIBox * 0x015d4a50, int 
1) line 1407
nsGfxScrollFrameInner::AddRemoveScrollbar(nsBoxLayoutState & {...}, 
nsRect & {...}, int 1, int 0, int 1) line 978
nsGfxScrollFrameInner::AddVerticalScrollbar(nsBoxLayoutState & {...}, 
nsRect & {...}, int 1) line 935
nsGfxScrollFrameInner::Layout(nsBoxLayoutState & {...}) line 1131 + 23 bytes
nsGfxScrollFrame::DoLayout(nsGfxScrollFrame * const 0x015d4174, 
nsBoxLayoutState & {...}) line 1031 + 15 bytes
nsBox::Layout(nsBox * const 0x015d4174, nsBoxLayoutState & {...}) line 985
nsBoxFrame::Reflow(nsBoxFrame * const 0x015d413c, nsIPresContext * 
0x081c1d00, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & 
{...}, unsigned int & 0) line 781
nsGfxScrollFrame::Reflow(nsGfxScrollFrame * const 0x015d413c, 
nsIPresContext * 0x081c1d00, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, unsigned int & 0) line 735 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x015d413c, nsIPresContext * 
0x081c1d00, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & 
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 692 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x015d40c8, nsIPresContext * 
0x081c1d00, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & 
{...}, unsigned int & 0) line 544
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x08b4db00, 
nsIPresContext * 0x081c1d00, nsHTMLReflowMetrics & {...}, const nsSize & 
{...}, nsIRenderingContext & {...}) line 145
PresShell::ProcessReflowCommand(nsVoidArray & {...}, int 0, 
nsHTMLReflowMetrics & {...}, nsSize & {...}, nsIRenderingContext & 
{...}) line 5299
PresShell::ProcessReflowCommands(int 0) line 5354
PresShell::FlushPendingNotifications(PresShell * const 0x081fd690) line 4358
nsDocument::FlushPendingNotifications(nsDocument * const 0x0838c630, int 
1) line 3154
nsHTMLDocument::FlushPendingNotifications(nsHTMLDocument * const 
0x0838c630, int 1) line 1399 + 13 bytes
nsGenericHTMLElement::GetPrimaryFrame(nsIHTMLContent * 0x08370820, 
nsIFormControlFrame * & 0x00000000, int 1) line 2409
nsHTMLInputElement::GetValue(nsHTMLInputElement * const 0x08370850, 
basic_nsAWritableString<unsigned short> & {...}) line 421 + 18 bytes
nsWalletlibService::OnEndDocumentLoad(nsWalletlibService * const 
0x032c575c, nsIDocumentLoader * 0x061d4800, nsIRequest * 0x081c6b20, 
unsigned int 2152398850) line 373 + 45 bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x061d4800, 
nsIRequest * 0x081c6b20, unsigned int 2152398850) line 838
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x061d4800, 
nsIRequest * 0x081c6b20, unsigned int 2152398850) line 846
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x061d4800, 
nsIRequest * 0x081c6b20, unsigned int 2152398850) line 846
nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int 2152398850) line 634
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x061d4804, 
nsIRequest * 0x081c6b20, nsISupports * 0x00000000, unsigned int 
2152398850, const unsigned short * 0x00000000) line 564
nsLoadGroup::RemoveRequest(nsLoadGroup * const 0x061d4790, nsIRequest * 
0x081c6b20, nsISupports * 0x00000000, unsigned int 2152398850, const 
unsigned short * 0x00000000) line 518 + 48 bytes
nsLoadGroup::Cancel(nsLoadGroup * const 0x061d4790, unsigned int 
2152398850) line 247
nsDocLoaderImpl::Stop(nsDocLoaderImpl * const 0x061d4800) line 284 + 31 
bytes
nsURILoader::Stop(nsURILoader * const 0x0339f900, nsISupports * 
0x061d4818) line 833 + 23 bytes
nsDocShell::StopLoad(nsDocShell * const 0x061d3170) line 553
nsDocShell::InternalLoad(nsDocShell * const 0x061d3170, nsIURI * 
0x081c04f0, nsIURI * 0x00000000, nsISupports * 0x00000000, int 1, int 0, 
const char * 0x00000000, nsIInputStream * 0x00000000, nsIInputStream * 
0x00000000, unsigned int 2, nsISHEntry * 0x00000000) line 3115 + 12 bytes
nsDocShell::Reload(nsDocShell * const 0x061d3180, unsigned int 0) line 
1573 + 67 bytes
XPTC_InvokeByIndex(nsISupports * 0x061d3180, unsigned int 9, unsigned 
int 1, nsXPTCVariant * 0x0012d8f0) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x032607c0, 
nsXPCWrappedNative * 0x08b316a0, const XPCNativeMemberDescriptor * 
0x08b31754, nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 
1, long * 0x01673718, long * 0x0012dad8) line 934 + 42 bytes
WrappedNative_CallMethod(JSContext * 0x032607c0, JSObject * 0x015f4570, 
unsigned int 1, long * 0x01673718, long * 0x0012dad8) line 250 + 34 bytes
js_Invoke(JSContext * 0x032607c0, unsigned int 1, unsigned int 0) line 
786 + 23 bytes
js_Interpret(JSContext * 0x032607c0, long * 0x0012e858) line 2679 + 15 bytes
js_Invoke(JSContext * 0x032607c0, unsigned int 1, unsigned int 2) line 
803 + 13 bytes
js_InternalInvoke(JSContext * 0x032607c0, JSObject * 0x014a2340, long 
23021656, unsigned int 0, unsigned int 1, long * 0x0012e9f0, long * 
0x0012e980) line 875 + 20 bytes
JS_CallFunctionValue(JSContext * 0x032607c0, JSObject * 0x014a2340, long 
23021656, unsigned int 1, long * 0x0012e9f0, long * 0x0012e980) line 
3299 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x03260970, void * 
0x014a2340, void * 0x015f4858, unsigned int 1, void * 0x0012e9f0, int * 
0x0012e9ec, int 0) line 940 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x08b30204) line 154 + 64 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 
0x04b9dc70, nsIDOMEvent * 0x08b30204, nsIDOMEventTarget * 0x04b9dec8, 
unsigned int 8, unsigned int 7) line 916 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x04509cb0, nsEvent 
* 0x0012f2a4, nsIDOMEvent * * 0x0012f16c, nsIDOMEventTarget * 
0x04b9dec8, unsigned int 7, nsEventStatus * 0x0012f2e8) line 1844 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x04b9dec0, 
nsIPresContext * 0x04509cb0, nsEvent * 0x0012f2a4, nsIDOMEvent * * 
0x0012f16c, unsigned int 1, nsEventStatus * 0x0012f2e8) line 3634
PresShell::HandleDOMEventWithTarget(PresShell * const 0x04508c10, 
nsIContent * 0x04b9dec0, nsEvent * 0x0012f2a4, nsEventStatus * 
0x0012f2e8) line 5146 + 39 bytes
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x04509cb0, nsGUIEvent * 
0x0012f490) line 181
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x014f9730, 
nsIPresContext * 0x04509cb0, nsGUIEvent * 0x0012f490, nsEventStatus * 
0x0012f778) line 128
PresShell::HandleEventInternal(nsEvent * 0x0012f490, nsIView * 
0x00000000, unsigned int 1, nsEventStatus * 0x0012f778) line 5114 + 41 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x04508c10, nsEvent * 
0x0012f490, nsIFrame * 0x014f9730, nsIContent * 0x04b9dec0, unsigned int 
1, nsEventStatus * 0x0012f778) line 5080 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * 
const 0x05b2b280, nsIPresContext * 0x04509cb0, nsMouseEvent * 
0x0012f884, nsEventStatus * 0x0012f778) line 2072 + 61 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 
0x05b2b288, nsIPresContext * 0x04509cb0, nsEvent * 0x0012f884, nsIFrame 
* 0x014f9730, nsEventStatus * 0x0012f778, nsIView * 0x0450f7d0) line 
1176 + 28 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f884, nsIView * 
0x0450f7d0, unsigned int 1, nsEventStatus * 0x0012f778) line 5119 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x04508c14, nsIView * 
0x0450f7d0, nsGUIEvent * 0x0012f884, nsEventStatus * 0x0012f778, int 1, 
int & 1) line 5034 + 25 bytes
nsView::HandleEvent(nsView * const 0x0450f7d0, nsGUIEvent * 0x0012f884, 
unsigned int 28, nsEventStatus * 0x0012f778, int 1, int & 1) line 372
nsViewManager::DispatchEvent(nsViewManager * const 0x0450df20, 
nsGUIEvent * 0x0012f884, nsEventStatus * 0x0012f778) line 1982
HandleEvent(nsGUIEvent * 0x0012f884) line 68
nsWindow::DispatchEvent(nsWindow * const 0x04508ee4, nsGUIEvent * 
0x0012f884, nsEventStatus & nsEventStatus_eIgnore) line 688 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f884) line 709
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) 
line 3983 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) 
line 4193
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 2621552, 
long * 0x0012fc3c) line 2993 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x016a02a0, unsigned int 514, unsigned int 
0, long 2621552) line 943 + 27 bytes
USER32! 77e71820()
JS3250! 00280070()

Comment 1

[pnunn]

for pav...

Comment 2

[Tom Everingham]

this is working for me. Tested 4/12 builds on winNT, mac, and linux.  Please 
re-open if you can still reproduce it.

Comment 3

[Tom Everingham]

verified wfm

Comment 4

[shrirang khanzode]

seems to have got fixed ..