74006 - Replying to a forwarded mail with a gif attachment leads to a crash

Status: VERIFIED DUPLICATE of bug 74035

(MailNews Core :: Composition, defect)

Description

[Sheela Ravindran]

commercial trunk buildid: 2001-03-29-06

steps that leads to crash:
compose a message from a mail account and make the recipient to one of the 
newsgroup
attach a small gif file( the gif file I attached was 2kb size)
send this message to newsgroup
Go to newsgroup and forward this message to your mail account
After receiving this message, click on reply to this message 
Add some text and click on send button
You get the intelligent send dlg- choose to send both plain and html text
click ok 
Results in crash.

Below is the stack trace:

imgLoader::LoadImage(imgLoader * const 0x03664b20, nsIURI * 0x00000000, 
nsILoadGroup * 0x0ae90450, imgIDecoderObserver * 0x0bd3f960, nsISupports * 
0x0bd2b8c0, imgIRequest * * 0x070e6f48) line 68 + 31 bytes
nsImageFrame::AttributeChanged(nsImageFrame * const 0x070e6eb4, nsIPresContext * 
0x0bd2b8c0, nsIContent * 0x0a4fe860, int 3, nsIAtom * 0x018e7220, int 3) line 
1456 + 111 bytes
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 
0x0bd11970, nsIPresContext * 0x0bd2b8c0, nsIContent * 0x0a4fe860, int 3, nsIAtom 
* 0x018e7220, int 3) line 9851 + 35 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x0bd11aa0, nsIPresContext * 
0x0bd2b8c0, nsIContent * 0x0a4fe860, int 3, nsIAtom * 0x018e7220, int -1) line 
1272
PresShell::AttributeChanged(PresShell * const 0x0bd10398, nsIDocument * 
0x0bd28810, nsIContent * 0x0a4fe860, int 3, nsIAtom * 0x018e7220, int -1) line 
4429 + 57 bytes
nsDocument::AttributeChanged(nsDocument * const 0x0bd28810, nsIContent * 
0x0a4fe860, int 3, nsIAtom * 0x018e7220, int -1) line 1686 + 32 bytes
nsHTMLDocument::AttributeChanged(nsHTMLDocument * const 0x0bd28810, nsIContent * 
0x0a4fe860, int 3, nsIAtom * 0x018e7220, int -1) line 1370
nsGenericHTMLElement::SetAttribute(nsGenericHTMLElement * const 0x0a4fe860, int 
3, nsIAtom * 0x018e7220, const basic_nsAReadableString<unsigned short> & {...}, 
int 1) line 1404
nsHTMLImageElement::SetSrcInner(nsIURI * 0x00000000, const 
basic_nsAReadableString<unsigned short> & {...}) line 1076 + 27 bytes
nsHTMLImageElement::SetSrc(nsHTMLImageElement * const 0x0a4fe888, const 
basic_nsAReadableString<unsigned short> & {...}) line 1183 + 24 bytes
nsMsgComposeAndSend::ProcessMultipartRelated(int * 0x0012bc94, int * 0x0012bca0) 
line 1660
nsMsgComposeAndSend::HackAttachments(const nsMsgAttachmentData * 0x00000000, 
const nsMsgAttachedFile * 0x00000000) line 2149 + 16 bytes
nsMsgComposeAndSend::Init(nsIMsgIdentity * 0x08956fd0, nsMsgCompFields * 
0x0aec9980, nsFileSpec * 0x00000000, int 0, int 0, int 0, nsIMsgDBHdr * 
0x00000000, const char * 0x08d79b64, const char * 0x00000000, unsigned int 0, 
const nsMsgAttachmentData * 0x00000000, const nsMsgAttachedFile * 0x00000000) 
line 2630 + 16 bytes
nsMsgComposeAndSend::CreateAndSendMessage(nsMsgComposeAndSend * const 
0x0bd51170, nsIEditorShell * 0x0ae901d0, nsIMsgIdentity * 0x08956fd0, 
nsIMsgCompFields * 0x0aec9980, int 0, int 0, int 0, nsIMsgDBHdr * 0x00000000, 
const char * 0x08d79b64, const char * 0x00000000, unsigned int 0, const 
nsMsgAttachmentData * 0x00000000, const nsMsgAttachedFile * 0x00000000, void * 
...) line 3508
nsMsgCompose::_SendMsg(int 0, nsIMsgIdentity * 0x08956fd0, int 0) line 618 + 129 
bytes
nsMsgCompose::SendMsg(nsMsgCompose * const 0x0aec9a40, int 0, nsIMsgIdentity * 
0x08956fd0) line 705 + 20 bytes
XPTC_InvokeByIndex(nsISupports * 0x0aec9a40, unsigned int 7, unsigned int 2, 
nsXPTCVariant * 0x0012c2cc) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x0a913500, 
nsXPCWrappedNative * 0x0aec9860, const XPCNativeMemberDescriptor * 0x0aec93ac, 
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 2, long * 
0x0712cee0, long * 0x0012c4b4) line 934 + 42 bytes
WrappedNative_CallMethod(JSContext * 0x0a913500, JSObject * 0x0706dc28, unsigned 
int 2, long * 0x0712cee0, long * 0x0012c4b4) line 250 + 34 bytes
js_Invoke(JSContext * 0x0a913500, unsigned int 2, unsigned int 0) line 786 + 23 
bytes
js_Interpret(JSContext * 0x0a913500, long * 0x0012d234) line 2679 + 15 bytes
js_Invoke(JSContext * 0x0a913500, unsigned int 1, unsigned int 2) line 803 + 13 
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x089b9350, 
nsXPCWrappedJS * 0x0aec4320, unsigned short 5, const nsXPTMethodInfo * 
0x014205f8, nsXPTCMiniVariant * 0x0012d69c) line 874 + 21 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x0aec4320, unsigned short 5, 
const nsXPTMethodInfo * 0x014205f8, nsXPTCMiniVariant * 0x0012d69c) line 432
PrepareAndDispatch(nsXPTCStubBase * 0x0aec4320, unsigned int 5, unsigned int * 
0x0012d74c, unsigned int * 0x0012d73c) line 100 + 31 bytes
SharedStub() line 124
XPTC_InvokeByIndex(nsISupports * 0x0aec4320, unsigned int 5, unsigned int 1, 
nsXPTCVariant * 0x0012d8f0) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x0a913500, 
nsXPCWrappedNative * 0x0bd13580, const XPCNativeMemberDescriptor * 0x0a8eb9b4, 
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long * 
0x0712cd88, long * 0x0012dad8) line 934 + 42 bytes
WrappedNative_CallMethod(JSContext * 0x0a913500, JSObject * 0x0707df38, unsigned 
int 1, long * 0x0712cd88, long * 0x0012dad8) line 250 + 34 bytes
js_Invoke(JSContext * 0x0a913500, unsigned int 1, unsigned int 0) line 786 + 23 
bytes
js_Interpret(JSContext * 0x0a913500, long * 0x0012e858) line 2679 + 15 bytes
js_Invoke(JSContext * 0x0a913500, unsigned int 1, unsigned int 2) line 803 + 13 
bytes
js_InternalInvoke(JSContext * 0x0a913500, JSObject * 0x0706c058, long 117958664, 
unsigned int 0, unsigned int 1, long * 0x0012e9f0, long * 0x0012e980) line 875 + 
20 bytes
JS_CallFunctionValue(JSContext * 0x0a913500, JSObject * 0x0706c058, long 
117958664, unsigned int 1, long * 0x0012e9f0, long * 0x0012e980) line 3299 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x0a9136b0, void * 0x0706c058, 
void * 0x0707e808, unsigned int 1, void * 0x0012e9f0, int * 0x0012e9ec, int 0) 
line 940 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x0bd716e4) line 154 + 64 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0a9c6df0, 
nsIDOMEvent * 0x0bd716e4, nsIDOMEventTarget * 0x0a9bc278, unsigned int 8, 
unsigned int 7) line 916 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x0a948240, nsEvent * 
0x0012f2a4, nsIDOMEvent * * 0x0012f16c, nsIDOMEventTarget * 0x0a9bc278, unsigned 
int 7, nsEventStatus * 0x0012f2e8) line 1844 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0a9bc270, nsIPresContext * 
0x0a948240, nsEvent * 0x0012f2a4, nsIDOMEvent * * 0x0012f16c, unsigned int 1, 
nsEventStatus * 0x0012f2e8) line 3634
PresShell::HandleDOMEventWithTarget(PresShell * const 0x0a94f800, nsIContent * 
0x0a9bc270, nsEvent * 0x0012f2a4, nsEventStatus * 0x0012f2e8) line 5146 + 39 
bytes
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x0a948240, nsGUIEvent * 
0x0012f490) line 181
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x06ff03b8, 
nsIPresContext * 0x0a948240, nsGUIEvent * 0x0012f490, nsEventStatus * 
0x0012f778) line 128
PresShell::HandleEventInternal(nsEvent * 0x0012f490, nsIView * 0x00000000, 
unsigned int 1, nsEventStatus * 0x0012f778) line 5114 + 41 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x0a94f800, nsEvent * 
0x0012f490, nsIFrame * 0x06ff03b8, nsIContent * 0x0a9bc270, unsigned int 1, 
nsEventStatus * 0x0012f778) line 5080 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 
0x0a9db8c0, nsIPresContext * 0x0a948240, nsMouseEvent * 0x0012f884, 
nsEventStatus * 0x0012f778) line 2072 + 61 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x0a9db8c8, 
nsIPresContext * 0x0a948240, nsEvent * 0x0012f884, nsIFrame * 0x06ff03b8, 
nsEventStatus * 0x0012f778, nsIView * 0x0a94ff40) line 1176 + 28 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f884, nsIView * 0x0a94ff40, 
unsigned int 1, nsEventStatus * 0x0012f778) line 5119 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x0a94f804, nsIView * 0x0a94ff40, 
nsGUIEvent * 0x0012f884, nsEventStatus * 0x0012f778, int 1, int & 1) line 5034 + 
25 bytes
nsView::HandleEvent(nsView * const 0x0a94ff40, nsGUIEvent * 0x0012f884, unsigned 
int 28, nsEventStatus * 0x0012f778, int 1, int & 1) line 372
nsViewManager::DispatchEvent(nsViewManager * const 0x0a94d120, nsGUIEvent * 
0x0012f884, nsEventStatus * 0x0012f778) line 1982
HandleEvent(nsGUIEvent * 0x0012f884) line 68
nsWindow::DispatchEvent(nsWindow * const 0x0a94fe04, nsGUIEvent * 0x0012f884, 
nsEventStatus & nsEventStatus_eIgnore) line 688 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f884) line 709
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3983 + 
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 
4193
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 2555952, long * 
0x0012fc3c) line 2993 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x10cd08a2, unsigned int 514, unsigned int 0, long 
2555952) line 943 + 27 bytes
USER32! 77e71820()
00270030()

Comment 1

[Sheela Ravindran]

change qa contact to myself.  Adding keywords and nominating for nsbeta1

Comment 2

[laurel]

Sending from template with inserted image, too crashes.  Sending a message with
any inline image is a problem.

Comment 3

[varada]

This could/should be a dup of 73742 - crashing because of the new image lib. 
Similar stack trace

Comment 4

[scottputterman]

reassigning to pavlov.  It looks like it could be a dup, but I'm not sure.

Comment 5

[sairuh (rarely reading bugmail)]

dupping...

*** This bug has been marked as a duplicate of 74035 ***

Comment 6

[Sheela Ravindran]

verifying as dup based on the stack trace