75704 - crash nt 2001041104 trunk [@ nsHTMLImageElement::OnStartContainer]

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P1)

Description

[Bert Andries]

When following the news link
accessing http://www.rsgb.org/news/index.htm directly works.

Comment 1

[Oliver Klee]

Worksforme using the same build on Win2k.

Bert, could you attach a Dr. Watson log? In addition, please read the bug
reporting guidelines at
http://www.mozilla.org/quality/bug-writing-guidelines.html and consider using
Bugzilla Helper at http://www.mozilla.org/quality/help/bug-form.html to report bugs.

Thanks for using Mozilla and reporting bugs!

Comment 2

[Matthias Versen [:Matti]]

confirming with win2k, build 20010412.. (CVS debug 08am)



Stack Trace:
nsHTMLImageElement::OnStartContainer(nsHTMLImageElement * const 0x048c280c, 
imgIRequest * 0x0478e180, nsISupports * 0x03d7b630, imgIContainer * 0x00000000) 
line 935 + 7 bytes
imgRequestProxy::OnStartContainer(imgRequestProxy * const 0x0478e184, 
imgIRequest * 0x00000000, nsISupports * 0x00000000, imgIContainer * 0x00000000) 
line 256
imgRequest::AddObserver(imgIDecoderObserver * 0x0478e184) line 106
imgRequestProxy::Init(imgRequest * 0x0473dab0, nsILoadGroup * 0x04740c58, 
imgIDecoderObserver * 0x048c280c, nsISupports * 0x03d7b630) line 97
imgLoader::LoadImage(imgLoader * const 0x033fb530, nsIURI * 0x0478e318, 
nsILoadGroup * 0x04740c58, imgIDecoderObserver * 0x048c280c, nsISupports * 
0x03d7b630, imgIRequest * * 0x048c2814) line 169
nsHTMLImageElement::SetSrcInner(nsIURI * 0x046df540, const nsAString & {...}) 
line 1150 + 141 bytes
nsHTMLImageElement::SetProperty(JSContext * 0x03ea09a8, JSObject * 0x046524f8, 
long 54953084, long * 0x0012e8c0) line 762 + 33 bytes
nsJSUtils::nsCallJSScriptObjectSetProperty(nsISupports * 0x048c2800, JSContext * 
0x03ea09a8, JSObject * 0x046524f8, long 54953084, long * 0x0012e8c0) line 197 + 
27 bytes
SetHTMLImageElementProperty(JSContext * 0x03ea09a8, JSObject * 0x046524f8, long 
54953084, long * 0x0012e8c0) line 628 + 25 bytes
js_SetProperty(JSContext * 0x03ea09a8, JSObject * 0x046524f8, long 55609288, 
long * 0x0012e8c0) line 2504 + 207 bytes
js_Interpret(JSContext * 0x03ea09a8, long * 0x0012ea78) line 2551 + 1939 bytes
js_Invoke(JSContext * 0x03ea09a8, unsigned int 1, unsigned int 2) line 830 + 13 
bytes
js_InternalInvoke(JSContext * 0x03ea09a8, JSObject * 0x03c6e3f0, long 63371384, 
unsigned int 0, unsigned int 1, long * 0x0012ec10, long * 0x0012eba0) line 902 + 
20 bytes
JS_CallFunctionValue(JSContext * 0x03ea09a8, JSObject * 0x03c6e3f0, long 
63371384, unsigned int 1, long * 0x0012ec10, long * 0x0012eba0) line 3334 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x047d4fc8, void * 0x03c6e3f0, 
void * 0x03c6f878, unsigned int 1, void * 0x0012ec10, int * 0x0012ec0c, int 0) 
line 940 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04781f1c) line 154 + 64 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0474a1f8, 
nsIDOMEvent * 0x04781f1c, nsIDOMEventTarget * 0x047d4eb0, unsigned int 1, 
unsigned int 7) line 920 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x03d7b630, nsEvent * 
0x0012f0f4, nsIDOMEvent * * 0x0012f0b4, nsIDOMEventTarget * 0x047d4eb0, unsigned 
int 7, nsEventStatus * 0x0012f118) line 1543 + 39 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x047d4ea0, 
nsIPresContext * 0x03d7b630, nsEvent * 0x0012f0f4, nsIDOMEvent * * 0x0012f0b4, 
unsigned int 1, nsEventStatus * 0x0012f118) line 566
DocumentViewerImpl::LoadComplete(DocumentViewerImpl * const 0x0471cf10, unsigned 
int 0) line 1044 + 47 bytes
nsDocShell::EndPageLoad(nsIWebProgress * 0x04740bb4, nsIChannel * 0x04745250, 
unsigned int 0) line 2748
nsWebShell::EndPageLoad(nsIWebProgress * 0x04740bb4, nsIChannel * 0x04745250, 
unsigned int 0) line 985
nsDocShell::OnStateChange(nsDocShell * const 0x04742ee0, nsIWebProgress * 
0x04740bb4, nsIRequest * 0x04745250, int 131088, unsigned int 0) line 2666
nsWebShell::OnStateChange(nsWebShell * const 0x04742ee0, nsIWebProgress * 
0x04740bb4, nsIRequest * 0x04745250, int 131088, unsigned int 0) line 947
nsDocLoaderImpl::FireOnStateChange(nsIWebProgress * 0x04740bb4, nsIRequest * 
0x04745250, int 131088, unsigned int 0) line 1301
nsDocLoaderImpl::doStopDocumentLoad(nsIRequest * 0x04745250, unsigned int 0) 
line 731
nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int 0) line 627
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x04740ba4, nsIRequest * 
0x03ca9860, nsISupports * 0x00000000, unsigned int 0) line 559
nsLoadGroup::RemoveRequest(nsLoadGroup * const 0x04740c58, nsIRequest * 
0x03ca9860, nsISupports * 0x00000000, unsigned int 0) line 486 + 44 bytes
PresShell::RemoveDummyLayoutRequest() line 5725 + 42 bytes
PresShell::DoneRemovingReflowCommands() line 5681
PresShell::ProcessReflowCommands(int 1) line 5481
ReflowEvent::HandleEvent() line 5327
HandlePLEvent(ReflowEvent * 0x047afee0) line 5341
PL_HandleEvent(PLEvent * 0x047afee0) line 588 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00c552c8) line 518 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x003a01d6, unsigned int 49418, unsigned int 0, 
long 12931784) line 1069 + 9 bytes
USER32! 77e048dc()
USER32! 77e04aa7()
USER32! 77e166fd()
nsAppShellService::Run(nsAppShellService * const 0x00c96990) line 422
main1(int 2, char * * 0x003579d0, nsISupports * 0x00000000) line 1005 + 32 bytes
main(int 2, char * * 0x003579d0) line 1300 + 37 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 3

[karnaze (gone)]

I'm seeing the crash also. Reassigning to attinasi, CCing pavlov. Changing url 
from http://www.rsgb.org to http://www.rsgb.org/news/index.htm.

Comment 4

[Marc Attinasi]

This works fine for me - I have a build from 04/11 - updating now to check the
most recent

Comment 5

[Jens-Uwe]

I doubt that changing the URLs was a good idea. the original one crashes here,
while the new one works fine (which is bad for reproducing a crash;)
I am on Linux 2001041208

Comment 6

[Matthias Versen [:Matti]]

you must load the first URL ("http://www.rsgb.org") 
and follow the news link to :
"http://www.rsgb.org/news/index.htm" to see the crash.

I see no crash if I go direct to
"http://www.rsgb.org/news/index.htm"

Comment 7

[Marc Attinasi]

Putting URL back... Start at URL, then click the News link (tab)

Comment 8

[Marc Attinasi]

This WORKSFORME now - I tried several times, starting at http://www.rsgb.org/ 
and clicking the 'news' link. I noticed pavlov checked in a bunch of image 
related fixes in the past day - could that have fixed this? Marking WORKSFORME 
(tested with CVS build from today) - please reopen if you are still seeing the 
problem - Thanks!

Comment 9

[Jan Carpenter]

Reopening
This bug is a topcrasher, added topcrash keyword.  
Added [@ nsHTMLImageElement::OnStartContainer]for tracking.  

Here are some URLs that might help repro this crash:
     (29099146) URL: http://www.amd.com/products/cpg/bin/miniport_480_winme.exe
     (29070982) URL: www.spiegel.de
     (29046953) URL: www.movies.com
     (29042948) URL: dancesafe.org
     (29038144) URL: http://www.micro-solutions.com/
     (29000051) URL: www.nb.se/direkt/index.html
     (28987182) URL: http://www.virtual-emuarcade.eplugz.com/
     (28982888) URL: http://www.idt.com/products/welcome.html
     (28925301) URL: www.minolta.com

Here is a recent stack trace:
         nsHTMLImageElement::OnStartContainer
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLImageElement.cpp  
line 936] 
         imgRequestProxy::OnStartContainer
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequestProxy.cpp  line 256] 
         imgRequest::AddObserver
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequest.cpp  line 107] 
         imgRequestProxy::Init
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequestProxy.cpp  line 97] 
         imgLoader::LoadImage   
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgLoader.cpp
line 169] 
         nsHTMLImageElement::SetSrcInner
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLImageElement.cpp  
line 1161] 
         nsHTMLImageElement::SetProperty
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLImageElement.cpp  
line 765] 
         nsJSUtils::nsCallJSScriptObjectSetProperty
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSUtils.cpp  line 198] 
         SetHTMLImageElementProperty
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLImageElement.cpp  line 634] 
         js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c  line 2505] 
         js_Interpret   [d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 
2554] 
         js_Execute     [d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 
994] 
         JS_EvaluateUCScriptForPrincipals       
[d:\builds\seamonkey\mozilla\js\src\jsapi.c
line 3295] 
         nsJSContext::EvaluateString
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp  line 610] 
         HTMLContentSink::EvaluateScript
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp  
line 4736] 
         HTMLContentSink::ProcessSCRIPTTag
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp  
line 5102] 
         HTMLContentSink::AddLeaf
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp  
line 3226] 
         CNavDTD::AddLeaf       
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp  line
3808] 
         CNavDTD::AddHeadLeaf   
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp  line
3867] 
         CNavDTD::HandleStartToken      
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp
line 1716] 
         CNavDTD::HandleToken   
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp  line
878] 
         CNavDTD::BuildModel    
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp  line
521] 
         nsParser::BuildModel   
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line
2031] 
         nsParser::ResumeParse  
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line
1910] 
         nsParser::OnDataAvailable      
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp
line 2361] 
         nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp  line 260] 
         nsHTTPFinalListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p  line 1165] 
         nsStreamListenerTee::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp  line 56] 
         nsHTTPServerListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p  line 539] 
         nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp  line 
183] 
         PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  
line 589] 
         PL_ProcessPendingEvents        
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c
line 522] 
         _md_EventReceiverProc  
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1070]
         nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 408] 
         netscp6.exe + 0x16ec (0x004016ec)  
         netscp6.exe + 0x11b8 (0x004011b8)  
         netscp6.exe + 0x2c28 (0x00402c28)  
         KERNEL32.DLL + 0x192a6 (0x77e992a6)  
 

Comment 10

[Jay Patel [:jay]]

Marking WORKSFORME again, since Talkback data shows that this crash last 
occurred with the 2001041309 build.  Since Marc was able to run the testcase 
without crashing with the build from 4/14, I'm guessing Pav might have fixed 
this problem with his checkins on 4/13.

Comment 11

[Jay Patel [:jay]]

If anyone sees this crash with a build newer than 2001041309, it might be worth 
reopening, but if not, please verify with the latest trunk builds.

Comment 12

[Matthias Versen [:Matti]]

verified fixed with win2k build 20010417.. (CVS)

Comment 13

[Shiva Thirumazhusai]

Moving all the Works For Me bugs to talkback user account for future reference.

Comment 14

[Shiva Thirumazhusai]

We are gathering all the Resolved and WFM bugs which are happened to be topcrash 
bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.

Comment 15

[Chad Austin]

Verifications.  Tests (if necessary) were done with 2001052504 on Windows 2000.

Please forgive the spam.