89131 - crash when trying to save an image

Status: VERIFIED DUPLICATE of bug 68454

(SeaMonkey :: UI Design, defect)

Description

[Dan Naumov]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2+)
Gecko/20010702
BuildID:    2001070204

Trying to save the textures found on this sites by using the right-click menu
results in a crash. See "Steps to Reproduce" and "Additional Information".

Reproducible: Always
Steps to Reproduce:
1. Go to http://www.shaderlab.com/beta/?p=textures/sci-fi/majestic
2. Left-Click on the red image to get a bigger preview of the image.
3. Right-Click on the bigger image and select "Save As".

Actual Results:  Mozilla crashed.

Expected Results:  A "Save As" dialog should've appeared.

This problem can be encounter all through the entire site. You can go to
http://www.shaderlab.com/beta/?p=textures and pick any texture category and
trying to save the big preview of the texture image results in a crash.

I am using a talkback build, so I sent the talkback message as well.

Comment 1

[James Paige]

I can confirm this crash with build 2001070204 on Windows 95. Talkback ID
TB32488449K

Comment 2

[Asa Dotzler [:asa]]

Incident ID 32488449
Stack Signature COMDLG32.DLL + 0x650e (0x7fed650e) 6120fccb
Bug ID
Trigger Time 2001-07-03 15:18:14
User Comments Bugzilla Bug 89131 crash when trying to save an image
Build ID 2001070209
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
COMDLG32.DLL + 0x650e (0x7fed650e)
COMDLG32.DLL + 0x2e89 (0x7fed2e89)
COMDLG32.DLL + 0x288b (0x7fed288b)
COMDLG32.DLL + 0x487a (0x7fed487a)
KERNEL32.DLL + 0x3663 (0xbff73663)
KERNEL32.DLL + 0x228e0 (0xbff928e0) 

Comment 3

[Asa Dotzler [:asa]]

from jago's talkback report:

Incident ID 32487440
Stack Signature comdlg32.dll + 0x7e8d (0x76b37e8d) 92187614
Bug ID
Trigger Time 2001-07-03 14:49:47
User Comments
Build ID 2001070209
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
comdlg32.dll + 0x7e8d (0x76b37e8d)
0xf70c758b 

Comment 4

[Asa Dotzler [:asa]]

XPApps? not sure who is responsible for calling the windows dialog.

Comment 5

[sairuh (rarely reading bugmail)]

i can repro the crash on 2001.07.03.1x-trunk comm bits on winNT and mac.
interestingly, on linux [2001.07.03.16-trunk], i don't get a crash...i get as
far as the file picker for saving, it goes away after i click OK, but no file is
ever saved.

i'll check this on the branch.

not sure if this should go to event handling, or what. saari, jrgm, d'you know
who'd best own this?

Mac talkback report #32497798:

nsVoidArray::RemoveElement() [nsVoidArray.cpp, line 258] 
nsDeleteObserved::RemoveDeleteObserver() [nsDeleteObserver.cpp, line 78] 
nsMacEventDispatchHandler::SetDeactivated() [nsMacEventHandler.cpp, line 324] 
nsMacEventHandler::HandleActivateEvent() [nsMacEventHandler.cpp, line 1206] 
nsMacEventHandler::HandleOSEvent() [nsMacEventHandler.cpp, line 457] 
nsMacWindow::HandleOSEvent() [nsMacWindow.cpp, line 1151] 
nsMacMessageSink::DispatchOSEvent() [nsMacMessageSink.cpp, line 44] 
nsMacMessagePump::DispatchOSEventToRaptor() [nsMacMessagePump.cpp, line 956] 
nsMacMessagePump::DoActivate() [nsMacMessagePump.cpp, line 920] 
nsMacMessagePump::DispatchEvent() [nsMacMessagePump.cpp, line 420] 
nsMacMessagePump::DoMessagePump() [nsMacMessagePump.cpp, line 269] 
nsAppShell::Run() [nsAppShell.cpp, line 110] 
nsAppShellService::Run() [nsAppShellService.cpp, line 417] 
Netscape 6 + 0x694c (0x044d977c) 
Netscape 6 + 0x76d0 (0x044da500) 
Netscape 6 + 0x1c198 (0x044eefc8)

winNT talkback is the same as the ones reported by asa. i have a Macsbug stack
crawl...will add that soon.

Comment 6

[sairuh (rarely reading bugmail)]

Macsbug info pretty similar:

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  044EEFC8  
  061137C0    PPC  044DA500  main+00130
  06113760    PPC  044D977C  main1(int, char**, nsISupports*)+00C1C
  06113430    PPC  06919CEC  nsAppShellService::Run()+00018
  061133F0    PPC  0678F310  nsAppShell::Run()+00048
  061133A0    PPC  0678FD60  nsMacMessagePump::DoMessagePump()+0003C
  06113350    PPC  06790388  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
00098
  06113300    PPC  067911CC  nsMacMessagePump::DoActivate(EventRecord&)+00068
  061132B0    PPC  06791328  
nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort
*)+00040
  06113260    PPC  0678C934  nsMacMessageSink::DispatchOSEvent(EventRecord&, 
GrafPort*)+00038
  06113220    PPC  06787628  nsMacWindow::HandleOSEvent(EventRecord&)+00020
  061131E0    PPC  0678865C  nsMacEventHandler::HandleOSEvent(EventRecord&)+00070
  06113190    PPC  067897D8  nsMacEventHandler::HandleActivateEvent(EventRecord&
)+00154
  06113140    PPC  067881EC  nsMacEventDispatchHandler::SetDeactivated(nsWindow*
)+00064
  061130F0    PPC  06791C20  
nsDeleteObserved::RemoveDeleteObserver(nsDeleteObserver*)+00018
 Closing log

Comment 7

[sairuh (rarely reading bugmail)]

also crashes w/branch bits on mac and winnt; also fails to save on linux branch
bits.

Comment 8

[John Morrison]

Egads, it's the cyndilauper.com bug! Hell does freeze over. The popup has an
onblur handler which closes the popup when the filepicker comes up. Hilarity
ensues...

*** This bug has been marked as a duplicate of 68454 ***

Comment 9

[sairuh (rarely reading bugmail)]

woohoo! thx for the reminder, jrgm. :)

zap.

Comment 10

[greer]

adding stack signature and keyword topcrash for talkback tracking.

Comment 11

[John Morrison]

You're barking up the wrong tree. This is an obscure scenario (window.close 
during a blur), it does not crash with that signature on windows, and the 
stack trace may just be a "victim" stack trace on Mac.

Comment 12

[John Morrison]

*** Bug 115542 has been marked as a duplicate of this bug. ***