Closed Bug 3520 Opened 26 years ago Closed 26 years ago

page with image crashes browser on exit

Categories

(Core :: Graphics: ImageLib, defect, P3)

Product:
Core
Component:
Graphics: ImageLib
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED DUPLICATE of bug 5238

People

(Reporter: morse, Assigned: pnunn)

References

(
URL
)

Details

Following content will crash the browser upon browser exit. To demonstrate this, bring up a page containing the content and then close the browser. The stack trace at time of crash is included. Content: -------- <html> <body> <img src="http://junk.gif" width="96" height="42"> </body> </html> Stack Trace: ------------ XP_NotifyObservers(OpaqueObserverList * 0xdddddddd, long 9, void * 0x0012fc50) line 248 + 3 bytes il_image_destroyed_notify(_IL_ImageReq * 0x0128cc90) line 320 + 18 bytes IL_DestroyImage(_IL_ImageReq * 0x0128cc90) line 1377 + 9 bytes ImageRequestImpl::Release(ImageRequestImpl * const 0x0128bda0) line 124 + 12 bytes DeviceContextImpl::~DeviceContextImpl() line 94 + 39 bytes nsDeviceContextWin::~nsDeviceContextWin() line 61 nsDeviceContextWin::`scalar deleting destructor'(unsigned int 1) + 15 bytes DeviceContextImpl::Release(DeviceContextImpl * const 0x01271330) line 52 + 99 bytes nsWebShell::~nsWebShell() line 470 + 27 bytes nsWebShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsWebShell::Release(nsWebShell * const 0x01270b80) line 538 + 95 bytes nsDocumentBindInfo::~nsDocumentBindInfo() line 1380 + 27 bytes nsDocumentBindInfo::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsDocumentBindInfo::Release(nsDocumentBindInfo * const 0x012da170) line 1389 + 99 bytes nsStreamListenerProxy::~nsStreamListenerProxy() line 832 + 18 bytes nsStreamListenerProxy::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsStreamListenerProxy::Release(nsStreamListenerProxy * const 0x012da1c0) line 683 + 92 bytes bam_exit_routine(URL_Struct_ * 0x012da240, int -201, MWContext_ * 0x012da4c0) line 1401 + 18 bytes net_CallExitRoutine(void (URL_Struct_ *, int, MWContext_ *)* 0x004a2d6b bam_exit_routine(URL_Struct_ *, int, MWContext_ *), URL_Struct_ * 0x012da240, int -201, int 102, MWContext_ * 0x012da4c0) line 1158 + 15 bytes CallExitRoutineProxyEvent::HandleEvent(CallExitRoutineProxyEvent * const 0x012d6cc0) line 895 + 40 bytes ProxyEvent::HandlePLEvent(PLEvent * 0x012d6cc4) line 397 PL_HandleEvent(PLEvent * 0x012d6cc4) line 478 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x0122ebb0) line 439 + 9 bytes _md_EventReceiverProc(void * 0x02c60160, unsigned int 49306, unsigned int 0, long 19065776) line 822 + 9 bytes US
Status: NEW → ASSIGNED
Target Milestone: M5
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → WORKSFORME
I just tried this out on a recent build and am no longer getting this crash. So I agree with pnunn's resolution of works-for-me.
[put snippet on a web server to use in verifying that this is no longer taking place. I actually believe this is a duplicate of another bug that has been fixed]
Status: RESOLVED → REOPENED
Status: REOPENED → RESOLVED
Closed: 26 years ago → 26 years ago
Resolution: WORKSFORME → DUPLICATE
Status: RESOLVED → VERIFIED
Err, actually, this is a duplicate of 5238. (Okay, 5238 is a duplicate of this, but that bug was the one that got investigated and fixed.) Thus, re-opening to mark as duplicate.
*** This bug has been marked as a duplicate of 5238 ***
You need to log in before you can comment on or make changes to this bug.