Under Win32 (VC++ 6.0 optimized build), Gecko will become unstable (will GPF) after displaying a form containing an <input type="image"...> element. The following test case illustrates the problem: 1. Create a VC++ 6.0 project named "Myviewer", identical to the viewer app, except that the only source files are nsSetupRegistry.cpp and the following .cpp #include <windows.h> #include "nsITimer.h" #include "plevent.h" HINSTANCE gInstance, gPrevInstance; static nsITimer* gNetTimer; #include "nsIEventQueueService.h" #include "nsIServiceManager.h" #include "nsIWebShell.h" #include "nsXPComCIID.h" #include "nsINetService.h" #include "nsIAppShell.h" #include "nsWidgetsCID.h" static NS_DEFINE_IID(kWebShellCID, NS_WEB_SHELL_CID); static NS_DEFINE_IID(kIWebShellIID, NS_IWEB_SHELL_IID); static NS_DEFINE_IID(kEventQueueServiceCID, NS_EVENTQUEUESERVICE_CID); static NS_DEFINE_IID(kIEventQueueServiceIID, NS_IEVENTQUEUESERVICE_IID); static NS_DEFINE_IID(kAppShellCID, NS_APPSHELL_CID); static NS_DEFINE_IID(kIAppShellIID, NS_IAPPSHELL_IID); static NS_DEFINE_IID(kWindowCID, NS_WINDOW_CID); static NS_DEFINE_IID(kIWindowIID, NS_IWINDOW_IID); extern "C" void NS_SetupRegistry(); static nsIWebShell* gWebShell; static nsIAppShell* gAppShell; static nsIWidget* gWindow; #define IDM_LOAD_URL 40001 //--------------------------------------------------------------------- void check_rv(nsresult rv, char* pAction) { nsString m("From check_rv -- "); if (rv == NS_OK) { m.Append("Successful: "); m.Append(pAction); char* pStr = m.ToNewCString(); printf("\n%s", pStr); delete pStr; } else { m.Append("Error: "); m.Append(pAction); m.Append(". rv = "); m.Append(rv, 16); char* pStr = m.ToNewCString(); printf("\n%s", pStr); delete pStr; } } //--------------------------------------------------------------------- static nsEventStatus PR_CALLBACK HandleBrowserEvent(nsGUIEvent *aEvent) { nsEventStatus result = nsEventStatus_eIgnore; switch(aEvent->message) { case NS_MENU_SELECTED: switch(((nsMenuEvent*)aEvent)->mCommand) { case IDM_LOAD_URL: nsString url("C:\\myviewer\\formbad.htm"); nsresult rv = gWebShell->LoadURL(url); check_rv(rv, "LoadURL"); } break; case NS_DESTROY: gAppShell->Exit(); result = nsEventStatus_eConsumeDoDefault; default: break; } return result; } //--------------------------------------------------------------------- void doit(int argc, char **argv) { nsresult rv = NS_ERROR_FAILURE; // Setup Registry NS_SetupRegistry(); // Create the Event Queue for the UI thread nsIEventQueueService* mEventQService; rv = nsServiceManager::GetService(kEventQueueServiceCID, kIEventQueueServiceIID, (nsISupports **)&mEventQService); check_rv(rv, "GetService(...&mEventQService)"); rv = mEventQService->CreateThreadEventQueue(); check_rv(rv, "mEventQService->CreateThreadEventQueue()"); // Create widget application shell rv = nsComponentManager::CreateInstance(kAppShellCID, nsnull, kIAppShellIID, (void**) &gAppShell); check_rv(rv, "CreateInstance(...&gAppShell)"); rv = gAppShell->Create(&argc, argv); check_rv(rv, "gAppShell->Create()"); // Setup networking library rv = NS_InitINetService(); check_rv(rv, "NS_InitINetService()"); // Create top level window rv = nsComponentManager::CreateInstance(kWindowCID, nsnull, kIWindowIID, (void**)&gWindow); check_rv(rv, "CreateInstance(...&gWindow)"); nsWidgetInitData initData; initData.mBorderStyle = eBorderStyle_dialog; nsRect r(0, 0, 400, 600); rv = gWindow->Create((nsIWidget*)NULL, r, HandleBrowserEvent, nsnull, gAppShell, nsnull, &initData); check_rv(rv, "gWindow->Create()"); rv = gWindow->GetClientBounds(r); check_rv(rv, "gWindow->GetClientBounds()"); rv = gWindow->Show(PR_TRUE); check_rv(rv, "gWindow->Show()"); // Create web shell rv = nsComponentManager::CreateInstance(kWebShellCID, nsnull, kIWebShellIID, (void**)&gWebShell); check_rv(rv, "CreateInstance(...&gWebShell)"); r.x = r.y = 0; rv = gWebShell->Init(gWindow->GetNativeData(NS_NATIVE_WIDGET), r.x, r.y, r.width, r.height, nsScrollPreference_kAuto, PR_TRUE, PR_TRUE); check_rv(rv, "gWebShell->Init()"); // Show web shell rv = gWebShell->Show(); check_rv(rv, "gWebShell->Show()"); // Create main menu HMENU menu = ::LoadMenu(gInstance, "Myviewer"); HWND hwnd = (HWND)gWindow->GetNativeData(NS_NATIVE_WIDGET); ::SetMenu(hwnd, menu); // LoadURL nsString url("C:\\myviewer\\formbad.htm"); rv = gWebShell->LoadURL(url); check_rv(rv, "gWebShell->LoadURL()"); // Start message pump gAppShell->Run(); } //--------------------------------------------------------------------- int main(int argc, char **argv) { doit(argc, argv); return 0; } 2. Add a new menu item to Myviewer.rc and associate it with the constant IDM_LOAD_URL (40001). 3. Create the subdirectory "C:\myviewer". 4. Save the following html to the file "C:\myviewer\formbad.htm" <html> <head> </head> <body> <form> <input type="image" src="foo.jpg"> </form> </body> </html> 5. Build and execute the project, wait for the form to be displayed, then select the new menu item. If this didn't cause the GPF, select the menu item again (it sometimes happens on the 2nd invocation). Note that the GPF will occur regardless of whether foo.jpg exists.

My test case for this is at http://marmot.net/work/input_image.html. I haven't seen it GPF using this case. If this is something that can only be seen using a developer's build, karnaze, if you can help me figure out a test case if this is valid and when it is fixed, that'd be great.

I don't know who should get this bug. Nisheeth has "embedding apis" but this is a much lower level SDK issue than that. Troy, I'm reassigning this to you so you can decide what to do with it (and also because I would not be able to look at it for a long time and don't have plans to install VC 6.0).

Reassigning to Eric

After further testing I've found that this GPF can also be caused by html that doesn't contain <input type = "image"...>. Although it's not clear what other html constructs might invoke this behavior. In the doit() function I included, you'll note that I'm not setting a container or observer. Could that be the cause for this instability?

This bug in particular, and the general question of Gecko's stability in general, has somehow become the main topic of conversation in my current development project. The powers that be are considering switching to an embedded PDF viewer or (God forbid) the IE ActiveX control, abandoning Gecko. I don't want this, and will do anything to prevent it. What can I do to help with this bug? If you'd like, I can zip up my entire VC++ project, put it up on my web, and send you a link to it? Or anything else --- you name it. Paul

It would appear that this is just bug #4131. The fix described in http://www.doczilla.com/development/extmoz.html#i6.3 which is to modify mozilla/gfx/src/nsImageManager.cpp, adding the line NS_ADDREF(gImageManager); after the line gImageManager = new ImageManagerImpl(); seems to work.

Paul, thanks for figuring this out.

Paul, would you please be so kind as to verify this as fixed? Thanks!

It's fixed.

Marking verified fixed (as per Paul). Thanks again!