While fixing a bug of my own, I ran into the failure case shown below. This was probably never hit in 4.x except in a low memory situation, when we probably didn't survive in any case. It is hit in the current codebase, since the URL returned could be null if it is malformed. When we go into the failture code, the ImageReq is deleted, but not removed from the ic that was attached to above. As a result, there's a dangling pointer left in the ic that we hit later when cleaning up this group context. The failure code should remove this dangling pointer. 2070 url = ic->net_cx->CreateURL(image_url, cache_reload_policy); 2071 2072 if (!url) 2073 { 2074 #ifndef M12N /* XXXM12N fix me. */ 2075 /* xxx clean up previously allocated objects */ 2076 return MK_OUT_OF_MEMORY; 2077 #else 2078 NS_RELEASE(image_req->net_cx); 2079 PR_FREEIF(image_req); 2080 return NULL; 2081 #endif /* M12N */ 2082 }

Thanks for catching that Vidur. -pn

It looks like this also a problem there is a bug creating a new NetReader or creating a net context for the image request. -pn

Used il_delete_client() to clean up. In 3 places, where image_req creation fails in IL_GetImage(). -pn

Vidur, Would you like to confirm that this is fixed to your satisfaction, or should I just rubber-stamp it as verified? Thanks!

I trust Pam on this. Rubber-stamp it!

Boing! Rubber-stamped verified. Thanks!