Closed Bug 1356 Opened 26 years ago Closed 22 years ago

URL: (relative) Bogus Image crashes NGLayout

Categories

(Core :: Networking, defect, P1)

Product:
Core
Component:
Networking
Platform:
x86
Other
Type:
defect

Tracking

()

Status:
VERIFIED DUPLICATE of bug 1420

People

(Reporter: angus, Assigned: raman)

References

(
URL
)

Details

Here's the sample code that crashes the viewer (I'm using an optimized build from 11-10-98 8pm): <html> <a href="http://www.browsercaps.com/config/Cv/Generated/survey.html"> <img width=48 height=24 src="/Images/nbtakeoff.gif" alt="Take the Tests" border=0> </a> </body> </html> Note that on your local machine, the Image will not be found (of course). This seems to be causing the crash. If you change the path for the image to an absolute URL, this example does NOT crash NGLayout: <html> <a href="http://www.browsercaps.com/config/Cv/Generated/survey.html"> <img width=48 height=24 src="http://www.browsercaps.com/Images/nbtakeoff.gif" alt="Take the Tests" border=0> </a> </body> </html> Here's the stack trace: PL_HashString(const void * 0x00000000) line 462 + 22 bytes PL_HashTableLookup(PLHashTable * 0x00ea12e0, const void * 0x00000000) line 343 + 10 bytes nsNetFile::GetFilePath(nsNetFile * const 0x00ea0030, const char * 0x00f872a0, char * * 0x0012bb64) line 172 + 16 bytes WH_FileName(const char * 0x00f872a0, XP_FileType xpURL) line 946 + 45 bytes NET_I_XP_Stat(const char * 0x00f872a0, _stat * 0x0012bc10, XP_FileType xpURL) line 1301 + 13 bytes net_check_file_type(_ActiveEntry * 0x00f873a0) line 180 + 94 bytes net_ProcessFile(_ActiveEntry * 0x00f873a0) line 1291 + 9 bytes net_FileLoad(_ActiveEntry * 0x00f873a0) line 1273 + 9 bytes NET_GetURL(URL_Struct_ * 0x00f876f0, int 102, MWContext_ * 0x00f87460, void (URL_Struct_ *, int, MWContext_ *)* 0x004220da bam_exit_routine(URL_Struct_ *, int, MWContext_ *)) line 3028 + 12 bytes nsNetlibService::OpenStream(nsNetlibService * const 0x00ec70e0, nsIURL * 0x00f87bc0, nsIStreamListener * 0x00f87980) line 363 + 20 bytes nsDocumentBindInfo::Bind(nsIURL * 0x00f87bc0, nsIStreamListener * 0x00f879e0) line 1171 + 23 bytes nsDocLoaderImpl::OpenStream(nsDocLoaderImpl * const 0x00eeca54, nsIURL * 0x00f87bc0, nsIStreamListener * 0x00f879e0) line 840 + 16 bytes URLImpl::Open(nsIStreamListener * 0x00f879e0) line 712 + 26 bytes ImageNetContextImpl::GetURL(ilIURL * 0x00f87c90, NET_ReloadMethod NET_NORMAL_RELOAD, ilINetReader * 0x00f87b30) line 489 + 15 bytes IL_GetImage(const char * 0x00f86280, _IL_GroupContext * 0x00f86510, OpaqueObserverList * 0x00f86160, _NI_IRGB * 0x00000000, unsigned long 0, unsigned long 0, unsigned long 0, void * 0x00f86480) line 1899 + 35 bytes ImageRequestImpl::Init(void * 0x00f86510, const char * 0x00f86280, nsIImageRequestObserver * 0x00f86410, const unsigned int * 0x00000000, unsigned int 0, unsigned int 0, unsigned int 0, ilINetContext * 0x00f86480) line 107 + 49 bytes ImageGroupImpl::GetImage(const char * 0x00f86280, nsIImageRequestObserver * 0x00f86410, const unsigned int * 0x00000000, unsigned int 0, unsigned int 0, unsigned int 0) line 237 + 46 bytes nsFrameImageLoader::Init(nsFrameImageLoader * const 0x00f86410, nsIPresContext * 0x00f80f00, nsIImageGroup * 0x00f865c0, const nsString & {...}, const unsigned int * 0x00000000, nsIFrame * 0x00f81f10, unsigned int (nsIPresContext &, nsIFrame *, int)* 0x0051d7c0 UpdateImageFrame(nsIPresContext &, nsIFrame *, int), int 0) line 142 + 29 bytes nsPresContext::StartLoadImage(nsPresContext * const 0x00f80f00, const nsString & {...}, const unsigned int * 0x00000000, nsIFrame * 0x00f81f10, unsigned int (nsIPresContext &, nsIFrame *, int)* 0x0051d7c0 UpdateImageFrame(nsIPresContext &, nsIFrame *, int), int 0, nsIFrameImageLoader * & 0x00000000) line 537 + 43 bytes nsHTMLImageLoader::StartLoadImage(nsIPresContext * 0x00f80f00, nsIFrame * 0x00f81f10, unsigned int (nsIPresContext &, nsIFrame *, int)* 0x0051d7c0 UpdateImageFrame(nsIPresContext &, nsIFrame *, int), int 0, int & 0) line 177 + 37 bytes nsHTMLImageLoader::GetDesiredSize(nsIPresContext * 0x00f80f00, const nsHTMLReflowState & {...}, nsIFrame * 0x00f81f10, unsigned int (nsIPresContext &, nsIFrame *, int)* 0x0051d7c0 UpdateImageFrame(nsIPresContext &, nsIFrame *, int), nsHTMLReflowMetrics & {...}) line 221 ImageFrame::GetDesiredSize(nsIPresContext * 0x00f80f00, const nsHTMLReflowState & {...}, nsHTMLReflowMetrics & {...}) line 397 nsLeafFrame::Reflow(nsLeafFrame * const 0x00f81f14, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 1230676) line 70 nsInlineReflow::ReflowFrame(nsHTMLReflowMetrics & {...}, unsigned int & 1230676) line 489 nsInlineReflow::ReflowFrame(nsIFrame * 0x00f81f10) line 269 + 16 bytes nsInlineFrame::ReflowFrame(nsInlineReflowState & {...}, nsInlineReflow & {...}, nsIFrame * 0x00f81f10, unsigned int & 0) line 975 + 12 bytes nsInlineFrame::ReflowMapped(nsInlineReflowState & {...}, nsInlineReflow & {...}, unsigned int & 0) line 917 + 24 bytes nsInlineFrame::InitialReflow(nsInlineReflowState & {...}, nsInlineReflow & {...}) line 797 + 20 bytes nsInlineFrame::Reflow(nsInlineFrame * const 0x00f831f4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 1232972) line 563 + 25 bytes nsInlineReflow::ReflowFrame(nsHTMLReflowMetrics & {...}, unsigned int & 1232972) line 489 nsInlineReflow::ReflowFrame(nsIFrame * 0x00f831f0) line 269 + 16 bytes nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, LineData * 0x00f81ae0, nsIFrame * 0x00f831f0, unsigned int & 120) line 3456 + 18 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, LineData * 0x00f81ae0, unsigned int & 120) line 2857 + 24 bytes nsBlockFrame::ReflowLinesAt(nsBlockReflowState & {...}, LineData * 0x00f81ae0) line 2722 + 20 bytes nsBlockFrame::FrameAppendedReflow(nsBlockReflowState & {...}) line 2464 nsBlockFrame::Reflow(nsBlockFrame * const 0x00f80594, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1860 + 18 bytes nsBodyFrame::Reflow(nsBodyFrame * const 0x00f80694, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 402 nsContainerFrame::ReflowChild(nsIFrame * 0x00f80690, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 437 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x00f82164, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 367 nsContainerFrame::ReflowChild(nsIFrame * 0x00f82160, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 437 + 28 bytes RootFrame::Reflow(RootFrame * const 0x00f82614, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 147 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x00f81de0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 163 PresShell::ProcessReflowCommands() line 713 PresShell::ExitReflowLock(PresShell * const 0x00f83e40) line 417 PresShell::ContentAppended(PresShell * const 0x00f83e48, nsIDocument * 0x00f85730, nsIContent * 0x00f829cc, int 0) line 831 nsDocument::ContentAppended(nsDocument * const 0x00f85730, nsIContent * 0x00f829cc, int 0) line 544 HTMLContentSink::WillInterrupt(HTMLContentSink * const 0x00f852f0) line 1363 CNavDTD::WillInterruptParse(CNavDTD * const 0x00f83ce0) line 3373 + 18 bytes nsParser::ResumeParse() line 653 nsParser::OnDataAvailable(nsParser * const 0x00f853b4, nsIURL * 0x00f84340, nsIInputStream * 0x00f843f0, int 185) line 879 nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x00f83910, nsIURL * 0x00f84340, nsIInputStream * 0x00f843f0, int 185) line 1362 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x00f820f0) line 607 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x00f820f4) line 452 + 12 bytes PL_HandleEvent(PLEvent * 0x00f820f4) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00ea7830) line 357 + 9 bytes _md_EventReceiverProc(HWND__ * 0x00120646, unsigned int 49394, unsigned int 0, long 15366192) line 675 + 9 bytes USER32! 77e71250() 00ea7830()
Status: NEW → ASSIGNED
Investigatiing...
i opened a similar bug (1549) before i saw this one, but basically if you type in a bogus directory or file name on a valid server, it also crashes NGLayout.
URL: http://www.browsercaps.com/config/Cv/...
Priority: P2 → P1
Summary: Bogus Image URL (relative) crashes NGLayout → ss:Bogus Image URL (relative) crashes NGLayout
Putting on ss: radar.
Summary: ss:Bogus Image URL (relative) crashes NGLayout → rn:Bogus Image URL (relative) crashes NGLayout
Taking off ss: list per bug mtg today. Will Release Note.
Summary: rn:Bogus Image URL (relative) crashes NGLayout → Bogus Image URL (relative) crashes NGLayout
This noe on Release Notes. Removing rn: status.
Assignee: gagan → raman
Status: ASSIGNED → NEW
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
The fix for bug# 1420 fixes this problem also. thanks, raman
Status: RESOLVED → VERIFIED
Verified fixed in 1.28.99 builds on MacOS, Win32 & Linux. Specifically, verified that the sample code no longer crashes the viewer with a bogus image URL.
Changing all Networking Library/Browser bugs to Networking-Core component for Browser. Occasionally, Bugzilla will burp and cause Verified bugs to reopen when I do this in a bulk change. If this happens, I will fix. ;-)
Bulk move of all Networking-Core (to be deleted component) bugs to new Networking component.
REOPEN: to dupe
Status: VERIFIED → REOPENED
Resolution: FIXED → ---
Summary: Bogus Image URL (relative) crashes NGLayout → URL: (relative) Bogus Image crashes NGLayout
RESOLVED/DUPE *** This bug has been marked as a duplicate of 1420 ***
Status: REOPENED → RESOLVED
Closed: 26 years ago → 22 years ago
Resolution: --- → DUPLICATE
Keywords: verifyme
vrfy dupe
Status: RESOLVED → VERIFIED
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.