#0 0x20 in ?? () #1 0x40946c5d in RDFXULBuilderImpl::OnSetAttribute (this=0x810af78, aElement=0x8248818, aName=@0xbfffdd4c, aValue=@0xbfffde10) at nsRDFXULBuilder.cpp:1363 #2 0x40956b57 in XULDocumentImpl::OnSetAttribute (this=0x810b298, aElement=0x8248818, aName=@0xbfffdd4c, aValue=@0xbfffde10) at nsXULDocument.cpp:3309 #3 0x4092422e in RDFElementImpl::SetAttribute (this=0x8248818, aName=@0xbfffdd4c, aValue=@0xbfffde10) at nsRDFElement.cpp:877 #4 0x40f5b67e in setAttribute (shell=0x8102900, id=0x40f71649 "Browser:Status", name=0x40f71644 "text", value=@0xbfffde10) at nsBrowserAppCore.cpp:797 #5 0x40f5d2ce in nsBrowserAppCore::OnStatusURLLoad (this=0x82e78d0, loader=0x82edcc8, aURL=0x8482538, aMsg=@0xbfffde10) at nsBrowserAppCore.cpp:1412 #6 0x402bbcc5 in nsWebShell::OnStatusURLLoad (this=0x82ed8e8, loader=0x82edcc8, aURL=0x8482538, aMsg=@0xbfffde10) at nsWebShell.cpp:2443 #7 0x402b4937 in nsDocLoaderImpl::FireOnStatusURLLoad (this=0x82edcc8, aLoadInitiator=0x82edcc8, aURL=0x8482538, aMsg=@0xbfffde10) at nsDocLoader.cpp:919 #8 0x402b5912 in nsDocumentBindInfo::OnStatus (this=0x8481cd0, aURL=0x8482538, aMsg=0x8482908) at nsDocLoader.cpp:1361 #9 0x4029c32e in stub_Progress (context=0x8474ae8, msg=0x84828c0 "Connect: Contacting host: www.disney.go.com...") at nsStubContext.cpp:548 #10 0x402777eb in NET_Progress (context=0x8474ae8, msg=0x84828c0 "Connect: Contacting host: www.disney.go.com...") at mkutils.c:98 #11 0x40265d6f in net_start_first_connect (host=0x84827f8 "www.disney.go.com", sock=0x84899b8, window_id=0x8474ae8, tcp_con_data=0x8482848, error_msg=0x8461c30, localIP=0) at mkconect.c:868 #12 0x402666e5 in NET_BeginConnect ( url=0x84825b0 "http://www.disney.go.com/globalmedia/homepage/bgtile.jpg", ip_address_string=0x0, prot_name=0x401aadb5 "HTTP", def_port=80, sock=0x8482814, dummy=0 '\000', tcp_con_data=0x84827e4, window_id=0x8474ae8, error_msg=0x8461c30, socks_host=0, socks_port=0, localIP=0) at mkconect.c:1255 #13 0x4019b851 in net_start_http_connect (ce=0x8482738) at mkhttp.c:500 #14 0x401a2bf5 in net_ProcessHTTP (ce=0x8482738) at mkhttp.c:3523 #15 0x401a2ace in net_HTTPLoad (ce=0x8482738) at mkhttp.c:3491 #16 0x4026b392 in NET_GetURL (URL_s=0x8461b28, output_format=102, window_id=0x8474ae8, exit_routine=0x402962f8 <bam_exit_routine(URL_Struct_ *, int, MWContext_ *)>) at mkgeturl.c:2979 #17 0x40294795 in nsNetlibService::OpenStream (this=0x8071c58, aUrl=0x8482538, aConsumer=0x8481cd0) at nsNetService.cpp:480 #18 0x402b5619 in nsDocumentBindInfo::Bind (this=0x8481cd0, aURL=0x8482538, aListener=0x83c2038) at nsDocLoader.cpp:1263 #19 0x402b4461 in nsDocLoaderImpl::OpenStream (this=0x82edcc8, aUrl=0x8482538, aConsumer=0x83c2038) at nsDocLoader.cpp:744 #20 0x40295f49 in NS_OpenURL (aURL=0x8482538, aConsumer=0x83c2038) at nsNetService.cpp:1206 #21 0x400e8f8d in ImageNetContextImpl::GetURL (this=0x8482500, aURL=0x8482520, aLoadMethod=NET_NORMAL_RELOAD, aReader=0x8482680) at nsImageNetContextAsync.cpp:490 #22 0x40480c78 in IL_GetImage ( image_url=0x84821e8 "http://www.disney.go.com/globalmedia/homepage/bgtile.jpg", img_cx=0x84820e0, obs_list=0x8482288, background_color=0xbfffe730, req_width=0, req_height=0, flags=0, opaque_cx=0x8482130) at if.cpp:2008 #23 0x400e9f13 in ImageRequestImpl::Init (this=0x8482228, aGroupContext=0x84820e0, aUrl=0x84821e8 "http://www.disney.go.com/globalmedia/homepage/bgtile.jpg", aObserver=0x8482154, aBackgroundColor=0x8463be8, aWidth=0, aHeight=0, aFlags=0, aNetContext=0x8482130) at nsImageRequest.cpp:242 #24 0x400e773a in ImageGroupImpl::GetImage (this=0x8482080, aUrl=0x84821e8 "http://www.disney.go.com/globalmedia/homepage/bgtile.jpg", aObserver=0x8482154, aBackgroundColor=0x8463be8, aWidth=0, aHeight=0, aFlags=0) at nsImageGroup.cpp:266 #25 0x40d0916c in nsFrameImageLoader::Init (this=0x8482150, aPresContext=0x8401cc8, aGroup=0x8482080, aURL=@0x8463bf4, aBackgroundColor=0x8463be8, aDesiredSize=0x0, aTargetFrame=0x8463dc8, aCallBack=0, aClosure=0x0) at nsFrameImageLoader.cpp:193 #26 0x40d196c9 in nsPresContext::StartLoadImage (this=0x8401cc8, aURL=@0x8463bf4, aBackgroundColor=0x8463be8, aDesiredSize=0x0, aTargetFrame=0x8463dc8, aCallBack=0, aClosure=0x0, aResult=0xbfffe8d0) at nsPresContext.cpp:709 #27 0x40c944f2 in nsCSSRendering::PaintBackground (aPresContext=@0x8401cc8, aRenderingContext=@0x8481b88, aForFrame=0x8463dc8, aDirtyRect=@0xbfffebc4, aBorderArea=@0xbfffe958, aColor=@0x8463bdc, aSpacing=@0x8463c1c, aDX=0, aDY=0) at nsCSSRendering.cpp:1779 #28 0x40b71dba in nsBlockFrame::Paint (this=0x8463dc8, aPresContext=@0x8401cc8, aRenderingContext=@0x8481b88, aDirtyRect=@0xbfffebc4, aWhichLayer=eFramePaintLayer_Underlay) at nsBlockFrame.cpp:4887 #29 0x40b68cf5 in nsAreaFrame::Paint (this=0x8463dc8, aPresContext=@0x8401cc8, aRenderingContext=@0x8481b88, aDirtyRect=@0xbfffebc4, aWhichLayer=eFramePaintLayer_Underlay) at nsAreaFrame.cpp:161 #30 0x40b77206 in nsContainerFrame::PaintChild (this=0x8463a88, aPresContext=@0x8401cc8, aRenderingContext=@0x8481b88, aDirtyRect=@0xbfffee10, aFrame=0x8463dc8, aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:295 #31 0x40b7706e in nsContainerFrame::PaintChildren (this=0x8463a88, aPresContext=@0x8401cc8, aRenderingContext=@0x8481b88, aDirtyRect=@0xbfffee10, aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:235 #32 0x40b815df in nsHTMLContainerFrame::Paint (this=0x8463a88, aPresContext=@0x8401cc8, aRenderingContext=@0x8481b88, aDirtyRect=@0xbfffee10, aWhichLayer=eFramePaintLayer_Underlay) at nsHTMLContainerFrame.cpp:78 #33 0x40b9de25 in PresShell::Paint (this=0x82f7e48, aView=0x8463ad0, aRenderingContext=@0x8481b88, aDirtyRect=@0xbfffee10) at nsPresShell.cpp:1940 #34 0x41024140 in nsView::Paint (this=0x8463ad0, rc=@0x8481b88, rect=@0xbfffee10, aPaintFlags=128, aResult=@0xbfffef74) at nsView.cpp:285 #35 0x4102dd23 in nsViewManager::RenderView (this=0x83b8a58, aView=0x8463ad0, aRC=@0x8481b88, aDamageRect=@0xbfffef64, aGlobalRect=@0x8481d80, aResult=@0xbfffef74) at nsViewManager.cpp:1277 #36 0x4102c1be in nsViewManager::RenderViews (this=0x83b8a58, aRootView=0x8462f40, aRC=@0x8481b88, aRect=@0xbfffef64, aResult=@0xbfffef74) at nsViewManager.cpp:810 #37 0x4102b728 in nsViewManager::Refresh (this=0x83b8a58, aView=0x8462f40, aContext=0x8481b88, rect=0xbfffeff8, aUpdateFlags=0) at nsViewManager.cpp:519 #38 0x4102e4fb in nsViewManager::DispatchEvent (this=0x83b8a58, aEvent=0xbffff0b8, aStatus=@0xbffff03c) at nsViewManager.cpp:1642 #39 0x41023998 in HandleEvent (aEvent=0xbffff0b8) at nsView.cpp:66 #40 0x400c4512 in nsWidget::DispatchEvent (this=0x8462fa8, event=0xbffff0b8, aStatus=@0xbffff078) at nsWidget.cpp:981 #41 0x400c441c in nsWidget::DispatchWindowEvent (this=0x8462fa8, event=0xbffff0b8) at nsWidget.cpp:943 #42 0x400c6585 in nsWindow::OnPaint (this=0x8462fa8, event=@0xbffff0b8) at nsWindow.cpp:509 #43 0x400c1490 in handle_expose_event (w=0x84630a0, event=0x8161ab8, p=0x8462fa8) at nsGtkEventHandler.cpp:374 #44 0x405ede01 in gtk_marshal_BOOL__POINTER (object=0x84630a0, func=0x400c1418 <handle_expose_event(_GtkWidget *, _GdkEventExpose *, void *)>, func_data=0x8462fa8, args=0xbffff19c) at gtkmarshal.c:32 #45 0x405b2aea in gtk_handlers_run (handlers=0x8312950, signal=0xbffff158, object=0x84630a0, params=0xbffff19c, after=0) at gtksignal.c:1909 #46 0x405b1ff0 in gtk_signal_real_emit (object=0x84630a0, signal_id=25, params=0xbffff19c) at gtksignal.c:1469 #47 0x405b0300 in gtk_signal_emit (object=0x84630a0, signal_id=25) at gtksignal.c:552 #48 0x405e54bc in gtk_widget_event (widget=0x84630a0, event=0x8161ab8) at gtkwidget.c:2788 #49 0x40584271 in gtk_main_do_event (event=0x8161ab8) at gtkmain.c:800 #50 0x4062ae86 in gdk_event_dispatch (source_data=0x0, current_time=0xbffff4fc, user_data=0x0) at gdkevents.c:2086 #51 0x40657093 in g_main_dispatch (current_time=0xbffff4fc) at gmain.c:644 #52 0x4065761f in g_main_iterate (block=1, dispatch=1) at gmain.c:851 #53 0x406577a1 in g_main_run (loop=0x81037f0) at gmain.c:909 #54 0x40583c2f in gtk_main () at gtkmain.c:507 #55 0x400b6a29 in nsAppShell::Run (this=0x809c828) at nsAppShell.cpp:208 #56 0x4001e1ed in nsAppShellService::Run (this=0x8077f30) at nsAppShellService.cpp:208 #57 0x804ba54 in main (argc=1, argv=0xbffff670) at nsAppRunner.cpp:462

There may be another problem related to RDF, but the crash I'm seeing (in viewer and apprunner) looks like this: nsCSSFrameConstructor::CantRenderReplacedElement(nsCSSFrameConstructor * const 0x010c7830, nsIPresContext * 0x010db9e0, nsIFrame * 0x00000000) line 4992 + 7 bytes StyleSetImpl::CantRenderReplacedElement(StyleSetImpl * const 0x010c7370, nsIPresContext * 0x010db9e0, nsIFrame * 0x00000000) line 899 PresShell::HandleCantRenderReplacedElementEvent(nsIFrame * 0x00000000) line 1350 HandlePLEvent(CantRenderReplacedElementEvent * 0x0115e870) line 1369 PL_HandleEvent(PLEvent * 0x0115e870) line 491 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00fe0470) line 452 + 9 bytes _md_EventReceiverProc(void * 0x043d03f8, unsigned int 0x0000c0ae, unsigned int 0x00000000, long 0x00fe0470) line 868 + 9 bytes USER32! 77e71268() aFrame == nsnull. Peter, this looks like your juju...

No, this is Troy's juju. Did he bring anyone up to speed on his stuff before he left?

This is a verification URL, giving it an M6 milestone so we can start moving on this.

Still crashing for me, updating status whiteboard. #0 0x407e5904 in memmove (dest=0x853b010, src=0x853b014, len=67108864) at ../sysdeps/generic/memmove.c:69 #1 0x40095ceb in nsCRT::memmove (aDest=0x853b010, aSrc=0x853b014, aCount=67108864) at nsCRT.h:85 #2 0x4008e218 in nsVoidArray::RemoveElementAt (this=0x8242550, aIndex=0) at nsVoidArray.cpp:167 #3 0x4008e299 in nsVoidArray::RemoveElement (this=0x8242550, aElement=0x85dcfa0) at nsVoidArray.cpp:182 #4 0x400f709c in ImageNetContextImpl::RequestDone (this=0x84baff8, aConsumer=0x85dcfa0) at nsImageNetContextAsync.cpp:519 #5 0x400f689e in ImageConsumer::OnStopBinding (this=0x85dcfa0, aURL=0x8449eb8, status=0, aMsg=0xbfffeee8) at nsImageNetContextAsync.cpp:327 #6 0x402c50a6 in nsDocumentBindInfo::OnStopBinding (this=0x85dcfd0, aURL=0x8449eb8, aStatus=0, aMsg=0xbfffeee8) at nsDocLoader.cpp:1523 #7 0x402aabf7 in stub_complete (stream=0x85e0838) at nsStubContext.cpp:771 #8 0x401c564b in net_ProcessFile (cur_entry=0x856af48) at mkfile.c:1360 #9 0x40278f17 in NET_ProcessNet (ready_fd=0x0, fd_type=1) at mkgeturl.c:3355

I don't see that on Win NT 4.0, the reported crash is in image code now... transferring over there.

I just updated my tree and I don't see the crash on NT. Will try on linux & mac. -pn

I think this is a Linux-specific problem, and it may be timer-related, showing different stack traces.

reassigning to mcafee at his request...... note: I get different trace at crash everytime I run it. -pn

This might be a dupe of the gagan timer bug, which is marked M8 awaiting the necko landing. Assigning to chofmann, since this is a verification URL and might not be able to wait for M8.

warren, m8. it would also be good if chrisd, paulmac, or namachi can see if they can get some more straight forward analysis of all the type of crashes and problems assoicated with the disney site, and break this up into a single bug for each problem

Well, to be honest, the developers can't even narrow this down, so I don't imagine I can either. I guess we just wait for Necko and hope. I'm content just leaving this bug and the other one (5879) as is - a linux-specific timer-related semi-random crash bug.

Deferring until after necko landing.

This no longer crashes, but the page is blank. Bug 5879 appears to be the same thing. *** This bug has been marked as a duplicate of 5879 ***

Verifying as duplicate (confirmed that 5879 is in fact a full duplicate.)