* TITLE/SUMMARY [PP] Closing browser while loading image triggers a crash * STEPS TO REPRODUCE 0) Launch Apprunner 1) Open a second browser window 2) In either browser window, load the URL http://feature.geography.wisc.edu/ histcart/v1.gif (or, for a JPEG try http://www.prometheus-music.com/images/ rw_rough4.jpg) 2) While the image is loading, close the browser window. * RESULT - What happened An approximately 10 second pause occurs, browser crashes; stack crawl enclosed. (Tracking ID of ENO18YMO) While I wanted to see who this crash should actually go to, but Cyclone is down again. - What was expected Behavior equivalent to Win32/Linux; window should close without triggering a crash. * REGRESSION - Occurs On Mac OS Apprunner (5.14.99 AM optimized build) - Doesn't Occur On Win32 Apprunner (5.14.99 AM optimized build [NT 4, Service Pack 3]) Linux Apprunner (5.14.99 AM optimized build) * CONFIGURATIONS TESTED - [Mac] Power Mac 8500/120 (233 Mhz 604e), 64 MB RAM (VM on; 1 MB of VM used), 1024x768 (Thousands of Colors), Mac OS 8.6 - [Win32] Vectra VL (233 Mhz P2), 96 MB RAM, 800x600 (True Color), NT 4.0 SP3. - [Linux] Vectra VL (266 Mhz P2), 96 MB RAM. * STACK CRAWL PowerPC access exception at 0B38B104 PR_Lock+000A0 Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 0BA1AD14 02D59700 PPC 0BA19E2C main+006C0 02D59570 PPC 0B645B20 nsAppShellService::Run()+00018 02D59530 PPC 0B7214A8 nsAppShell::Run()+00038 02D594B0 PPC 0B721E24 nsMacMessagePump::DoMessagePump()+0003C 02D59460 PPC 0B721FBC nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 0005C 02D59410 PPC 0B722454 nsMacMessagePump::DoMouseDown(EventRecord&)+00234 02D59340 PPC 0B722B98 nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort *)+00044 02D592F0 PPC 0B71CE1C nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+00038 02D592B0 PPC 0B718940 nsMacWindow::HandleOSEvent(EventRecord&)+00020 02D59250 PPC 0B718D48 nsMacEventHandler::HandleOSEvent(EventRecord&)+00084 02D59210 PPC 0B719B78 nsMacEventHandler::HandleMouseDownEvent(EventRecord& )+0010C 02D59160 PPC 0B701CC0 nsWindow::Destroy()+00088 02D59110 PPC 0B7038BC nsWindow::ReportDestroyEvent()+00058 02D590A0 PPC 0B703634 nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018 02D59060 PPC 0B703560 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus& )+00090 02D59010 PPC 0B6402EC nsWebShellWindow::HandleEvent(nsGUIEvent*)+000C4 02D58FC0 PPC 0B640134 nsWebShellWindow::Close()+00034 02D58F60 PPC 0B97DE4C nsWebShell::Destroy()+00100 02D58ED0 PPC 0B981190 nsWebShell::Stop()+00058 02D58E80 PPC 0B9772F0 nsDocLoaderImpl::Stop()+00058 02D58E30 PPC 0B34BB14 nsVoidArray::EnumerateForwards(int (*)(void*, void* ), void*)+000 3C 02D58DE0 PPC 0B978A9C nsDocLoaderImpl::StopDocLoaderEnumerator(void*, void*)+00038 02D58DA0 PPC 0B9772F0 nsDocLoaderImpl::Stop()+00058 02D58D50 PPC 0B34BB14 nsVoidArray::EnumerateForwards(int (*)(void*, void* ), void*)+000 3C 02D58D00 PPC 0B978A9C nsDocLoaderImpl::StopDocLoaderEnumerator(void*, void*)+00038 02D58CC0 PPC 0B9772C4 nsDocLoaderImpl::Stop()+0002C 02D58C70 PPC 0B94AAF0 nsSupportsArray::EnumerateForwards(int (* )(nsISupports*, void*), void*) const+0003C 02D58C20 PPC 0B9789DC nsDocLoaderImpl::StopBindInfoEnumerator(nsISupports* , void*)+000 30 02D58BE0 PPC 0B979644 nsDocumentBindInfo::Stop()+0006C 02D58B90 PPC 0B077DB8 nsNetlibService::InterruptStream(nsIURL*)+0007C 02D58B40 PPC 0B05078C NET_InterruptStream+00034 02D58B00 PPC 0B05061C net_InterruptActiveStream+00038 02D58AC0 PPC 0B0729F0 net_InterruptHTTP+00174 02D589F0 PPC 0B07259C net_ProcessHTTP+0037C 02D589A0 PPC 0B045F78 net_MemCacheAbort+00024 02D58960 PPC 0B07D7AC stub_abort(_NET_StreamClass*, int)+00090 02D588C0 PPC 0B979D14 nsDocumentBindInfo::OnStopBinding(nsIURL*, unsigned int, const u nsigned short*)+00088 02D58860 PPC 0B9787E0 nsDocLoaderImpl::LoadURLComplete(nsIURL*, nsISupports*, int)+001 2C 02D58800 PPC 0B978144 nsDocLoaderImpl::FireOnEndDocumentLoad(nsIDocumentLoader*, int)+ 00054 02D587B0 PPC 0B98311C nsWebShell::OnEndDocumentLoad(nsIDocumentLoader*, nsIURL*, int)+ 001D4 02D586D0 PPC 0B011410 nsBrowserAppCore::OnEndDocumentLoad(nsIDocumentLoader*, nsIURL*, int)+00378 02D584E0 PPC 0B010E5C setAttribute(nsIWebShell*, const char*, const char*, const nsStr ing&)+00120 02D58420 PPC 0A3E2B50 nsHTMLInputElement::SetAttribute(const nsString&, const nsString &)+00010 02D583E0 PPC 0A4C4750 nsGenericElement::SetAttribute(const nsString&, const nsString&) +00050 02D58390 PPC 0A3E3BC8 nsHTMLInputElement::SetAttribute(int, nsIAtom*, const nsString&, int)+00010 02D58350 PPC 0A37F2B0 nsGenericHTMLElement::SetAttribute(int, nsIAtom*, const nsString &, int)+005F4 02D58270 PPC 0A185590 XULDocumentImpl::AttributeChanged(nsIContent*, nsIAtom*, int)+00 054 02D58210 PPC 0B644090 nsWebShellWindow::AttributeChanged(nsIDocument*, nsIContent*, ns IAtom*, int)+00044 02D58160 PPC 0A18D628 SetXULElementProperty(JSContext*, JSObject*, long, long*)+0001C 02D58110 PPC 0A675AE0 JS_GetPrivate+00010 02D580D0 PPC 0A699224 js_GetSlotWhileLocked+0001C 02D58080 PPC 0A6999A4 js_LockObj+0002C 02D58030 PPC 0A699808 js_LockScope1+0003C Closing log

[QA Assigning to self.]

cc:ing fur, per an lxr check.

BTW, I should have mentioned --- I can't reproduce this crash on HTML pages that have IMG tags. It only occurs when loading the image file itself as the URL.

reassigning to danm as p2 for m6

It's a problem with menu items being referenced after they're deleted. Looking into it.

Menumeister wants the bug. Menumeister gets the bug. Reassigning.

A list of window items (menu items, actually) was being referenced after it was deleted. That particular list is no longer being used anyway, so we just kept it from being built in the first place. All better now.

Verified fixed on 5.25.99 Mac OS M6 candidate build. (Steps to reproduce no longer trigger a crash.) Also double-checked that there was no post-fix regression involving this use case on Win32 (5.25.99 M6) or Linux (5.26.99?).