Got to http://rhyme.lycoszone.com Hit reload Crash (100% repeatable for me) 2001032904 [This URL's contents may change over the next day or two, so it may be good to try to check this bug soon] I'm just guessing that this is a cache problem.

Wfm with 2001032920 / Win98SE.

confirming with win2k / build 2001032804 Talkback ID : TB28468918Z

It looks like imglib2 is involved here: after several assertions ###!!! ASSERTION: not a container: 'PR_FALSE', file ../../../../../mozilla/layout/html/base/src/nsFrame.cpp, line 350 ###!!! Break: at file ../../../../../mozilla/layout/html/base/src/nsFrame.cpp, line 350 the crash happens here: #0 0x41c6b076 in nsImageListener::FrameChanged (this=0x877d458, aContainer=0x874ddf0, aContext=0x867c920, newframe=0x8882850, dirtyRect=0xbfffebf4) at ../../../../../mozilla/layout/html/base/src/nsImageFrame.cpp:1758 this = (nsImageListener *) 0x877d458 pc = {mRawPtr = 0x867c920} #1 0x41f65957 in imgRequestProxy::FrameChanged (this=0x87e8e98, container=0x874ddf0, cx=0x0, newframe=0x8882850, dirtyRect=0xbfffebf4) at ../../../../mozilla/modules/libpr0n/src/imgRequestProxy.cpp:204 this = (imgRequestProxy *) 0x87e8e98 #2 0x41f6338f in imgRequest::FrameChanged (this=0x8794508, container=0x874ddf0, cx=0x0, newframe=0x8882850, dirtyRect=0xbfffebf4) at ../../../../mozilla/modules/libpr0n/src/imgRequest.cpp:299 ob = (imgIDecoderObserver *) 0x87e8e9c this = (imgRequest *) 0x8794508 LOG_SCOPE_TMP_VAR__LINE__ = {mLog = 0x8282160, mFrom = 0x8794508, mFunc = {<nsCString> = {<basic_nsAWritableString<char>> = {<basic_nsAReadableString<char>> = {<nsPrivateSharableString<char>> = { _vptr. = 0x401dab40 <nsCAutoString virtual table>}, <No data fields>}, <No data fields>}, <nsStr> = {mLength = 24, mCapacity = 63, mCharSize = eOneByte, mOwnsBuffer = 0, { mStr = 0xbfffeae8 "imgRequest::FrameChanged", mUStr = 0xbfffeae8}}, <No data fields>}, mBuffer = "imgRequest::FrameChanged\000\200\a@\002\000\000\000а¤\035@P(\210\b\000\000\000\000\000\000\000\0004ляїlp\006@4ляї«дцA"}} i = 0 count = 1 #3 0x41f60581 in imgContainer::Notify (this=0x874ddf0, timer=0x8883700) at ../../../../mozilla/modules/libpr0n/src/imgContainer.cpp:398 frameToUse = {mRawPtr = 0x8882850} observer = {mRawPtr = 0x879450c} nextFrame = {mRawPtr = 0x8732240} timeout = 100 numFrames = 6 previousAnimationFrameIndex = 0 dirtyRect = {x = 425, y = 1, width = 43, height = 48} (note: line numbers are only valid for the mozilla-source from March 30th: NS_IMETHODIMP nsImageListener::FrameChanged(imgIContainer *aContainer, nsISupports *aContext, gfxIImageFrame *newframe, nsRect * dirtyRect) { if (!mFrame) return NS_ERROR_FAILURE; nsCOMPtr<nsIPresContext> pc(do_QueryInterface(aContext)); NS_ASSERTION(pc, "not a pres context!"); 1758--> return mFrame->FrameChanged(aContainer, pc, newframe, dirtyRect); } #endif NS_IMETHODIMP nsImageFrame::FrameChanged(imgIContainer *aContainer, nsIPresContext *aPresContext, gfxIImageFrame *aNewFrame, nsRect *aDirtyRect) { float p2t; aPresContext->GetPixelsToTwips(&p2t); nsRect r(*aDirtyRect); r *= p2t; // convert to twips mTransform.TransformCoord(&r.x, &r.y, &r.width, &r.height); Invalidate(aPresContext, r, PR_FALSE); return NS_OK; }

*** Bug 74314 has been marked as a duplicate of this bug. ***

*** Bug 74373 has been marked as a duplicate of this bug. ***

I don't see the cache in the stack trace. Pav, is this really a cache bug, or does it belong to ImgLib2

*** Bug 74973 has been marked as a duplicate of this bug. ***

*** Bug 75217 has been marked as a duplicate of this bug. ***

load the attached testcase into mozilla. *ASSERT* when it finishes loading, hit reload. *ASSERT* crash.

load the page... 2 image frames get created. hit reload...... 1 image frame gets destroyed. ... 2 image frames get created. .... crash layout bug?

the patch to nsCSSFrameConstructor in bug 73547 fixes this bug.

pollmann checked in the fix for 73547. marking this one fixed.

Verified fixed on Win98 build 2001041104 Verified fixed on Mac build 2001041108 Verified fixed on Linux build 2001041108

I know this is fixed, but adding Trunk and [@ nsImageListener::FrameChanged] to summary and topcrash keyword since this *was* a topcrash in recent builds.