**** observed with 2001-04-09 build **** Steps to repro: - open mail; - clik on Insert, choose image, attach an image file ( the size of the one i am attachihg is very small, 7K); - OK the dlgbox, clcik send; //note : nscp6 crashes

I know this is a dup of another bug but cant find it - I am attaching the stack trace to this and reassigning to pavlov.

*** Bug 75569 has been marked as a duplicate of this bug. ***

In case this isn't a dup, nominating.

I can't seem to reproduce this. I hit some assertions in mail and the plaintexteditor code, but none related to images and no crash.

I've seen it yesterday with Win32 installer trunk build 2001041109. I solved it by attaching the image, instead of inserting it.

Still crashing with the newest win32 installer 2001041520 build on WinME. BTW, it contains PSM2. The way to reproduce: Set "Compose messages in HTML format", insert image (JPG, GIF - no difference), send. Crash!

Adding crash, topcrash keywords and [@ nsImageFrame::AttributeChanged] to summary for tracking, this is still topcrasher with the latest trunk builds. Here is a stack trace from a crash with Build: 2001041612 Incident ID 29201610 nsImageFrame::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1561] nsCSSFrameConstructor::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9873] StyleSetImpl::AttributeChanged [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1298] PresShell::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4521] nsDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1628] nsHTMLDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line 1396] nsGenericHTMLElement::SetAttribute [d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp, line 1415] nsHTMLImageElement::SetSrcInner [d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLImageElement.cpp, line 1078] nsHTMLImageElement::SetSrc [d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLImageElement.cpp, line 1186] nsMsgComposeAndSend::ProcessMultipartRelated [d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 1691] nsMsgComposeAndSend::HackAttachments [d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 2181] nsMsgComposeAndSend::Init [d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 2666] nsMsgComposeAndSend::CreateAndSendMessage [d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 3443] nsMsgCompose::_SendMsg [d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 635] nsMsgCompose::SendMsg [d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 730] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] nsXPCWrappedNativeClass::CallWrappedMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativeclass.cpp, line 937] WrappedNative_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 245] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] nsXPCWrappedJSClass::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 876] nsXPCWrappedJS::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 432] PrepareAndDispatch [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 102] SharedStub [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 124] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] nsXPCWrappedNativeClass::CallWrappedMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativeclass.cpp, line 937] WrappedNative_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 245] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] nsJSContext::CallEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] nsJSEventListener::HandleEvent [d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] nsEventListenerManager::HandleEventSubType [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 921] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1855] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3673] PresShell::HandleDOMEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5265] nsButtonBoxFrame::MouseClicked [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 178] nsButtonBoxFrame::HandleEvent [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 128] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5234] PresShell::HandleEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5189] nsEventStateManager::CheckForAndDispatchClick [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2292] nsEventStateManager::PostHandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1392] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5238] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5144] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2020] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 705] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 722] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4026] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4269] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3035] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 957] USER32.dll + 0x1268 (0x77e71268) This is the same crash reported in dup Bug 75569. Here are a few Talkback entries with helpful info: nsImageFrame::AttributeChanged c4a53771 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsImage Frame.cpp line 1561 Build: 2001041612 CrashDate: 2001-04-16 UptimeMinutes: 4 Total: 4 OS: Windows NT 4.0 build 1381 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29201610 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=29201610 (29201610) Comments: Win32 2001-04-16-21-trunk build. Forwarding selmer's application group status report inline. Crash upon sending. Using HTML mail. Will file a bug. nsImageFrame::AttributeChanged c33a6da4 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsImage Frame.cpp line 1551 Build: 2001041606 CrashDate: 2001-04-16 UptimeMinutes: 149 Total: 149 OS: Windows NT 5.0 build 2195 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29193180 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=29193180 (29193180) Comments: Composer:Insert an image and Change Align nsImageFrame::AttributeChanged 689b18a9 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsImage Frame.cpp line 1498 Build: 2001041222 CrashDate: 2001-04-13 UptimeMinutes: 2 Total: 7 OS: Windows 98 4.10 build 67766222 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29068850 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=29068850 (29068850) Comments: I tried to send mail in html format with a picture in jpeg format nsImageFrame::AttributeChanged 37c2175b http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsImage Frame.cpp line 1498 Build: 2001041106 CrashDate: 2001-04-12 UptimeMinutes: 289 Total: 412 OS: Windows 98 4.10 build 67766446 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29013637 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=29013637 (29013637) Comments: replying to a message with an gif icon and clicking on send crashed netscape. nsImageFrame::AttributeChanged 8d3a4f4c http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsImage Frame.cpp line 1491 Build: 2001040906 CrashDate: 2001-04-09 UptimeMinutes: 4 Total: 255 OS: Windows 98 4.90 build 73010104 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=28886582 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=28886582 (28886582) Comments: embedding a .jpeg file and sending. nsImageFrame::AttributeChanged 8d3a4f4c http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsImage Frame.cpp line 1491 Build: 2001040906 CrashDate: 2001-04-09 UptimeMinutes: 1 Total: 250 OS: Windows 98 4.90 build 73010104 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=28886392 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=28886392 (28886392) Comments: sending a mail msg with an embedded .gif You all get the idea...send or reply to an email with an inserted/imbedded image and boom!

how about you test this with today's build since i fixed this last night?

Works for me! Today win32 installer build, WinME.

I have to retract, kind of. The bug is fixed. There is no crash. However, the image shows up, after receiving the message, as the ALT text. That is no image shows, but it is really attached. I believe I should file a new bug (after checking if someone did it already) :-(

I filed the new bug 76437 (Images in HTML mail do not show) for the possibly related problem described above

Resolving Fixed per Jacek Piskozub's comments (and the latest Talkback data which shows the last crash happening with the 2001041612 build). Jacek, you can go ahead and verify this if you aren't crashing anymore.

*** Bug 75297 has been marked as a duplicate of this bug. ***

*** Bug 76294 has been marked as a duplicate of this bug. ***

win32 (2001-07-13-06-0.9.2) This bug is gone.