11090 - test10 crashes viewer on linux and irix, 8-bit color

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Tomi Leppikangas]

test10.html crashes viewer. This happens on 8bpp mode when just few colors
awailable. Happens on apprunner too. Build on 19990802.

backtrace:
#0  0x40134e15 in nsBlender::Do8Blend (this=0x81685e0, aBlendVal=63 '?',
aNumlines=77, aNumbytes=152,
    aSImage=0x816aac0 '´' <repeats 150 times>, "j\b", '´' <repeats 48 times>...,
    aDImage=0x816f5a8 '×' <repeats 14 times>, "Ñ\\+V±«[",
    aSecondSImage=0x8174090 '\005' <repeats 150 times>, "j\b", '\005' <repeats
48 times>..., aSLSpan=152,
    aDLSpan=152, aColorMap=0x82b9c08, aBlendQuality=nsHighQual,
aSrcBackColor=4278190335,
    aSecondSrcBackColor=4294901760) at ../../../gfx/src/nsBlender.cpp:741
#1  0x4013431d in nsBlender::Blend (this=0x81685e0,
    aSrcBits=0x816aac0 '´' <repeats 150 times>, "j\b", '´' <repeats 48
times>..., aSrcStride=152, aSrcBytes=152,
    aDestBits=0x816f5a8 '×' <repeats 14 times>, "Ñ\\+V±«[", aDestStride=152,
aDestBytes=152,
    aSecondSrcBits=0x8174090 '\005' <repeats 150 times>, "j\b", '\005' <repeats
48 times>..., aSecondSrcStride=152,
    aSecondSrcBytes=152, aLines=77, aAlpha=25, aPixFormat=@0xbfffeb7c,
aSrcBackColor=4278190335,
    aSecondSrcBackColor=4294901760) at ../../../gfx/src/nsBlender.cpp:229
#2  0x401340ec in nsBlender::Blend (this=0x81685e0, aSX=8, aSY=8, aWidth=150,
aHeight=77, aSrc=0x82a9ea0,
    aDest=0x8260fd8, aDX=8, aDY=8, aSrcOpacity=0.25, aSecondSrc=0x82b9790,
aSrcBackColor=4278190335,
    aSecondSrcBackColor=4294901760) at ../../../gfx/src/nsBlender.cpp:147
#3  0x48df0139 in nsViewManager::RenderViews (this=0x8260e90,
aRootView=0x8265700, aRC=@0x8265090, aRect=@0xbfffed1c,
    aResult=@0xbfffed2c) at ../../../view/src/nsViewManager.cpp:950
#4  0x48deecf3 in nsViewManager::Refresh (this=0x8260e90, aView=0x8265700,
aContext=0x8265090, rect=0xbfffeda0,
    aUpdateFlags=1) at ../../../view/src/nsViewManager.cpp:535


(gdb) list ../../../gfx/src/nsBlender.cpp:741
736       // build a colormap we can use to get an inverse map
737       map = aColorMap->cmap.map+10;
738       mapptr = new PRUint8[256*3];
739       invermap = mapptr;
740       for(i=0;i<216;i++){
741         *invermap=map->blue;
742         invermap++;
743         *invermap=map->green;
744         invermap++;
745         *invermap=map->red;
(gdb) print map
$2 = (_NI_RGB *) 0x3c
(gdb) print map->blue
Cannot access memory at address 0x3e.
(gdb)

Comment 1

[Peter Trudelle]

This is not XPToolkit, since it happens on Viewer.  reassigning to rickg for
triage.

Comment 2

[rickg]

Kevin -- please take a look.

Comment 3

[Tomi Leppikangas]

Its not just viewer, apprunner crashes too. So component should be something
else than 'viewer app'?

Comment 4

[Kevin McCluskey (gone)]

This is a result of the blender code path's not being complete as described in
bug #4820. Since this is a crasher I'll keep it as seperate bug.

Don, reassigning to you, since you own bug #4820

Comment 5

[leger]

phillip. Is this crashing Mac or Win32?

Comment 6

[phillip]

no, i tried on
     1999-08-09-08 WinNT 4.0 sp4
     1999-08-09-08 MacOS 8.51
there is no crash at all, with both 8 and 16 bit color depth.

Comment 7

[leger]

Setting to Layout.  Please change component if this is something more specific.

rickg, a crasher...please review for M9 blocker.

Comment 8

[leger]

petersen...on linux only with 1999081608 build?  Is so, release note at:
http://bugzilla.mozilla.org/show_bug.cgi?id=11352
and move thie to M10 please.

Comment 9

[Chris Petersen]

Using the latest Linux build (Aug 19th), the test10.html document loads and
displays correctly.

Comment 10

[Chris Petersen]

Download the Aug 16th build (1999081609) on Redhat 6.0, the page loads and
displays without crashing.

Comment 11

[Tomi Leppikangas]

Still crashing on todays build for me, Petersen did you test on 8bpp?
This is  on RedHat 6.0 with communicator running (without private colorman,
sucks all colors).

Comment 12

[Chris Petersen]

Using the Aug 16th build in 8 bit mode, the apprunner will exit. Running the
application in 24 bit mode will not reproduce this problem. Testing was done
under Redhat 6.0.

Comment 13

[chris hofmann]

moving to m10 for more investigation

Comment 14

[Syd Logan]

There was code that was not yet implemented in gfx/src/gtk to support 8-bit deep
visuals for image display. I've done most of this work, and in my source tree I
can display test10.html without a crash but the colors are wrong.

Comment 15

[Syd Logan]

Pam, I'm up in MV this week. Any chance you have some cycles to talk over what I
have done so far? other than Tuesday afternoon, I'm basically free.

Comment 16

[Syd Logan]

Mass moving these bugs to M13

Comment 17

[Chris McAfee]

Yep, this crashes solaris too.

Comment 18

[John Morrison]

See same crash, do8blend, demo #10, (OpenVMS), bug #17356

Comment 19

[Alex Musil]

Moving Syd's non-PDT+ bugs to M15 to indicate that he will not have time to get
to them for Beta.

Comment 20

[leger]

Adding "crash" keyword to all known open crasher bugs.

Comment 21

[Alex Musil]

Moving Syd's non-IM bugs to M20

Comment 22

[Chris Petersen]

Tomi, please check to see if this problem is still occuring in the latest build.

Comment 23

[Tomi Leppikangas]

Yes i still see this. Tested with todays build (20000510). With 8bpp X-server
crashes in nsBlender::Do8Blend as before.

Comment 24

[Andreas Franke (gone)]

The crash on linux was bug 17356 and has been fixed. jrgm had suggested to use
that bug for the linux crash and this bug for irix (see his comments 2000-01-19
22:51 in that bug). Now that the hack to avoid the crash on linux has been
checked in, it may well be that the crash on irix has gone, too. If so, this bug
could be closed. Can someone on irix please confirm this?
8bit blend still doesn't work, but that is covered by bug 50396 now.

Comment 25

[Chris Petersen]

Reporter, please check with latest build. I can't reproduce on the 12/12 build 
under Linux.

Comment 26

[Andreas Franke (gone)]

Marking fixed due to lack of responses. See my previous comment for the reasons.

Comment 27

[Chris Petersen]

Marking verified per last comments.