160664 - Mozilla crashes on www.glandium.org [@ nsImageWin::DrawTile]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P2)

Description

[Vincent Jaubert]

Mozilla crashes on www.glandium.org. I was not able to isolate the problem since
i was not even able to save the page.
It's a regression since this page is made specially for mozilla.
Build 20002080119

Comment 1

[Olivier Cahagne]

confirming using build 2002073118 on Win2k (trunk): TB8911451W.

Comment 2

[shadytrees]

WFM, I have Mozilla 1.1 Beta (build 2002072104) on Windows 98. 

Comment 3

[Olivier Cahagne]

Attachment: Reduced testcase

Comment 4

[greer]

Attachment: Stack

FWIW, This stack isn't going to be very useful. It was submitted during a time
when we had some trouble pushing symbols to the proper server, so the stack
won't resolve to anything beyond library/module names.

Comment 5

[greer]

-> Kevin to be reassinged when we get a better stack and can determine if this
is a dupe or not.

Comment 6

[Olivier Cahagne]

Testcase crashes if you select some text with mouse, it won't crash if:
 - you remove the background image,
 - you remove the white-repeat from the CSS attribute,
 - you remove some of the <div>.

If you need another Talkback ID: TB8915827K.

Comment 7

[greer]

Oliver's stack has the same problem I describe in comment #4. Can you reproduce
with a build prior to 2002-07-30?

Comment 8

[Moiz Dohadwala]

Crash reproduced: build 2002080108, win2k, sp2.
talkback id: TB8917347E

Comment 9

[Olivier Cahagne]

build 2002072908 on Win2k (trunk): TB8918219E (URL) and TB8918325Q (testcase).
Doesn't crash build 20020730 on Linux (trunk, built from source).

Comment 10

[greer]

Good stuff. Thanks, Olivier!

Incident # 8918219 (& 8918325)
--------------------
Product ID MozillaTrunk
Build ID 2002072908
Operating System Windows NT 5.0 build 2195
URL visited http://www.glandium.org/
User Comments bug 160664

Stack Trace
nsImageWin::DrawTile
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsImageWin.cpp, line 883]
nsRenderingContextImpl::DrawTile
[c:/builds/seamonkey/mozilla/gfx/src/nsRenderingContextImpl.cpp, line 979]
nsCSSRendering::PaintBackgroundWithSC
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSRendering.cpp, line 3133]
nsCSSRendering::PaintBackground
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSRendering.cpp, line 2597]
nsBlockFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5661]
nsContainerFrame::PaintChild
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 281]
nsBlockFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5820]
nsBlockFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5692]
nsContainerFrame::PaintChild
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 281]
nsBlockFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5820]
nsBlockFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5692]
nsContainerFrame::PaintChild
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 281]
nsContainerFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 199]
nsHTMLContainerFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp, line
135]
CanvasFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLFrame.cpp, line 393]
PresShell::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5782]
nsView::Paint [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 280]
nsViewManager::RenderDisplayListElement
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1207]
nsViewManager::RenderViews
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1152]
nsViewManager::Refresh [c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp,
line 747]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1746]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1038]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1060]
nsWindow::OnPaint [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp,
line 4894]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3644]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1304]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x39a3 (0x77e139a3)
USER32.DLL + 0x395f (0x77e1395f)
ntdll.dll + 0x2032f (0x77fa032f)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 452]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1534]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1881]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1899]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08)

Comment 11

[Olivier Cahagne]

some more info, the background image displays ok on Linux, looks distorted on
Win2k (tried 8-bit, 16-bit and 32-bit desktop mode).

Comment 12

[Mike Hommey [:glandium]]

Answer to comment #11 :

This is a known bug :
http://bugzilla.mozilla.org/show_bug.cgi?id=121230

Comment 13

[Olivier Cahagne]

recent related fixes that modified the tiling algorithm: bug 102321, bug 141786
and bug 143830. This used to be a topcrasher fixed with bug 128282.
CCing [e-mail] and [e-mail]

Comment 14

[Rene Pronk]

Might be caused by the patch for bug 148598.
mozilla/layout/html/style/src/nsCSSRendering.cpp was changed by this patch. The
patch has just been backed out because of problems.

Comment 15

[Andrew Schultz]

worksforme with linux trunk build 20020802 (URL and testcase)

Comment 16

[Jay Patel [:jay]]

Adding topcrash+ keyword as this was on the topcrash radar from 7/29 - 8/2.  If
this was caused by some other checkin as noted in comment #14, we'll have to
keep any eye out for any newer crashes if a similar fix is checked in again.

Comment 17

[Olivier Cahagne]

Might also be causing slowdown regression on http://mozilla-evangelism.bclary.com/

Comment 18

[Kevin McCluskey (gone)]

->dcone

Comment 19

[Jaime Rodriguez, Jr.]

is this a trunk and 1.1 crash only, or is this seen on the 1.0 branch as well?
pls advise ...

Comment 20

[Rene Pronk]

See #14. It's very probably the result of a patch for bug 148598 which was
backed out. If so, it's not in 1.0 and shouldn't be in the branch and shouldn't
even be anymore in the trunk. Can anyone confirm this? I couldn't download
todays latest builds.

Comment 21

[Jay Patel [:jay]]

This regression seems to have been introduced on the MozillaTrunk only...so no
need to worry about the Gecko 1.0 Branch.  Talkback data shows this last crashed
with Trunk builds on 8/2.  Marking this worksforme for now since the crash is
gone (most likely due to the backed out patch mentioned in comment #14).  

Feel free to reopen this if you see this crash again.  We should also make sure
to check if any future patch for bug 148598 introduces this regression again.

Comment 22

[Amarendra Hanumanula]

 Verifiying that the given URL and testcase works for me with 
2002-08-16-08-1.0(branch) and 2002-08-16-04-trunk builds. I was able to 
reproduce the crash with 2002-07-19-08-trunk build. working fine with todays 
branch and trunk builds.