40942 - crashes when scrolling UP over one image

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Greg Roelofs]

Using nightly build 2000-05-28-09-M16 for Linux (big tarball).  When invoked
thusly:

	./mozilla http://www.libpng.org/pub/png/

Mozilla successfully renders the entire page, and one can scroll down without
any problems.  But scrolling back up (using the scrollbar, not the PgUp and PgDn
keys) always causes a segfault just as the top of the small green image on the
right side of the Table of Contents becomes visible.  The similar small white
image above the green one causes no problems.  This is very reproducible on my
(nearly) stock Linux Slackware 7.0 system with glibc 2.1.2.

I thought it might be a problem with a registry left over from an April build,
but it still crashes even with a completely virgin install (i.e., ~/.mozilla
removed).  I also did not touch the relative size of the frame elements or of
the entire window.  The W3C validator link at the bottom tests out OK, too, so
presumably it's not because of bad HTML.

Here's the full error listing from the xterm window in which Mozilla was
started:

meltdown:/usr/local/www/mozilla-20000528 289> ./mozilla
http://www.libpng.org/pub/png/
.//run-mozilla.sh ./mozilla-bin http://www.libpng.org/pub/png/
MOZILLA_FIVE_HOME=/usr/local/www/mozilla-20000528
  LD_LIBRARY_PATH=/usr/local/www/mozilla-20000528
     LIBRARY_PATH=/usr/local/www/mozilla-20000528
       SHLIB_PATH=/usr/local/www/mozilla-20000528
          LIBPATH=/usr/local/www/mozilla-20000528
       ADDON_PATH=/usr/local/www/mozilla-20000528
      MOZ_PROGRAM=./mozilla-bin
      MOZ_TOOLKIT=
        moz_debug=0
     moz_debugger=
Profile Manager : Profile Wizard and Manager activites : Begin
Profile Manager : Command Line Options : Begin
Profile Manager : Command Line Options : End
ProfileManager : GetProfileDir
ProfileManager : GetProfileDir
Profile Manager : Profile Wizard and Manager activites : End
WEBSHELL+ = 1
WEBSHELL+ = 2
CSSLoaderImpl::LoadAgentSheet: Load of URL
'file:///home/roelofs/.mozilla/default/chrome/user.css' failed.  Error code:
16389
assuming d&d is off for Personal Toolbar
WEBSHELL+ = 3
WEBSHELL+ = 4
Setting content window
*** Pulling out the charset
in SetSecurityButton
WEBSHELL+ = 5
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 600 greater than desired height
585
Warning - table cell content max element height 465 greater than desired height
450
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Warning - table cell content max element height 450 greater than desired height
435
Document: Done (4.457 secs)
*** check number of frames in content area 
Document http://www.libpng.org/pub/png/ loaded successfully
.//run-mozilla.sh: line 29:  1452 Segmentation fault      $prog ${1+"$@"}

This particular binary doesn't seem to have any traceback/debugging info
compiled in, so I'm just guessing about the component.

Greg

Comment 1

[tor]

Probably mine.  Taking bug for investigation.

Comment 2

[Jeffrey Baker]

Crashes here too (Linux 2000052908).  Please raise severity to critical and add
crash keyword.

Comment 3

[tor]

Can't reproduce on solaris/native with a 5/29 cvs pull.  Could you run
your binary with the debugger and give a stack trace?  Even though your
build doesn't have debugging information it will still have the symbol
names, which will give some clue as to what is happening.

What bit depth is your X server running at?

Comment 4

[Greg Roelofs]

Sorry, I knew I was forgetting something:  the display depth is 24 (32 bpp). 
The gdb run was not terribly useful, although it's entirely possible I didn't do
it right:

meltdown:/usr/local/www/mozilla-20000528 307> ./run-mozilla.sh -g -d gdb
mozilla-bin http://www.libpng.org/pub/png/
MOZILLA_FIVE_HOME=/usr/local/www/mozilla-20000528
  LD_LIBRARY_PATH=/usr/local/www/mozilla-20000528
     LIBRARY_PATH=/usr/local/www/mozilla-20000528
       SHLIB_PATH=/usr/local/www/mozilla-20000528
          LIBPATH=/usr/local/www/mozilla-20000528
       ADDON_PATH=/usr/local/www/mozilla-20000528
      MOZ_PROGRAM=mozilla-bin
      MOZ_TOOLKIT=
        moz_debug=1
     moz_debugger=gdb
/usr/bin/gdb mozilla-bin -x /tmp/mozargs1572
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...
(no debugging symbols found)...
(gdb) run
Starting program: /usr/local/www/mozilla-20000528/mozilla-bin
http://www.libpng.org/pub/png/
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
warning: shared library handler failed to enable breakpoint
Profile Manager : Profile Wizard and Manager activites : Begin
Profile Manager : Command Line Options : Begin
Profile Manager : Command Line Options : End
ProfileManager : GetProfileDir
ProfileManager : GetProfileDir
Profile Manager : Profile Wizard and Manager activites : End

Program received signal ?, Unknown signal.
0x4024424a in ?? () from /lib/libc.so.6
(gdb) 

When I typed "continue" at that point, it appeared to hang, and no apprunner
window was ever visibly created.

Severity and keywords also updated.

Comment 5

[Andreas Franke (gone)]

gdb 4.18 is too old: it can't handle threads. gdb 4.95.0 is known to work,
and probably gdb 5 will also work.

Comment 6

[Andreas Franke (gone)]

Attachment: stack trace (including function symbols), PC/Linux 5/21

Comment 7

[Andreas Franke (gone)]

I should add that I crashed with build 2000052908, too.

Comment 8

[tor]

I can't reproduce this on solaris and according to the stack trace
it isn't crashing in the compositing code, but rather in the general
nsImageGTK code.  Handing off to pavlov.

Comment 9

[Jeffrey Baker]

This is not crashing anymore.  I tested on Linux build 2000061214 (M17).  If
this rises from the grave, please reopen.

Comment 10

[John Unruh]

Verified worksforme.

Comment 11

[Jeffrey Baker]

This is crashing for me intermittently on Linux Build 2000080605 M17.  See also
Bug 47816.

The easiest way to reproduce is to scroll with the scroll thumb UP over the
little image of the O'Reilly book.

Comment 12

[Jeffrey Baker]

Actually, the best way to reproduce is to grab the scroll thumb and move it
wildly up and down for 30 seconds or so.

Comment 13

[tor]

Checked in what is hopefully the final word in the nsImageGTK::DrawComposited
clipping code.  Should fix this problem.

Comment 14

[Jeffrey Baker]

Can't reproduce the crash on Linux 2000-08-15-05, unsing my previous rather
unscientific procedure.  Fix looks good.

Comment 15

[Terri Preston]

Verified on Linux build 2000-11-08-07-MN6 (no crash)