213390 - Random crashes when loading some websites since 0718 build [@ nsRenderingContextWin::GetWidth][@ nsRenderingContextWin::GetTextDimensions][@ 0x00616e61 ]

Status: RESOLVED FIXED

(Core Graveyard :: GFX: Win32, defect, P1)

Description

[Goi]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030721 Mozilla Firebird/0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030721 Mozilla Firebird/0.6

When loading some websites on Mozilla/Mozilla Firebird 0718 onwards, I get
semi-reproducible crashes. It doesn't crash 100% of the time, but most of the
time it does.

Reproducible: Sometimes

Steps to Reproduce:
1. Load the above website
Actual Results:  
The program crashes with the standard "mozilla.exe has generated errors and will
be closed by Windows. You will need to restart the program. An error log has
been created." message.

Expected Results:  
Load the page as per normal.

Comment 1

[Matthias Versen [:Matti]]

Attachment: stacktrace from a 4h old win2k cvs build

I could reproduce it only once

Comment 2

[Matthias Versen [:Matti]]

-> Layout

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Caused by bug 212723?

There are two stack traces that started showing up at the same time:

Incident ID 22095369
Stack Signature 	nsRenderingContextWin::GetTextDimensions 68cf5f95
Email Address 	
Product ID 	MozillaTrunk
Build ID 	2003072104
Trigger Time 	2003-07-22 02:31:53
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	gkgfxwin.dll
URL visited 	
User Comments 	
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/gfx/src/windows/nsRenderingContextWin.cpp
Trigger Line No. 	1658
Stack Trace 	
nsRenderingContextWin::GetTextDimensions
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 1658]
nsTextFrame::MeasureText
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 4953]
nsTextFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 5439]
nsLineLayout::ReflowFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp, line 1028]
nsBlockFrame::ReflowInlineFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3747] 



Incident ID 22084050
Stack Signature 	nsRenderingContextWin::GetWidth d2987b4f
Email Address 	
Product ID 	MozillaTrunk
Build ID 	2003072104
Trigger Time 	2003-07-21 16:11:12
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	gkgfxwin.dll
URL visited 	
User Comments 	
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/gfx/src/windows/nsRenderingContextWin.cpp
Trigger Line No. 	1519
Stack Trace 	
nsRenderingContextWin::GetWidth
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 1519]
nsRenderingContextWin::GetTextDimensions
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 2155]
nsTextFrame::MeasureText
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 4887]
nsTextFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 5439] 

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Looking at one of the two talkback reports above in more detail, in ID 22084050,
it looks like mCurrFontWin is garbage (in particular, the pointer is non-null,
but the vtable pointer in the object is null).  In a report similar to the first
(in most of them the dissasembly didn't make sense, but in one it did), it looks
like the vtable pointer in the object is garbage.

Comment 5

[Ali Ebrahim]

Sites that crash Firebird include:

www.citybus.com.hk
www.starhub.com.sg
www.mlb.com

Comment 6

[Simon Paquet [:sipaq]]

*** Bug 213453 has been marked as a duplicate of this bug. ***

Comment 7

[rbs]

> Caused by bug 212723?

Seems so. Which would then mean that it exposed a weirdness (e.g., a dead object
being used -- per comment 4). All calls of GetTextDimensions/GetWidth are
preceded by a SetupFontAndColors() which should have ensured that things are in
sync.

Comment 8

[rbs]

Re: comment 5

Is anyone seeing this bug with SeaMonkey? I am using SeaMonkey but it hasn't yet
crashed on me due to this bug.

Comment 9

[Bill Mason]

Re: comment 8

See the dup'ed bug in comment 6.  mlb.com has been seen to crash in Seamonkey.

Comment 10

[rbs]

Still no crash for me (Win2K). I could fix the bug If I can reproduce.

Not being able to reproduce makes things hard. It would help if somebody
summarizes the steps that they do to get the crash.

Comment 11

[whorfin]

There is dump information in <a
href="http://bugzilla.mozilla.org/show_bug.cgi?id=213390#c3">Comment #3</a>.

Also, just judging from the area of the code where this occurs, it could also be
screen resolution and/or video driver dependent.  I run in 1280x1024 mode at
work and at home, and run Win2K at work and WinXP SP1 at home, and it happens
consistently for me, every time, on the mlb.com site.

Comment 12

[Goi]

www.starhub.net.sg crashes for me almost 100% of the time with this bug. I just
need to load the website, and before it completes rendering, the error popup
dialog will appear. I don't know if this makes a difference, but I'm using the
Phoenity Neo theme, and I have the following extensions installed
TBE V1.8.2003070201
Text Links
AiO Gestures 0.8.0
User Agent Switcher 0.23

These are probably not important since people have reported that the bug appears
on a new profile, and I have reproduced the bug on Mozilla on my same
system(diff profile obviously) as well as Firebird on another system(also on
Win2K SP4). On all 3 installations, the crash is immediate, and happens almost
100% of the time.

Comment 13

[rbs]

Changed my resolution to 1280x1024, installed Flash, but still no crash I am afraid.

Comment 14

[Leo Zelevinsky]

It has nothing to do with Flash - it has crashed my Mozilla Firebird every time
I've tried www.redsox.com so far - and I don't have Flash installed.

Comment 15

[rbs]

WFM so far. Any clue as to what is common between those of you see the bug?!?

Comment 16

[Matthias Versen [:Matti]]

Attachment: another Stack Trace

I get this crash every 2 minutes today on the www.heise.de Forum

Using : win2k, 1024x768, flash6 R60

Steps to reproduce :
load www.heise.de (sorry, german) click on a News message (use an older message
where people already added comments), click on the big "Kommentare:" link,
click on a message with a few replys (message with a +") and click on the link
">>" next to "Beitrag".
This cause very frequently a crash on my system...

rbs: Can I help with my debug build ? (note: I don't know c++, c or anything
else :-) )

Comment 17

[rbs]

Sure, your debug build might help...

nsContainerBox::LayoutChildAt(nsBoxLayoutState & {...}, nsIBox * 0x00000000, ...)
[line 94 -- @see view-source on the attachment goto line (Ctrl+L) 94]

seems that the stack trace is out of sync. (Otherwise the crash would have
happened here due to the fact that the nsIBox pointer is null.) Also, the
various null |ns[]Frame * const 0x00000000| and |nsRenderingContextWin * const
0x00000000| mean that something weird is going on.

Do you see any assertion before heading to the crash?

Comment 18

[Matthias Versen [:Matti]]

*** Bug 213906 has been marked as a duplicate of this bug. ***

Comment 19

[whorfin]

This is probably beating a dead horse, but I'll say it anyway.  You will NOT see
this bug if you use a 1.5a build.  This occurs only on trunk builds using the
1.5b Gecko codebase.

(Yeah, I'm a belt AND suspenders kinda guy).

Comment 20

[Robert La Ferla]

Crashes every time on http://www.torontobluejays.com.

Talkback incident #TB22240225X with latest 2003072704 nightly build.

Comment 21

[Robert La Ferla]

Also occurs when opening Address Book.

Talkback incident id # TB22246383Y

Comment 22

[rbs]

matti, with your debug build, do you crash where others have reported their
crash, e.g.,
 http://www.torontobluejays.com
 http://www.starhub.net.sg
 http://www.redsox.com

(I crash nowhere with my debug build, not even with the steps in comment 16.)

Comment 23

[Robert La Ferla]

The latest build (2003072813) still crashes on http://www.torontobluejays.com. 
This is reproducible every single time.

BTW - At least it doesn't crash on startup like this morning's build...

Comment 24

[Robert La Ferla]

Here's the error:

Unhandled exception in mozilla.exe (GKGFXWIN.DLL): 0xC0000005: Access Violation.

Comment 25

[rbs]

Re: comment 23
I get a crash with my build of today, but that seems unrelated to this (font)
crash. The crash instead comes from recent JS changes (bug 208030). Below is a
stack trace of what I get.

_free_dbg_lk(void * 0x02e4ef50, int 1) line 1066 + 60 bytes
_free_dbg(void * 0x02e4ef50, int 1) line 1001 + 13 bytes
free(void * 0x02e4ef50) line 956 + 11 bytes
JS_free(JSContext * 0x02c24fd8, void * 0x02e4ef50) line 1452 + 10 bytes
js_DestroyScript(JSContext * 0x02c24fd8, JSScript * 0x02e4ef50) line 1109 + 13 bytes
JS_DestroyScript(JSContext * 0x02c24fd8, JSScript * 0x02e4ef50) line 3185 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x02c24fd8, JSObject * 0x03281850,
JSPrincipals * 0x0327ceb8, const unsigned short * 0x037c3928, unsigned int 6613,
const char * 0x0012f650, unsigned int 1, long * 0x0012f538) line 3489 + 13 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x03420408, const nsAString &
{...}, void * 0x03281850, nsIPrincipal * 0x0327ceb0, const char * 0x0012f650,
unsigned int 1, const char * 0x010b96ac, nsAString & {...}, int * 0x0012f59c)
line 875 + 85 bytes
nsScriptLoader::EvaluateScript(nsScriptLoadRequest * 0x0375c4e0, const
nsAFlatString & {...}) line 642
nsScriptLoader::ProcessRequest(nsScriptLoadRequest * 0x0375c4e0) line 555 + 22 bytes
nsScriptLoader::OnStreamComplete(nsScriptLoader * const 0x0372fe7c,
nsIStreamLoader * 0x037ae078, nsISupports * 0x0375c4e0, unsigned int 0, unsigned
int 4294967295, const char * 0x037bf89e) line 898
nsStreamLoader::OnStopRequest(nsStreamLoader * const 0x037ae07c, nsIRequest *
0x037a7a58, nsISupports * 0x0375c4e0, unsigned int 0) line 144
nsStreamListenerTee::OnStopRequest(nsStreamListenerTee * const 0x037a8ed0,
nsIRequest * 0x037a7a58, nsISupports * 0x0375c4e0, unsigned int 0) line 66
nsHttpChannel::OnStopRequest(nsHttpChannel * const 0x037a7a60, nsIRequest *
0x037ae7d0, nsISupports * 0x00000000, unsigned int 0) line 3252
nsInputStreamPump::OnStateStop() line 484
nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x037ae7d4,
nsIAsyncInputStream * 0x037ae584) line 324 + 11 bytes
nsInputStreamReadyEvent::EventHandler(PLEvent * 0x037aec3c) line 117
PL_HandleEvent(PLEvent * 0x037aec3c) line 671 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00e23e08) line 606 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x04770296, unsigned int 49390, unsigned int 0,
long 14827016) line 1412 + 9 bytes
USER32! 77e3a244()
USER32! 77e145e5()
USER32! 77e1a792()
nsAppShellService::Run(nsAppShellService * const 0x0144b9f0) line 478
main1(int 1, char * * 0x00262698, nsISupports * 0x00dd40b8) line 1290 + 32 bytes
main(int 1, char * * 0x00262698) line 1669 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77ea847c()

---------------------
I still need a way to reproduce the original (font) bug, or some feedback from
people like matti who have a debug build and can reproduce.

Comment 26

[Robert La Ferla]

Well, I filed a bug for the crash (bug 213906) but matti marked it as a
duplicate of this one.  Can someone undo it?

Comment 27

[rbs]

It indeed looks like a dup. Let's just not confuse with the other fluctuations
that are happening on the trunk.

Comment 28

[whorfin]

Another site that crashes: http://www.geocaching.com/

This one has been causing crashes on both trunk and 1.5a.  There's a discussion
concerning it on mozillazine, and I verfiied it using my 1.5a nightly.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla
Firebird/0.6.1

Comment 29

[whorfin]

False alarm on the geocaching.com bug.  Using a build from the 7/31 codebase
(and creating a new profile), the geocaching.com bug went away, although
http://minnesota.twins.mlb.com continues to crash consistently.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030731 Mozilla
Firebird/0.6.1

Comment 30

[whorfin]

The geocaching.com bug should no longer be considered part of this crash. 
Turning off JavaScript causes the geocaching.com crash to go away (yes, it's
still there, but less often).  Going to minnesota.twins.mlb.com consistently
crashes on the 7/31 codebase, with JavaScript on or off.

Comment 31

[Goi]

Another possible website that causes the crash -
http://www.sol.no/underholdning/tvguiden

Comment 32

[rbs]

I got that one to crash, but it wasn't a font crash:
 	gklayout.dll!nsXULElement::SetAttr(nsINodeInfo * aNodeInfo=0x02ceead0, const
nsAString & aValue={...}, int aNotify=1)  Line 2405 + 0x20	C++

Comment 33

[Andrew Schultz]

crash in nsXULElement::SetAttr is bug 210269

Comment 34

[Robert La Ferla]

Is a developer looking into this bug?  It's been about 3 weeks that we have had
to live with this major crash bug.

Comment 35

[Goi]

I'm sure they are, but as it isn't an easily reproducible bug(it is afterall
random as the bug summary states) it isn't easy to debug. Every time something
like this pops up its gonna take a while. The last random crash bug(the infamous
Autocomplete Crash bug) took a hell of a lot longer than this bug has so far
existed...have patience. Use 0.6.1 in the mean time as its not affected.

Comment 36

[Robert La Ferla]

Okay but I would not call this a random crash bug.  I can reproduce it 100% of
the time on *every* single nightly build since 7/18.  So perhaps, it is my
settings or even my environment (Windows 2000).  

I realize that these bugs can be hard to track down.  If I were the developer, I
would compare the source from 7/17 to 7/18 (or whatever the time period was) to
see what files changed in that specific module.  There are also stack traces and
talkback files to help too.  If there's something I can do to help the
developer, please send me instructions.  I'll see if I can get another stack
trace or something...

Comment 37

[rbs]

>If there's something I can do to help the developer, please send me instructions. 

Can you build a debug build? The stack traces are not proving really helpful in
this situation. If someone with a debug build can reproduce, then we can start
from there. Often, the reason why such a bug might hang around is because the
interested developer (with their debug build) cannot reproduce. I am interested
in fixing this bug, but as I said I cannot reproduce. As the saying goes, it WFM...

Comment 38

[Robert La Ferla]

By a debug build, do you mean one with debug symbols?  If so, is there a nightly
debug build that can be downloaded?  If not, why should I as a user/tester have
to build it?  i.e.  That should be done automatically by the nightly build process.

Comment 39

[rbs]

> If not, why should I as a user/tester have to build it.

You don't get it yet. The stack trace isn't helpful enough here.

Comment 40

[Jason Barnabe (np)]

Attachment: testcase

Perhaps this can be of assistance :-). Reduced test case from the blue jays
site. Odd, really. It's got an EMBED, a table, and a form. And it seems to
matter that it's all in Arial. Hmmmm...

Comment 41

[Jason Barnabe (np)]

Hmmm... Crashes when I run it off my desktop, but not off bugzilla.

TB22504148H, if it helps any.

Comment 42

[rbs]

Robert (and others), do you crash on the reduced testcase? This is one of the
few cases where "me too" posts are welcome and encouraged... [I still don't
crash BTW.]

Comment 43

[rbs]

Bingo Jason... I finally got the crash with the reduced test case...

>	gkgfxwin.dll!nsRenderingContextWin::GetWidth(const char * aString=0x0012b318,
unsigned int aLength=1, int & aWidth=0)  Line 1518 + 0x1d	C++

Comment 44

[rbs]

Of course, it is random, and I haven't reproduced again. If somebody figures out
any steps to maximize the reproducibility, it would be helpful.

Comment 45

[Jason Barnabe (np)]

Reproducibility from when I was making the test case was about 97% or so. 

Clearing the cache might help. I think I needed to do that on the original page.

Comment 46

[Robert La Ferla]

Crashes every time with the test case for me.  I cleared my cache too.  I also
have it set to compare the page every time...

Comment 47

[Leo Zelevinsky]

For me, attachment works fine when I click through to it from bugzilla. But when
I open it from disk, at first Firebird was misbehaving (the spinning loading
icon stops spinning, nothing's happening). I cleared the cache, and now every
time I open the attachment straight from disk, Firebird is crashing.

I have Visual Studio installed - do I have to get all the source code and build
it locally to give any more help?

Comment 48

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 215272 has been marked as a duplicate of this bug. ***

Comment 49

[lohphat]

(from the just duped bug)

The crash happens for those test URLS when the URL opens a new window, but does
not crash when opening in a new tab.  

For those of you with consistant crash test URLs, does this behavior appear for
you as well?  Also, my browser's default new window size is full screen; don't
know if that's a factor or not.

Comment 50

[lohphat]

Another crash URL:
http://go.fark.com/cgi/fark/go.pl?IDLink=610342&location=http://www.rednova.com/rnprogs/indexgen%3fk=0%26u=0

Opening in tab still crashes.

TalkbackID: TB22534294Y

Comment 51

[rbs]

OK, I am able to reproduce more or less frequently by doing:
- disable all cache options of relevance I could find in about:config
- span several windows with the testcase
  -> crash eventually happens after flipping back and forth bteween the windows,
     click reload, click back/forward inside the windows.

Comment 52

[Jason Barnabe (np)]

Comment 49 is right on for me. The attached test case crashes when you open a
new window, but not a new tab or an existing window.

Comment 53

[Goi]

I just installed the 0810 build and I have a new crashing website to report -
http://www.svc.com or http://www.svcompucycle.com, both of which are the same
website. Do the developers have any idea where the problem lies?

Comment 54

[lohphat]

Hrm. WFM.

2003081004 win32 open in tab or new window.

Comment 55

[Matthias Versen [:Matti]]

*** Bug 215835 has been marked as a duplicate of this bug. ***

Comment 56

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 215773 has been marked as a duplicate of this bug. ***

Comment 57

[Jay Patel [:jay]]

These crashes make up 6 out of 10 topcrashers in current Talkback data (a couple
of valid stack signatures and a few offsets):
Here are the latest user comments and urls from Talkback reports:

From nsRenderingContextWin::GetWidth crashes:
(22640445)	URL: http://www.plumtree.com
     (22637190)	URL: http://www.christianfreebies.com/
     (22637190)	Comments: pressed back after watching an image (no tabs or
anything at the time. happened the two or three times I tested. 
     (22633383)	URL: http://www.geocities.com/nate2k3x/index.html
     (22633383)	Comments: Error comes when accessing this page:  
http://www.geocities.com/nate2k3x/index.html
     (22629595)	URL: http://www.stamp-connection.com
     (22629595)	Comments: THIS IS REPEATABLE.  Click on the "WheresGeorge.com"
stamp link.  
     (22629574)	URL: http://www.stamp-connection.com
     (22629574)	Comments: I clicked on the link for "WheresGeorge.com"
self-inking stamps.
     (22624071)	URL: http://www.shockwave.com/sw/content/popndrop
     (22624067)	URL: http://www.shockwave.com/sw/content/popndrop
     (22624067)	Comments: When clicking "Play game" a new window pops up - as it
should. Something in this window causes Mozilla to crash. (I've had the same
problem with several other windows on shockwave.com).
     (22613707)	URL: http://www.sfgiants.com
     (22597933)	URL: foxnews.com
     (22597933)	Comments: Trying to watch a real audio streaming clip.
     (22556227)	URL: http://summerslam.wwe.com
     (22556227)	Comments: After going to the WWE Summerslam site I clicked on a
link which should've taken me to the Summerslam history website but instead the
browser crashed after the link was clicked on.
     (22536706)	URL: http://www.sgi.com
     (22536507)	URL: http://www.sgi.com
     (22527426)	URL: http://www.ford.com
     (22527400)	URL: http://www.ford.com
     (22464246)	URL: nodedb.com
     (22443308)	URL: www.bajafresh.com
     (22419764)	URL: www.ericflint.net
     (22419764)	Comments: Clicked on the "Enter Here" link.  Display started to
update then an illegal memory access was committed.  I updated to the latest
build from the 31-July build I had been using and the display seemed to go a bit
further before the crash.

From the 0x00616e61 crashes:
(22638943)	URL: http://www.nvidia.com
     (22638943)	Comments: nvidia page crash!
     (22638656)	URL: opening www.gamespot.com
     (22638656)	Comments: crashes all over when visiting some sites
     (22632777)	URL: http://www.caja-ingenieros.es/
     (22631612)	URL: www.rednova.com
     (22631513)	URL: www.rednova.com
     (22631513)	Comments: appears that communictor blocked a popup on
www.rednova.com
     (22631407)	URL: www.rednova.com
     (22631407)	Comments: trying to go to www.rednova.com
     (22621664)	URL: http://www.unitethecows.com
     (22621664)	Comments: trying to get to there web site 
     (22611654)	URL: http://www.celebrityrants.com
     (22611654)	Comments: I clicked on a link.
     (22611590)	URL: http://www.celebrityrants.com
     (22611590)	Comments: I clicked on a link for a David Duchovny audio link.
     (22592954)	URL: http://www.fox.com
     (22590566)	URL: http://www.caja-ingenieros.es/
     (22586862)	URL: www.vippertalentos.com.br
     (22586862)	Comments: back the last page
     (22585917)	URL: http://www.fox.com
     (22584792)	URL: www.fox.com
     (22584792)	Comments: Crashes on this page
     (22577575)	URL: http://www.agaveblue.net/unsubscribe.asp?e=[e-mail]
     (22577575)	Comments: Clicked page link in email  navigator window popped up
and displayed address  crash immediately after that.
     (22574280)	URL: http://www.fox.com
     (22573338)	URL: http://www.fox.com
     (22572871)	URL: http://www.caja-ingenieros.es/
     (22572871)	Comments: Starting this web page
     (22572731)	URL: http://www.fox.com
     (22572674)	URL: http://www.fox.com
     (22570267)	URL: http://www.fox.com
     (22569237)	URL: http://www.tmn.ca
     (22569232)	URL: http://www.tmn.ca
     (22569232)	Comments: Opening the web page.
     (22563780)	URL: http://www.fox.com
     (22563157)	URL: http://www.fox.com
     (22562769)	URL: http://www.fox.com
     (22553818)	URL: http://www.fox.com
     (22553758)	URL: http://www.fox.com
     (22538362)	URL: http://www.sgi.com
     (22536379)	URL: http://www.sgi.com
     (22535761)	URL: http://www.sgi.com
     (22528358)	URL: http://www.sgi.com
     (22511506)	URL: http://www.usr.com
     (22510605)	URL: http://www.usr.com
     (22507542)	URL: http://fox.com
     (22506299)	URL: http://fox.com
     (22505918)	URL: http://fox.com
     (22504718)	URL: http://www.fox.com
     (22503575)	URL: http://www.fox.com
     (22496980)	URL: http://fox.com
     (22496907)	URL: http://fox.com
     (22487271)	URL: www.keptech.com/
     (22487271)	Comments: Opening a link from [H]ardOCP.com to the above site. 
Failure happened twice.
     (22480771)	URL: www.fox.com
     (22478446)	URL: http://www.nvidia.com/
     (22478015)	URL: www.fox.com
     (22476490)	URL: www.fox.com
     (22476294)	URL: www.fox.com
     (22476235)	URL: www.fox.com
     (22476222)	URL: www.fox.com
     (22475376)	URL:
http://www.pctechtalk.com/browse.php?sid=1r0d3v2d3q0p8w7k7b6r9f3z9d0c0h8w
     (22475376)	Comments: pressing the back button again
     (22473403)	URL: http://www.nvidia.com
     (22473403)	Comments: just started it up from the WinXP command line:   
http://www.nvidia.com    Moz. is my default browser
     (22468821)	URL: www.fox.com
     (22468804)	URL: www.fox.com
     (22468772)	URL: www.fox.com
     (22468731)	URL: www.fox.com
     (22468714)	URL: www.fox.com
     (22432194)	URL: www.br-alpha.de
     (22432191)	URL: www.br-alpha.de
     (22427707)	URL: http://www.nvidia.com/

From nsRenderingContextWin::GetTextDimensions crashes:
(22639723)	URL: http://www.sysmatrix.net/~patrickberg/music.htm
     (22639723)	Comments: I reloaded the page & then Mozilla failed
     (22583554)	Comments: reading mail 
     (22540394)	URL: foxnews.com
     (22540394)	Comments: Trying to watch a video in an imbedded real player page.
     (22526261)	URL: http://gardnerinc.com
     (22526261)	Comments: Just browsing
     (22424412)	URL: http://www.gamespot.com
     (22424399)	URL: http://www.gamespot.com

Comment 58

[Jason Barnabe (np)]

Attachment: another testcase

Testcase made from ford.com. While the other one had FORM and DIV elements,
this one doesn't. They both have EMBED and 2 <TD STYLE="FONT-SIZE...

Comment 59

[Simon Paquet [:sipaq]]

*** Bug 215834 has been marked as a duplicate of this bug. ***

Comment 60

[Simon Paquet [:sipaq]]

*** Bug 215870 has been marked as a duplicate of this bug. ***

Comment 61

[amano]

(using aebrahims unofficial Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.5b) Gecko/20030810 Mozilla Firebird/0.6.1+)

while I was NEVER able to reproduce these crashes out in the wild, these last
testcases  crash the browser (only by selecting "Open Link in a new window").

Comment 62

[Matthias Versen [:Matti]]

rbs: 
Sorry, i missed your comment !
I can't get to crash my debug build, only my optimized with symbols (but every
time for fox.com today)

I see another crash with my debug on http://www.plumtree.com (from the Talkback
comments) but i opened bug 215878 for that.

Comment 63

[Scot Hale]

Attachment: another test case

This isn't quite as elegant as the other two test cases, but I figured it
couldn't hurt to upload it.

Comment 64

[rbs]

Attachment: patch

Here is the patch to fix this nasty crasher.

There was a subtle flaw in this chunk:
@@ -2641,13 +2643,11 @@
 
 void nsRenderingContextWin :: SetupFontAndColor(void)
 {
-  if (((mFontMetrics != mCurrFontMetrics) || (NULL == mCurrFontMetrics)) &&
-      (nsnull != mFontMetrics))
-  {
+  if (mFontMetrics && (!mCurrFontWin || mCurrFontWin->mFont != mCurrFont)) {
     nsFontHandle  fontHandle;
     mFontMetrics->GetFontHandle(fontHandle);
     HFONT	   tfont = (HFONT)fontHandle;
-    
+
     ::SelectObject(mDC, tfont);
 
     mCurrFont = tfont;
=============================================

The whole point of this |if| is to avoid the OS function |::SelectObject| as
much as possible because it is an expensive operation. This optimization has a
bug.

Consider the scenario where |mFontMetrics| is released in SetFont() and another
one is |new|ed such that, by _coincidence_, the address is the same as the old
one. In this case |mFontMetrics == mCurrFontMetrics| and so the setup code
jumps pass the |if|, meaning that the other variables retains the values
associated to the older font-metrics that was released... A crash follows since
these values point to garbage. The randomness is explained by the bad
coincidence: the new and old addresses have to match.

In the patch, I changed the |if| to only trust what comes from |mFontMetrics|
itself. It owns |mCurrFontWin|. If SetFont() is called, mFontMetrics is changed
along with its constituents. And by clearing |mCurrFontWin|, the |if| gets
executed, and things are brought in sync again.

Comment 65

[rbs]

Comment on attachment 129651 [details] [diff] [review]
patch

Asking r/sr

Comment 66

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 129651 [details] [diff] [review]
patch

looks good, although I'm not very familiar with the Win32 font code.

It might be helpful if you could add some comments to nsRenderingContextWin.h
documenting the roles of mCurrFont, mCurrFontWin, and mFontMetrics, especially
what the invariants are. (e.g., mCurrFontWin is a font owned by mFontMetrics,
or null)

Comment 67

[rbs]

Comment on attachment 129651 [details] [diff] [review]
patch

Asking a= on this nasty top crasher. The bug was due to the fact that a local
variable was keeping the value of a reference-counted font-metrics object that
could die, leaving that local variable with a value that is now meaningless.
The patch remedies the problem by relying on what the font-metrics object
itself owns.

Comment 68

[Oleg Sidletskiy]

>It has nothing to do with Flash - it has crashed my Mozilla Firebird every time
>I've tried www.redsox.com so far - and I don't have Flash installed.
It does not matter if you have flash, but if the *page* has flash (and
www.redsox.com redirects to a page with flash).

I think this has something to do with plugins that display content in a web
page, almost all of the pages listed/reported have flash or java applets in them.

The weird thing is that crashes a random and sometimes more frequent on some
sites than others (fox.com 50% vs. d2ol.com 10%).

Comment 69

[Oleg Sidletskiy]

*** Bug 215837 has been marked as a duplicate of this bug. ***

Comment 70

[Oleg Sidletskiy]

*** Bug 216158 has been marked as a duplicate of this bug. ***

Comment 71

[Oleg Sidletskiy]

*** Bug 216151 has been marked as a duplicate of this bug. ***

Comment 72

[Simon Paquet [:sipaq]]

*** Bug 216072 has been marked as a duplicate of this bug. ***

Comment 73

[Asa Dotzler [:asa]]

Comment on attachment 129651 [details] [diff] [review]
patch

 a=asa (on behalf of drivers) for checkin to Mozilla 1.5beta.

Comment 74

[rbs]

Checked-in with these added comments in nsRenderingContextWin.h:
+  // mFontMetrics owns mCurrFontWin which is a thin wrapper
+  // around mCurrFont (the actual GDI font handle). These variables
+  // allow us to quickly tell the current selected font and to
+  // avoid the high expense of a redundant setup of the same font.
   nsFontWin         *mCurrFontWin;
   HFONT             mCurrFont;

Comment 75

[Oleg Sidletskiy]

*** Bug 215886 has been marked as a duplicate of this bug. ***

Comment 76

[Simon Paquet [:sipaq]]

*** Bug 216300 has been marked as a duplicate of this bug. ***

Comment 77

[Gregor Larson]

*** Bug 214345 has been marked as a duplicate of this bug. ***

Comment 78

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 218064 has been marked as a duplicate of this bug. ***

Comment 79

[Simon Paquet [:sipaq]]

*** Bug 214725 has been marked as a duplicate of this bug. ***

Comment 80

[Simon Paquet [:sipaq]]

*** Bug 215682 has been marked as a duplicate of this bug. ***

Comment 81

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/afc662d52ab1