236515 - Browser crashed in print-preview by css-formated image

Status: RESOLVED WORKSFORME

(Core :: Print Preview, defect)

Description

[-]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.6) Gecko/20040113
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.6) Gecko/20040113

I applied following styles to a <div>-section:

.SwitchView { background-image: none; }
.SwitchView:hover { background: white url("some.png") no-repeat fixed center
center; }

I had a look at the result and tried a print preview. In the moment when I enter
the preview-area with the mouse, mozilla crashes 'in a moment' - there is no
error message or anything else, all mozilla-windows are closed imediatly. But
mozilla seems not to loose all its modules: it can be restarted much faster than
an first start of the application does.

Reproducible: Always
Steps to Reproduce:
1. load a (maybe local) page with styles as described
2. select print preview
3. hover the mouse inside the window

Actual Results:  
mozilla crashed

Expected Results:  
mozilla keeps on working (shouldn't try to animate the *print* preview)

I used an image  1.5" by 2" at 300dpi (don't know if this matters)

Comment 1

[Alex Eng]

Please attach a testcase (a sample HTML page that clearly demonstrates the
problem).  Thanks.

Comment 2

[-]

Hi!

Because for to provide some example for this I tried to cut down the used page
where I found this. This figured out to be not a simple job: the minimum (just
the HTML-framework with a div and few characters) didn't harm mozilla. Because I
can't give the original away I made some tests and now I got a simple file *not*
crashing mozilla like described *but* freezing it fully (need the task-manager
to kill). It's a bit to long to place it in here so I will append it.

It looks to me as if there is a problem in memorymanagement. So: could it be a
security risk?


Franz

Comment 3

[-]

Attachment: Example for mozilla lockup (at least here and now)

I think it is a good idea to save your work within mozilla before trying a
print-preview.

Comment 4

[-]

Attachment: Example for a lookup (at least here)

Didn't append the picture. But I don't beliefe it is the reason and I think,
you will manage to get your own. Mine is a png at 300dpi, 1.5" by 2".

Comment 5

[Alex Eng]

Reproduced on build 2004030808
Mozilla/5.0 (Windows; U; Win98; en-US; rv:) Gecko/20040308

Confirming.

Comment 6

[James Napolitano]

Hmm...  
I converted mozilla-banner.gif into a png, and used that in place of "some.png".
 Yet I got no crash.  The print preview window has no animation, regardless of
where I move the mouse; I only see the "Some Text to be displayed always" on the
bottom.
Mozilla/5.0 (Windows; U; Win98; en-US; rv:) Gecko/20040309
(win98se)

Comment 7

[James Napolitano]

Speak of the devil...
I just tried it again.  While the initial print preview didn't crash, when I hit
'Landscape' or increased the Scale, then Mozilla crashed.  Perhaps I had to do
this extra step because I was using a different size image.  
There was no TalkBack, but Windows displayed the following:

MOZILLA caused an invalid page fault in
module GKLAYOUT.DLL at 0197:0116ecb9.
Registers:
EAX=029a1d1c CS=0197 EIP=0116ecb9 EFLGS=00010206
EBX=0299fc10 SS=019f ESP=0065f3ac EBP=0065f3ec
ECX=00003390 DS=019f ESI=00003390 FS=4487
EDX=00000000 ES=019f EDI=0065f3b8 GS=0000
Bytes at CS:EIP:
a5 a5 a5 a5 8b 4d d8 85 c9 7e 42 83 7d d4 00 7e 
Stack dump:
0299fc10 00000000 0065f484 00000000 000003f9 00000000 00000000 00000000 00000000
00001c20 0000004b 00000001 00000001 000003f9 000002f1 00000000 

Choosing Debug, MS Visual Studio points out the following:

Unhandled exception in mozilla.exe (GKLAYOUT.DLL): 0xC0000005: Access Violation.
0116ECB9   movs        dword ptr [edi],dword ptr [esi]

When I tried to repeat the crash, Mozilla now hangs with ~95% CPU usage instead.
 Same thing happens if I use a GIF or JPEG instead.

Comment 8

[Stephan Grossklass]

Confirming hang after opening the testcase from comment #4 and selecting print
preview in 1.7b. The print status dialog came and went, then the hang.
Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.7b) Gecko/20040316

Comment 9

[Stephan Grossklass]

Still hangs in
Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.7b) Gecko/20040330

Comment 10

[Adam Hauner]

Is anybody able to reproduce crash with Mozilla 1.7 final? Please provide
TalkBack incident in such case.

Comment 11

[-]

(In reply to comment #10)
> Is anybody able to reproduce crash with Mozilla 1.7 final?

I do. Mozilla is still acting as I did describe it [Mozilla/5.0 (Windows; U;
Windows NT 5.0; de-AT; rv:1.7) Gecko/20040616].

> Please provide
> TalkBack incident in such case.

Sorry, I'm a bit away of that. I need a description how to do this.

Comment 12

[Adam Hauner]

Mozilla releases contain Talkback, which should catch most crashes and offer to
send in a crash report. To get the Talkback ID's go to your Mozilla directory
and go to components/, there start talkback.exe, it'll give you a list with the
IDs. Thank's a lot.

Comment 13

[-]

(In reply to comment #12)
> Mozilla releases contain Talkback, which should …

Sorry, but I do not have such a program there. None of the .exe-files sound like
such a thing. (Maybe a user defined install?!)
Isn't anybody out there who might do this job? I can't do this for the next time
because I'm away from my machine for the next days :-( (Got my hollidays :-)

Comment 14

[Adam Hauner]

Yes, TalkBack is option (as Quality Feedback Agent) in installer. It should be
in Full Install and in Custom Install. 

Comment 15

[Marius Strumyla]

opening the testcase in print preview, firefox 0.9.1 went into infinitive loop.
pp progress bar appeared then cpu %100 and nothing happens.
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1

Comment 16

[Martijn Wargers (dead)]

WFM in current trunk build. Please test again, it should not crash anymore in
the latest nightly trunk build (
http://ftp.scarlet.be/pub/mozilla.org/firefox/nightly/latest-trunk/ )