128282 - [PATCH]Crash when loading http://gabber.sourceforge.net [@ nsImageWin::DrawTile]

Status: VERIFIED FIXED

(Core Graveyard :: GFX, defect, P1)

Description

[Mark Williamson]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.8+) Gecko/20020227

Comment 1

[Mark Williamson]

TB3477344E

Comment 2

[Mark Williamson]

TB3478107E

Comment 3

[Dan]

Crashed with me too, TB3478693Z.

If you disable images, it doesn't crash.

Comment 4

[Mark Williamson]

I've been through http://gabber.sourceforge.net/images and I can load every
image independently without moz crashing.

Is this linked with the null sized gif in this dir?

http://gabber.sourceforge.net/images/css.gif

Comment 5

[Mike]

me three on crashing.  Win2K SP2.  Build 2002022703.

Comment 6

[Matthias Versen [:Matti]]

-> Compositor (?) and confirming with win2k build 20020226..

Comment 7

[Matthias Versen [:Matti]]

Attachment: win2k stack trace

Comment 8

[Olivier Cahagne]

wfm using build 2002022808 on Linux.
Might be a Windows-only bug ?

Comment 9

[Kevin McCluskey (gone)]

Reassigning to Don

Comment 10

[timeless]

*** Bug 128324 has been marked as a duplicate of this bug. ***

Comment 11

[timeless]

*** Bug 123434 has been marked as a duplicate of this bug. ***

Comment 12

[Daniel Steinberger]

in bug 128282 i created attachment 71927 [details] which demonstrates the problem. it
crashes the browser in module 'gkgfxwin.dll'
some talkback IDs are: TB3486577M, TB3485969M, TB3441933K and others

my testcase simply does the following: use an image in the   <link rel="shortcut
icon" type="image/png" href="..."> tag in the header and then also style an
(any) other element in the page content with the same image: voila there is the
crasher. if one removes one of the uses of the image, everything works fine.

the given URL doesn't seem to use it's shortcut icon elsewhere, but it seem to
be the same conditions which crash the browser. so my testcase should work for
this one, too.

Comment 13

[Daniel Steinberger]

the above bug number should have been bug 128324 of cause (dup'd in comment 10).
and pavlov also stated "dcone has been playing with the windows tiling code
recently.. over to him" there, so dcone seems to be the right owner.

Comment 14

[Matthias Versen [:Matti]]

*** Bug 128842 has been marked as a duplicate of this bug. ***

Comment 15

[dcone (gone)]

for some reason.. http://grabber.sourceforge.net went away while I was running
my tests.. but I use http://linuxgraphic.org which also crashed my machine.  The
problem was we were doing the alpha blend with an optimized image.. which means
we did not have the bits for the blend.  I fixed by converting back to a DDB.  I
am copying Pavlov and Kevin so they can see what I did and can raise any issues
with how I fixed it.  With the current patch.. the memory will go up.. until
something optimizes the image later.. but since it needs to be a DIB for
rendering.. I do not convert back to a DDB.  This will only happend with Alpha
image with a depth of 8 bits.  The only other question I have.. maybee we should
never optimize images with this depth alpha since they need the DIB information
for rendering.

Comment 16

[dcone (gone)]

Attachment: Patch to convert from DDB to DIB for Alpha blend

Comment 17

[Kevin McCluskey (gone)]

Comment on attachment 72474 [details] [diff] [review]
Patch to convert from DDB to DIB for Alpha blend

Please change the if( mImageBits==0) with  if(mImageBits) 

r=[e-mail]

Comment 18

[Marc Attinasi]

Comment on attachment 72474 [details] [diff] [review]
Patch to convert from DDB to DIB for Alpha blend

sr=attinasi

Comment 19

[Marc Attinasi]

Kevin, you meant 'if(!mImageBits)', right?

Comment 20

[Kevin McCluskey (gone)]

oops! Yes, I just wanted the formulation of the statement to change not the
actual comparison.

Comment 21

[Jay Patel [:jay]]

Talkback data shows this crash last appeared with builds from 3/1.  Has anyone
been able to reproduce this since then?  It would be interesting to see if this
is being reported under a different stack signature now.

Comment 22

[Daniel Steinberger]

still happend on 2002030508/WinXP -> TalkbackID is TB3757518E

Comment 23

[Asa Dotzler [:asa]]

Comment on attachment 72474 [details] [diff] [review]
Patch to convert from DDB to DIB for Alpha blend

a=asa (on behalf of drivers) for checkin to the 1.0 trunk

Comment 24

[Kevin McCluskey (gone)]

The patch was checked into the trunk.

Comment 25

[Olivier Cahagne]

*** Bug 130599 has been marked as a duplicate of this bug. ***

Comment 26

[Matthias Versen [:Matti]]

*** Bug 130980 has been marked as a duplicate of this bug. ***

Comment 27

[greer]

No incidents in Talkback data on the Trunk for the last ten days following 
checkin. Good fix, Don.

Comment 28

[Boris Zbarsky [:bzbarsky]]

*** Bug 131985 has been marked as a duplicate of this bug. ***

Comment 29

[R.K.Aa.]

*** Bug 137419 has been marked as a duplicate of this bug. ***