140055 - X-server crashes when scrolling horizontally in documents with very long lines

Status: RESOLVED INVALID

(SeaMonkey :: General, defect)

Description

[Stefan A. Möller]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9+) Gecko/20020423
BuildID:    2002042321

Linux X-server crashes when scrolling horizontally in documents with very long
lines. This happens both with html documents in the browser's main window, and
with html source displayed in the source viewer.


Reproducible: Always
Steps to Reproduce:
1. go to http://paypal.4t.com/
2. view page source
3. scroll down the source code until those very long lines with lots of numbers
in it come into view
4. now scroll horizontally to the very right, and then back to the left
(sometimes i had to repeat step 4 two or three times)

Actual Results:  X-server crashes or freezes.

I'm using XFree 4.1.0 and Kernel 2.4.16 (SuSE builds).

I've experienced this problem some time ago with the 0.9.9 build on another
machine, with the same linux system, but another graphics card. In that case it
happend when scrolling an html page in the main browser window. Unfortunately I
have been unable to reproduce it, for that page was the output of validator.w3.org.
This time the page source viewer is crashing X, but it seems to be the same sort
of problem.

Note: I will create an attachment with my actual testcase, because paypal.4t.com
has been used to spy passwords of PayPal users, and I don't expect that server
to be online for a longer period of time...  ;-)

Comment 1

[Stefan A. Möller]

Attachment: testcase from paypal.4t.com

Comment 2

[Stefan A. Möller]

Attachment: ...and that's the other case: scrolling HTML page in main browser window crashes X-server, too

Steps to Reproduce this one:
1. open this attachment
2 [details] [diff] [review]. scroll down to the bottom of the page (in main browser window, *not* source
code)
3. scroll to the very right and back to the left (same as above)

Result: Another X-server crash.

Comment 3

[Michiel van Leeuwen (email: mvl+moz@)]

This looks like it is bug 120318

Comment 4

[Stefan A. Möller]

... but not only the source viewer. Main browser, too!

BTW: Why is bugzilla automatically inserting links within the text?
Of course the testcase is (id=80952), and not "open this _attachment_".

Comment 5

[Adrian Ulrich]

hmm.. wfm 2002042023

XFree86 Version 4.1.0.1 / X Window System
(protocol Version 11, revision 0, vendor release 6510)
Release Date: 21 December 2001

on ppc (r128 -> iBook2)

Comment 6

[Michiel van Leeuwen (email: mvl+moz@)]

I think it is the same problem. If I am correct, view-source uses a big <pre>
block. The other testcase also has a <pre> block. So I think you can dup this,
and add a comment to the other bug.

Comment 7

[Adrian Ulrich]

*** Bug 140694 has been marked as a duplicate of this bug. ***

Comment 8

[Boris Zbarsky [:bzbarsky]]

Stefan, are you using the nvidia driver?  I have seen this once or twice since I
have started to use that driver; I had never seen it before that....

Comment 9

[Stefan A. Möller]

Yes. Actually two different drivers:
- at work (Riva TNT card): the standard nv driver which comes with XFree 4.1.0
- at home (GeForce4 MX): the driver provided by nvidia, version 1.0-2802
In both cases the X-server is crashing.

Comment 10

[Andrew Schultz]

both testcases workforme
Riva TNT, nv driver from XFree86-4.1.0
Mozilla build 20020502

Comment 11

[Stefan A. Möller]

Still doesn't work for me with build 2002050113    :-(
So I did a lot of testing...
Results:

a) It has nothing to do with the nvidia driver: I can reproduce this bug on a
machine with ATI Xpert and mach64 driver (but it's Mozilla 0.9.9 there).

b) This bug depends on Mozilla's font settings. The X-server only crashes when
I'm using TrueType fonts, ISO8859-15, *and* font size increased to 18 pixels
(for both proportional and monospaced fonts):

user_pref("font.name.cursive.x-western", "monotype-courier new-iso8859-15");
user_pref("font.name.fantasy.x-western", "monotype-courier new-iso8859-15");
user_pref("font.name.monospace.x-western", "monotype-courier new-iso8859-15");
user_pref("font.name.sans-serif.x-western", "microsoft-verdana-iso8859-15");
user_pref("font.name.serif.x-western", "microsoft-georgia-iso8859-15");
user_pref("font.size.fixed.x-western", 18);
user_pref("font.size.variable.x-western", 18);

Notes:
- I had to restart Mozilla after changing the font settings, otherwise it does
not crash the X-server. (On the other machine it even didn't crash until I
restarted X. But after that it's always reproducable. Very odd ...)
- I'm using the TT fonts from www.microsoft.com/typography/fontpack/

Comment 12

[Stefan A. Möller]

Attachment: my XFree86 and Mozilla config files (XF86config, XftConfig, and prefs.js)

Comment 13

[Stefan A. Möller]

Oops...  attaching archive files doesn't work well. id=82620 is a .tar.gz file.

(I beg your pardon. It's the first time I'm reporting bugs here.)

Comment 14

[Adrian Ulrich]

*** Bug 148822 has been marked as a duplicate of this bug. ***

Comment 15

[Stefan A. Möller]

The problem has gone after updating to XFree86 Version 4.2.0.
Works for me now.

Comment 16

[zack-weg]

I see this even with a plain text file when scrolling left-to-right beyond the
2^15th pixel (not when scrolling right-to-left).
NS 6.2.3 displays garbage, but does not crash.
I'm using XFree86 4.1.0 with mach64 driver.

Comment 17

[zack-weg]

Attachment: testcase: line with 5000 chars of plain text

Comment 18

[Andrew Schultz]

the garbage display way off to the right is bug 130475

Comment 19

[Tril 0. Byte]

This might be a separate bug but someone said something about long fonts and X
4.1 so I'll post it here.

If I click on this link, X server will crash:
http://www.free-market.net/forums/e-gold0204/messages/891238204.html

The page contains a long TITLE, long META tag, and some long <B> sections.

There seems to be no problem with the linking page,
http://www.free-market.net/forums/e-gold0204/  (search for "scam, scam")

XFree86 version 4.1.0.1
Mozilla versions 1.0.0 (Debian i386 package) and build 2002082308 both crash X
on this link.

Comment 20

[Tril 0. Byte]

I will add that am using nv (free 2D Nvidia) driver, no fbdev.

Comment 21

[Bartosz Wucke]

Confirming on Linux/i386, Mozilla 1.0.1 (140055) - although to get the testcases
working I had to increase font size using view -> text zoom -> 200%

VGA: GForce2MX
X driver: "nv" (XF86 standard)
Modules in XF86Config-4:

Section "Module"
        Load  "dbe"             # Double-buffering
        Load  "GLcore"          # OpenGL support
        Load  "dri"             # Direct rendering infrastructure
        Load  "glx"             # OpenGL X protocol interface
        Load  "extmod"          # Misc. required extensions
         Load  "pex5"           # PHIGS for X 3D environment (obsolete)
         Load  "record" # X event recorder
         Load  "freetype"        # TrueType font handler
         Load  "type1"          # Adobe Type 1 font handler
         Load  "speedo"         # Adobe Type 1 font handler
EndSection

Somebody test this with non-nVidia card? (adding verifyme keyword)

Comment 22

[Andrew Schultz]

http://bugzilla.mozilla.org/describekeywords.cgi#verifyme

Comment 23

[Boris Zbarsky [:bzbarsky]]

It seems this is a known buffer overflow in XFree 4.0.x.  See
http://online.securityfocus.com/archive/1/244322 and
http://online.securityfocus.com/archive/1/244393

Comment 24

[Kenneth Herron]

Works for me, using linux nightly 2002112908 on a system with XFree86 4.2.1.

I'm going to go ahead and resolve this as invalid since it seems to be a bug in
the X server rather than mozilla.