167928 - Crash scrolling this page [@ nsFontMetricsWin::RealizeFont] [@ nsImageWin::DrawTile]

Status: RESOLVED WORKSFORME

(SeaMonkey :: General, defect)

Description

[Andrea Aime]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2a) Gecko/20020909
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2a) Gecko/20020909

The above page makes Mozilla crash every time I try
to scroll down.

Reproducible: Always

Steps to Reproduce:
1. Open http://sammaher.com/jboss/
2. Scroll down to the end of the page
3. Mozilla crashes during the scroll

Actual Results:  
Crash

Expected Results:  
It shouldn't crash ;-)

I've tried both pinball and modern theme, same result

Comment 1

[Andrea Aime]

I'm using a talkback enabled version, so you should
be able to get a backtrace too... how can I find the
talkback id?

Comment 2

[Thamer Mahmoud]

WFM on Windows XP 2002090804

Comment 3

[Olivier Cahagne]

Andrea, check 'mozilla/bin/talkback/talkback.exe'.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Run the components\talkback.exe program from the mozilla install directory. 
That should list your incident IDs...

There are two talkbacks for you email from today; not sure which is associated
with this bug...

Comment 5

[Frank Wein [:mcsmurf]]

Wfm Windows 2000,Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2a)
Gecko/20020910

Comment 6

[Andrea Aime]

Incident IDs: should be one of
TB10737800H
TB10737117G

Comment 7

[Andrea Aime]

Ah, ehm, sorry Boris, didn't read completely your
message. Both incidents should be related to this page.
At least one incident should have the URL in the incident
description.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Neither one does, actually.  ;)  The two stacks are:

nsImageWin::DrawTile
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsImageWin.cpp, line 829]
nsRect::Intersects [c:/builds/seamonkey/mozilla/gfx/src/nsRect.cpp, line 75]
ComputeBackgroundAnchorPoint
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSRendering.cpp, line 2289]
nsCSSRendering::PaintBackgroundWithSC
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSRendering.cpp, line 2773]
nsBoxFrame::GetInset
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1505]
nsBoxFrame::Paint
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1608]
nsBoxFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1767]
nsBoxFrameInner::GetDebugPref
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1575]
nsBoxFrame::Paint
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1608]
nsBoxFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1767]
nsBoxFrameInner::GetDebugPref
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1575]
nsBoxFrame::Paint
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1608]
nsBoxFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1767]
nsBoxFrameInner::GetDebugPref
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1575]
nsBoxFrame::Paint
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1608]
nsBoxFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1767]
nsBoxFrameInner::GetDebugPref
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1575]
nsBoxFrame::Paint
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1608]
nsBoxFrame::PaintChildren
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1767]
nsBoxFrameInner::GetDebugPref
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1575]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsContainerFrame::GetFrameForPointUsing
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 321]
nsContainerFrame::GetFrameForPointUsing
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 316]
PresShell::GetStyleContextFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5580]
nsView::Paint [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 278]
nsViewManager::RenderViews
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1169]
nsViewManager::RenderViews
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1090]
nsViewManager::Refresh [c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp,
line 716]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1682]
nsView::CreateWidget [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 824]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1052]
nsWindow::DispatchStandardEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1075]
nsWindow::OnPaint [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp,
line 4939]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3616]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1325]
USER32.DLL + 0x1b60 (0x77e11b60)
USER32.DLL + 0x2f29 (0x77e12f29)
USER32.DLL + 0x2f4f (0x77e12f4f)
ntdll.dll + 0x2032f (0x7848032f)
USER32.DLL + 0x83f1 (0x77e183f1)
nsAppShellService::JustCreateTopWindow
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 619]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1502]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1881]
DumpArbitraryHelp [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 547]
nsNativeAppSupportBase::Start
[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsNativeAppSupportBase.cpp, line 58]
KERNEL32.DLL + 0xd326 (0x77e8d326) 

and 

0x50088b14
nsFontMetricsWin::RealizeFont
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3344]
nsFontMetricsWin::QueryInterface
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 449]
nsFontCache::GetDeviceContext
[c:/builds/seamonkey/mozilla/gfx/src/nsDeviceContext.cpp, line 634]
DeviceContextImpl::GetLocaleLangGroup
[c:/builds/seamonkey/mozilla/gfx/src/nsDeviceContext.cpp, line 310]
nsRenderingContextWin::SetColor
[c:/builds/seamonkey/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 972]
HRuleFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHRFrame.cpp, line 183]
nsTextFrame::TextStyle::TextStyle
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 599]
nsTextFrame::Paint
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 1476]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsContainerFrame::GetFrameForPointUsing
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 321]
nsHTMLContainerFrame::ReparentFrameView
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp, line
342]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsContainerFrame::GetFrameForPointUsing
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 321]
nsHTMLContainerFrame::ReparentFrameView
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp, line
342]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsBlockFrame::GetClosestLine
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5866]
nsBlockFrame::PaintFloaters
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5750]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsBlockFrame::GetClosestLine
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5866]
nsBlockFrame::PaintFloaters
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5750]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsBlockFrame::GetClosestLine
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5866]
nsBlockFrame::PaintFloaters
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5750]
nsContainerFrame::ReplaceFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 369]
nsContainerFrame::GetFrameForPointUsing
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 321]
nsHTMLContainerFrame::ReparentFrameView
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp, line
342]
CanvasFrame::QueryInterface
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLFrame.cpp, line 209]
PresShell::GetLayoutObjectFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5592]
nsView::Paint [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 278]
nsViewManager::RenderViews
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1169]
nsViewManager::RenderViews
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1085]
nsViewManager::Refresh [c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp,
line 716]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1682]
nsView::CreateWidget [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 824]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1052]
nsWindow::DispatchStandardEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1075]
nsWindow::OnPaint [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp,
line 4939]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3616]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1325]
USER32.DLL + 0x1b60 (0x77e11b60)
USER32.DLL + 0x2f29 (0x77e12f29)
USER32.DLL + 0x2f4f (0x77e12f4f)
ntdll.dll + 0x2032f (0x7848032f)
nsScrollPortView::ScrollByPages
[c:/builds/seamonkey/mozilla/view/src/nsScrollPortView.cpp, line 475]
nsScrollPortView::ScrollTo
[c:/builds/seamonkey/mozilla/view/src/nsScrollPortView.cpp, line 275]
nsGfxScrollFrameInner::AttributeChanged
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp, line 943]
nsGfxScrollFrame::CreateAnonymousContent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp, line 424]
nsRange::ToString [c:/builds/seamonkey/mozilla/content/base/src/nsRange.cpp,
line 2326]
nsHTMLDocument::AttributeChanged
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp, line
1503]
nsXULElement::GetControllers
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3968]
nsXULElement::GetId
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3996]
nsSliderFrame::GetContentOf
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsSliderFrame.cpp, line 762]
nsSliderFrame::DoLayout
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsSliderFrame.cpp, line 418]
InClipRect [c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5728]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5976]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2055]
nsView::Paint [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 300]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1852]
nsView::CreateWidget [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 824]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1052]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1061]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5145]
nsWindow::SetTitle [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp,
line 5419] 

To dcone based on that first stack, I guess.

Comment 9

[Andrea Aime]

Ok, just to make sure I've added another talkback report,
talkback id is TB10740299H. I'm sure this one has been
created scrolling down on http://sammaher.com/jboss/

Comment 10

[Boris Zbarsky [:bzbarsky]]

nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5171] 

That's it for that one....

Comment 11

[dcone (gone)]

I can not reproduce this bug.. I can guess what might have happened, but I have
no way to make sure that the fix I propose fixes that.  The only thing I can see
that might cause a crash in nsImageWin was the creation of a compatible DC and
the code does not check to see if it was created (if it was not.. the memory is
very very very very low.. very small likelyhood that this compatible DC was not
created.. but should be checked for anyway).  If someone can repro the crash and
it crashes consistenly in nsImageWin.. I have a fix that they can try and see if
it goes away.. it may crash somewere else though because of an unstable enviornment.

Comment 12

[Andrea Aime]

It's quite unlikely that my machine was low on memory,  since I've got 512MB of RAM and I was able to reproduce  this several times during the day (ok, I was using   Netbeans, but I'm pretty sure there was plenty of  free RAM...). Anyway, tomorrow I will try again with only Mozilla in 512 MB... BTW, I cannot reproduce this on my linux box at home... 

Comment 13

[Andrea Aime]

Well, tried today with the very same build...
everything is working fine. Oh well, nevermind...