186704 - Reproducable crash when visiting xine website [XRenderCompositeText8] [XRenderCompositeText16]

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect)

Description

[André Dahlqvist]

[Tested with 2002-12-12 on Linux, fresh profile, fresh install]

I've been able to reproduce this crash for quite some time in Phoenix, and
*only* Phoenix. I appear to be rather alone in being able to reproduce it so the
cause may be something specific to my setup or to my distribution Debian.

All I have to do to cause the crash is to:

1) Go to http://xinehq.de

Result: Instant crash, I only get to see a flash of the layout before Phoenix
dies. I am unable to run Phoenix though gdb, but I have built a debug build and
this is the output I get when the crash occurs:

CSS Error (http://xinehq.de/css/framework.css :266.17): Unknown property
'text-decoraction'.  Declaration dropped.
###!!! ASSERTION: invlaid divisor: 'PR_FALSE', file
/home/andre/devel/cvs/mozilla/layout/html/table/src/nsTableFrame.cpp, line 3679
Break: at file
/home/andre/devel/cvs/mozilla/layout/html/table/src/nsTableFrame.cpp, line 3679
Gdk-ERROR **: BadIDChoice (invalid resource ID chosen for this connection)
  serial 18417 error_code 14 request_code 1 minor_code 0

I'm running Debian GNU/Linux Unstable. This happens with both regular nightlies
and binaries compiled by me. As I said above, the crash does NOT occur in Mozilla.

Comment 1

[alanjstr]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021225
Phoenix/0.5

Comment 2

[André Dahlqvist]

Attachment: A tar.gz file of a reduced testcase

The attached tar.gz files contains tree files, index.html and two stylesheets.
Loading index.html causes the crash for me. I have narrowed it down as much as
I can. If I comment out the loading of the stylesheets the crash does not
occur. If I comment out the paragraph that starts with "submissions" the crash
also does not occur.

Comment 3

[Todd Kulesza]

This appears to be related to the Xft code.  I've been having this crash since
Mozilla 1.2.1 was released, using my own build with Xft enabled.  Today I
rebuilt it using the exact same configure options, sans Xft, and the Xine page
loads fine.  This is on a Slackware 8.1 system with the Xft2/fontconfig package
from http://www.fontconfig.org, and FreeType 2.1.3.  The crash occurs using both
the 2.0 and 2.1 releases of fontconfig.

Comment 4

[Drew "DanteAliegri" Ogle]

So this is indeed kind of irritating.
I built a debug gtk+ 2 build, which also experinces this problem.
when running the test case in ddd, the stack is highly 
unremarkable:
#0  0x4024a6de in exit () from /lib/libc.so.6
#1  0x41860f8f in gdk_x_error (display=0x813d530, error=0xbffff220) at
gdkmain-x11.c:536
#2  0x4158d503 in _XError () from /usr/X11R6/lib/libX11.so.6
#3  0x4158bdd8 in _XReply () from /usr/X11R6/lib/libX11.so.6
#4  0x415875c5 in XSync () from /usr/X11R6/lib/libX11.so.6
#5  0x4185842b in gdk_flush () at gdkevents-x11.c:2190
#6  0x4184a0a6 in gdk_window_process_all_updates () at gdkwindow.c:2173
#7  0x4184a0ea in gdk_window_update_idle (data=0x0) at gdkwindow.c:2180
#8  0x41951756 in g_timeout_add () from /usr/lib/libglib-2.0.so.0
#9  0x4194f0b9 in g_get_current_time () from /usr/lib/libglib-2.0.so.0
#10 0x4194fe5f in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#11 0x41950233 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#12 0x4195090f in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#13 0x416cdaeb in gtk_main () at gtkmain.c:1092
#14 0x4151ee5f in nsAppShell::Run() () from
/usr/src/mozilla/dist/bin/components/libwidget_gtk2.so
#15 0x414ca3ca in nsAppShellService::Run() () from
/usr/src/mozilla/dist/bin/components/libnsappshell.so
#16 0x0804d9ce in operator new(unsigned) ()
#17 0x0804e54a in operator new(unsigned) ()
#18 0x402379f1 in __libc_start_main () from /lib/libc.so.6

The only thing interesting to mention is that with the debug build,
I have had, on occasion, it load fine, where I can then just go on and continue
to browse fine.

Just for extra information, when it does crash, here is what gtk says:
The error was 'BadRequest (invalid request code or no such operation)'.
 (Details: serial 7702 error_code 1 request_code 255 minor_code 0)
 (Note to programmers: normally, X errors are reported asynchronously;
  that is, you will receive the error a while after causing it.
  To debug your program, run it with the --sync command line
  option to change this behavior. You can then get a meaningful
  backtrace from your debugger if you break on the gdk_x_error() function.)

Which is very strange.
Is there a chance this is a gtk bug?

Comment 5

[Asa Dotzler [:asa]]

Unable to reproduce with a nightly or debug build from today. This seems to be
working now. 

The only interesting thing I see in the console is 

CSS Error (framework.css :266.17): Unknown property 'text-decoraction'. 
Declaration dropped.

If you're still seeing this crasher and can provide a full stack trace from a
debug build with line numbers and all that please reopen. 

Comment 6

[André Dahlqvist]

I will create a debug build of Phoenix right now, and see if I can crash it.
Like I wrote in comment 1 I cannot run phoenix though gdb, and talkback is not
available.

Take a look at this Debian bug which was filed using the 2003-01-30'th build of
Mozilla:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=179217

Comment 7

[André Dahlqvist]

Attachment: Crash with a debug build from today

I still crash on this website, and attached is some debug output plus a full
backtrace. The backtrace points to xft and it seams sort of similar to the one
I experience in bug 187654.

Comment 8

[André Dahlqvist]

Forgot to mention that this was with mozilla, so I'm reassigning it to that
component.

Comment 9

[André Dahlqvist]

I think blizzard wants xft bugs.

Comment 10

[Christopher Blizzard (:blizzard)]

*** Bug 187654 has been marked as a duplicate of this bug. ***

Comment 11

[Christopher Blizzard (:blizzard)]

*** Bug 195268 has been marked as a duplicate of this bug. ***

Comment 12

[James Strandboge]

Keith's Xrender patch on 

http://bugzilla.mozilla.org/show_bug.cgi?id=173204

fixes this issue for me.  Mozilla 1.2.1, fontconfig 2.1, libxft2 2.1, glibc
2.2.5, xfree86 4.2.1 and freetype 2.1.3.

Also, my problems related to:
http://bugzilla.mozilla.org/show_bug.cgi?id=187654

are fixed too.

Comment 13

[André Dahlqvist]

I installed Branden Robinson's 4.2.1-6pre7v2 pre-release of XFree86 for Debian
GNU/Linux, which contains these xft-related fixes:

+ XRenderFreeGlyphs wasn't sending the glyphset. (Keith Packard)
+ CompositeGlyphs functions were re-using overwritten data and trashing
  the output buffer. (Keith Packard)
+ CompositeText{8,16,32} weren't switching glyphsets at the right time.
  (Keith Packard) (Closes: #181815)
+ Was miscomputing request length for String16 and String32.  (Keith
  Packard)

With that release, this crash on no longer reproducable. I hope these patches
are in XFree86 4.3.0 and that adoption of that release is quick.

Should I mark this WFM?

Comment 14

[Christopher Blizzard (:blizzard)]

Sure, go right ahead.

Comment 15

[André Dahlqvist]

WFM since the fixes in new xft2 cures this bug.

Comment 16

[Andrew Schultz]

*** Bug 201459 has been marked as a duplicate of this bug. ***