267126 - xlib makes mozilla exit due to large image

Status: VERIFIED DUPLICATE of bug 210931

(Core Graveyard :: GFX: Gtk, defect)

Description

[georgi - hopefully not receiving bugspam]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10

when visiting the above url with latest mozilla trunk (and previous versions) 
on linux mozilla exits with the following error:


The error was 'BadValue (integer parameter out of range for operation)'.
  (Details: serial 93624 error_code 2 request_code 53 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)


Reproducible: Always
Steps to Reproduce:
go to the url

Comment 1

[georgi - hopefully not receiving bugspam]

seems confirmed on debian also.

gdb doesn't fire.

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

GFX:Xlib is for the xlib port of mozilla. this is not what default builds use.

Comment 3

[Mitch]

This is related to bug 210931 . Essentially gdb will not fire since it is a
clean exit being called. If we (mozilla) redefine the error handler then we can
trap this.

Comment 4

[Mitch]

In your html you have

<img src="apache.png" style="width: 65536; height: 65536; background:
red;">asdf</img>

So for a 8bpp image of that size you'll be wanting 8*65535^2 = 32GB of memory to
build that image. That clearly bad coding. Have you ever sceen a screen that big ?

Comment 5

[georgi - hopefully not receiving bugspam]

it is strange at first sight, but

1. this is linux specific - the testcase works on f*cked windoze
2. if you change <img> to <div> you'll see large scrollbars and red backround of
the <div> (without large amount of virtual memory)

Comment 6

[Mitch]

As explained:

1. Of course this is linux specific. Windows doesn't have Xlib. I am not
disputing it is a bug.
2. an <img> tag creates a xserver pixmap which triggers the bug. A <div> tag
doesn't create a xserver pixmap hence it works.

Bottom line, this is a dup of aforementioned bug.

Comment 7

[georgi - hopefully not receiving bugspam]

style="width: 2; height: 65536" => crash
style="width: 2; height: 65535" => no crash

something related to "short int" ?

Comment 8

[Mitch]

Yes it is a short. Gregori can you close this as a dup of 210931. I have a patch
which i will attach to the aforementioned bug and carry on discussion in that bug.

Comment 9

[Kenneth Herron]

Resolving per the previous comment.

*** This bug has been marked as a duplicate of 210931 ***