300504 - Latest Fx 1.0.5 crashes on www.izarc.org [@ nsImageWin::DrawTile 47966fa0]

Reporter

Description

•

19 years ago

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Goto http://www.izarc.org/ and 1.0.5 builds newer than 2005-30-06 will often crash.

2005-06-29-04-aviary1.0.1.win32 is ok.
2005-07-01-05-aviary1.0.1.win32 will often (not always!) crash.

Talkback: TB7413189

Bug 284716 ?

No problems with current trunk.


Reproducible: Always

Jochen

Reporter

Updated

•

19 years ago

Flags: blocking-aviary1.0.5?

Carsten Book [:Tomcat]

Comment 1

•

19 years ago

Confirmend with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.9)
Gecko/20050712 Firefox/1.0.5

Carsten Book [:Tomcat]

Comment 2

•

19 years ago

Talkback ID TB7417947M

Stack Signature nsImageWin::DrawTile 47966fa0 
Product ID Firefox10 
Build ID 2005071204 
Trigger Time 2005-07-12 10:04:13.0 
Platform Win32 
Operating System Windows NT 5.0 build 2195 
Module firefox.exe + (000e1dd8) 
URL visited Bug 300504 
User Comments  
Since Last Crash 21 sec 
Total Uptime 21 sec 
Trigger Reason Access violation 
Source File, Line No.
c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp,
line 955 
Stack Trace  

nsImageWin::DrawTile 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp,
line 955]
nsRenderingContextImpl::DrawTile 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/gfx/src/shared/nsRenderingContextImpl.cpp,
line 927]
nsCSSRendering::PaintBackgroundWithSC 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3243]
nsCSSRendering::PaintBackground 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 2747]
nsTableCellFrame::PaintUnderlay 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 388]
nsTableCellFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 428]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableRowFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 570]
nsTableRowGroupFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 287]
nsTableRowGroupFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 235]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1383]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1456]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 349]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableCellFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 476]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableRowFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 570]
nsTableRowGroupFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 287]
nsTableRowGroupFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 235]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1383]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1456]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 349]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableCellFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 476]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableRowFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 570]
nsTableRowGroupFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 287]
nsTableRowGroupFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 235]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1383]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1456]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 349]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]

Status: UNCONFIRMED → NEW

Ever confirmed: true

Summary: Latest Fx 1.0.5 crashes often on www.izarc.org → Latest Fx 1.0.5 crashes on www.izarc.org [@ nsImageWin::DrawTile 47966fa0]

Carsten Book [:Tomcat]

Comment 3

•

19 years ago

FF 1.0.5 Crashs here seconds after i go to this page.

Keywords: crash, regression

:Gavin Sharp [email: gavin@gavinsharp.com]

Updated

•

19 years ago

Assignee: nobody → win32

Component: General → GFX: Win32

Product: Firefox → Core

QA Contact: general → ian

Version: unspecified → Other Branch

:Gavin Sharp [email: gavin@gavinsharp.com]

Comment 4

•

19 years ago

Related bugs:
bug 299252
bug 284716 (r=pavlov,sr=tor)
bug 284978 (r=ere,sr=bz)
bug 289864

Range:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=AviaryBranchTinderbox&branch=AVIARY_1_0_1_20050124_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-06-29+04%3A00&maxdate=2005-07-01+05%3A00&cvsroot=%2Fcvsroot

Zach Lipton [:zach]

Comment 5

•

19 years ago

This is fixed on the trunk. If you can reproduce with the latest nightly build
on the trunk, please reopen. 

->WORKSFORME

Status: NEW → RESOLVED

Closed: 19 years ago

Resolution: --- → WORKSFORME

Frank Wein [:mcsmurf]

Comment 6

•

19 years ago

zach: Pleeeease read the bug before :), this seems like a branch-only regression

Status: RESOLVED → REOPENED

Resolution: WORKSFORME → ---

Steve England [:stevee]

Comment 7

•

19 years ago

Can't crash. New Profile, Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Can crash. New Profile, Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.7.9) Gecko/20050709 Firefox/1.0.5
TBID TB7420110M

Tracy Walker [:tracy]

Comment 8

•

19 years ago

a sligtly narrower window (though initially implied as such)

2005-06-30-05-aviary1.0.1 does not crash
2005-07-01-05-aviary1.0.1 crashes

Flags: blocking-aviary1.0.6?

Steve England [:stevee]

Comment 9

•

19 years ago

From comment 8

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=AviaryBranchTinderbox&branch=AVIARY_1_0_1_20050124_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-06-30+04%3A00&maxdate=2005-07-01+05%3A00&cvsroot=%2Fcvsroot

So bug 299252?

Steve England [:stevee]

Comment 10

•

19 years ago

bug 289864 comment 62 may also have relevent information.

Hermann Schwab

Comment 11

•

19 years ago

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5
TB7446516H

The browser is crashing, when the site is scrolled down. Use the cursorkeys for
scrolling: UP gives no reaction, LEFT and RIGHT scroll a bit on my 800x600 screen,
DOWN crashes after about a second. Could reproduce that yesterday on another
computer, and today once, but now no more.

Jochen

Reporter

Comment 12

•

19 years ago

Attached file crash testcase (obsolete) — Details

Testcase.

Load http://www.izarc.org/images/bg_main.png
Load the testcase -> no crash
Reload the testcase with "Shift-Reload" or clear the cache before reload ->
crash

This will only crash, if "td height" is set to >= height of bg_main.png

Jochen

Reporter

Updated

•

19 years ago

Flags: blocking-aviary1.0.5?

Hermann Schwab

Comment 13

•

19 years ago

testcase(In reply to comment #12)
> Created an attachment (id=189397) [edit]
> crash testcase

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5

 
> Load http://www.izarc.org/images/bg_main.png
> Load the testcase -> no crash
> Reload the testcase with "Shift-Reload" or clear the cache before reload ->
> crash
> 
> This will only crash, if "td height" is set to >= height of bg_main.png

bg_main.png has a height of 300px

testcase has height:300px
<td height="300" background="http://www.izarc.org/images/bg_main.png"></td>

http://www.izarc.org/ has height:257px
<td width="603" height="257" background="images/bg_main.png" align="center"
valign="top">

I could reproduce the bug before writing comment #11, when I scrolled down.
After writing comment #11, i couldn´t reproduce.

But I'm seeing a difference how http://www.izarc.org/images/bg_main.png is
displayed.
Seamonkey shows a darkgrey bottomline, while I can't see any difference betweeen
the screen and the bottomline of the image in Firefox.

Same line seen on Seamonkey when looking at izarc.org.
Firefox is showing only some pixels of that line, and a few above that.
Can attach a screenshot, if needed.

Jochen

Reporter

Comment 14

•

19 years ago

Attached image PNG for testcase — Details

PNG for testcase

Attachment #189397 - Attachment is obsolete: true

Jochen

Reporter

Comment 15

•

19 years ago

Attached file 2nd testcase — Details

As I said in my initial report, this will NOT crash always.

Alex

Comment 16

•

19 years ago

2nd testcase crashes my Fx most of the time, but http://www.izarc.org doesn't.

earthsound

Comment 17

•

19 years ago

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716
Firefox/1.0.6

Add TB7709033E & TB7709103G to the list

Just opened http://www.izarc.org & ff crashed. The 1st crash, I may have moved
the mousewheel (down), but the 2nd time I didn't do anything but load the page.

earthsound

Comment 18

•

19 years ago

should the title be changed to reflect that aviary builds after 2005-06-30-05
are affected?

cls

Comment 19

•

19 years ago

*** Bug 301839 has been marked as a duplicate of this bug. ***

Daniel Veditz [:dveditz]

Updated

•

19 years ago

Flags: blocking-aviary1.0.8? → blocking-aviary1.0.8-

Daniel Veditz [:dveditz]

Updated

•

19 years ago

Flags: blocking-aviary1.0.8- → blocking-aviary1.0.8?

Daniel Veditz [:dveditz]

Comment 20

•

19 years ago

No longer shows up as a crasher in 1.0.7, ranked #91 in 1.0.6

Flags: blocking-aviary1.0.8? → blocking-aviary1.0.8-

earthsound

Comment 21

•

18 years ago

Is this still showing up as a crasher or can we close it? The site WFM in both Firefox 1.5.x and 2.x.

Jochen

Reporter

Comment 22

•

18 years ago

Works for me with Fx 1.5.x, 2.0.x and trunk.
(1.0.x not tested... ;))

Status: REOPENED → RESOLVED

Closed: 19 years ago → 18 years ago

Resolution: --- → WORKSFORME

Nobody; OK to take it and work on it

Updated

•

16 years ago

Product: Core → Core Graveyard

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ nsImageWin::DrawTile 47966fa0]

crash testcase 19 years ago Jochen 183 bytes, text/html		Details
PNG for testcase 19 years ago Jochen 4.02 KB, image/png		Details
2nd testcase 19 years ago Jochen 197 bytes, text/html		Details