300504 - Latest Fx 1.0.5 crashes on www.izarc.org [@ nsImageWin::DrawTile 47966fa0]

Status: RESOLVED WORKSFORME

(Core Graveyard :: GFX: Win32, defect)

Description

[Jochen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Goto http://www.izarc.org/ and 1.0.5 builds newer than 2005-30-06 will often crash.

2005-06-29-04-aviary1.0.1.win32 is ok.
2005-07-01-05-aviary1.0.1.win32 will often (not always!) crash.

Talkback: TB7413189

Bug 284716 ?

No problems with current trunk.


Reproducible: Always

Comment 1

[Carsten Book [:Tomcat]]

Confirmend with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.9)
Gecko/20050712 Firefox/1.0.5

Comment 2

[Carsten Book [:Tomcat]]

Talkback ID TB7417947M

Stack Signature nsImageWin::DrawTile 47966fa0 
Product ID Firefox10 
Build ID 2005071204 
Trigger Time 2005-07-12 10:04:13.0 
Platform Win32 
Operating System Windows NT 5.0 build 2195 
Module firefox.exe + (000e1dd8) 
URL visited Bug 300504 
User Comments  
Since Last Crash 21 sec 
Total Uptime 21 sec 
Trigger Reason Access violation 
Source File, Line No.
c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp,
line 955 
Stack Trace  

nsImageWin::DrawTile 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp,
line 955]
nsRenderingContextImpl::DrawTile 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/gfx/src/shared/nsRenderingContextImpl.cpp,
line 927]
nsCSSRendering::PaintBackgroundWithSC 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3243]
nsCSSRendering::PaintBackground 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 2747]
nsTableCellFrame::PaintUnderlay 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 388]
nsTableCellFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 428]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableRowFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 570]
nsTableRowGroupFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 287]
nsTableRowGroupFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 235]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1383]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1456]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 349]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableCellFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 476]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableRowFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 570]
nsTableRowGroupFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 287]
nsTableRowGroupFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 235]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1383]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1456]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 349]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableCellFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 476]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableRowFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 570]
nsTableRowGroupFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 287]
nsTableRowGroupFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 235]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsTableFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1383]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1456]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 349]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]

Comment 3

[Carsten Book [:Tomcat]]

FF 1.0.5 Crashs here seconds after i go to this page.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Related bugs:
bug 299252
bug 284716 (r=pavlov,sr=tor)
bug 284978 (r=ere,sr=bz)
bug 289864

Range:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=AviaryBranchTinderbox&branch=AVIARY_1_0_1_20050124_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-06-29+04%3A00&maxdate=2005-07-01+05%3A00&cvsroot=%2Fcvsroot

Comment 5

[Zach Lipton [:zach]]

This is fixed on the trunk. If you can reproduce with the latest nightly build
on the trunk, please reopen. 

->WORKSFORME

Comment 6

[Frank Wein [:mcsmurf]]

zach: Pleeeease read the bug before :), this seems like a branch-only regression

Comment 7

[Steve England [:stevee]]

Can't crash. New Profile, Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Can crash. New Profile, Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.7.9) Gecko/20050709 Firefox/1.0.5
TBID TB7420110M

Comment 8

[Tracy Walker [:tracy]]

a sligtly narrower window (though initially implied as such)

2005-06-30-05-aviary1.0.1 does not crash
2005-07-01-05-aviary1.0.1 crashes

Comment 9

[Steve England [:stevee]]

From comment 8

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=AviaryBranchTinderbox&branch=AVIARY_1_0_1_20050124_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-06-30+04%3A00&maxdate=2005-07-01+05%3A00&cvsroot=%2Fcvsroot

So bug 299252?

Comment 10

[Steve England [:stevee]]

bug 289864 comment 62 may also have relevent information.

Comment 11

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5
TB7446516H

The browser is crashing, when the site is scrolled down. Use the cursorkeys for
scrolling: UP gives no reaction, LEFT and RIGHT scroll a bit on my 800x600 screen,
DOWN crashes after about a second. Could reproduce that yesterday on another
computer, and today once, but now no more.

Comment 12

[Jochen]

Attachment: crash testcase

Testcase.

Load http://www.izarc.org/images/bg_main.png
Load the testcase -> no crash
Reload the testcase with "Shift-Reload" or clear the cache before reload ->
crash

This will only crash, if "td height" is set to >= height of bg_main.png

Comment 13

[Hermann Schwab]

testcase(In reply to comment #12)
> Created an attachment (id=189397) [edit]
> crash testcase

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5

 
> Load http://www.izarc.org/images/bg_main.png
> Load the testcase -> no crash
> Reload the testcase with "Shift-Reload" or clear the cache before reload ->
> crash
> 
> This will only crash, if "td height" is set to >= height of bg_main.png

bg_main.png has a height of 300px

testcase has height:300px
<td height="300" background="http://www.izarc.org/images/bg_main.png"></td>

http://www.izarc.org/ has height:257px
<td width="603" height="257" background="images/bg_main.png" align="center"
valign="top">

I could reproduce the bug before writing comment #11, when I scrolled down.
After writing comment #11, i couldn´t reproduce.

But I'm seeing a difference how http://www.izarc.org/images/bg_main.png is
displayed.
Seamonkey shows a darkgrey bottomline, while I can't see any difference betweeen
the screen and the bottomline of the image in Firefox.

Same line seen on Seamonkey when looking at izarc.org.
Firefox is showing only some pixels of that line, and a few above that.
Can attach a screenshot, if needed.

Comment 14

[Jochen]

Attachment: PNG for testcase

PNG for testcase

Comment 15

[Jochen]

Attachment: 2nd testcase

As I said in my initial report, this will NOT crash always.

Comment 16

[Alex]

2nd testcase crashes my Fx most of the time, but http://www.izarc.org doesn't.

Comment 17

[earthsound]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716
Firefox/1.0.6

Add TB7709033E & TB7709103G to the list

Just opened http://www.izarc.org & ff crashed. The 1st crash, I may have moved
the mousewheel (down), but the 2nd time I didn't do anything but load the page. 

Comment 18

[earthsound]

should the title be changed to reflect that aviary builds after 2005-06-30-05
are affected?

Comment 19

[cls]

*** Bug 301839 has been marked as a duplicate of this bug. ***

Comment 20

[Daniel Veditz [:dveditz]]

No longer shows up as a crasher in 1.0.7, ranked #91 in 1.0.6

Comment 21

[earthsound]

Is this still showing up as a crasher or can we close it? The site WFM in both Firefox 1.5.x and 2.x.

Comment 22

[Jochen]

Works for me with Fx 1.5.x, 2.0.x and trunk.
(1.0.x not tested... ;))