319357 - Crash in browser when attempting to print a text selection [@ nsImageWin::DrawTile]

Status: RESOLVED FIXED

(Core Graveyard :: GFX: Win32, defect)

Description

[u178260]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

When I try to print a selection of text as opposed to the whole page by using the File > Print dialog, Firefox crashes and brings up the Talkback crash reporter.

Reproducible: Always

Steps to Reproduce:
1. Go to the URL http://evhead.com/2005/11/ten-rules-for-web-startups.asp
2. Select the body text from the title all the way down to where the "links to this post" section starts.
3. Go to File > Print...
4. Click the "Selection" radio box under "Print range" after selecting your printer.
5. Click OK.
Actual Results:  
Firefox crashes and brings up an "Application Error" (I will try to attach a screenshot) as well as the Talkback error reporter.

Expected Results:  
The selection of text should be printed in full.

The application error dialog box reads:

firefox.exe - Application Error
The instruction at "0x004e18ed" referenced memory at "0x03a2cfa8". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

[OK] [Cancel]

---

about:buildconfig

Build platform
target
i586-pc-msvc

Build tools
Compiler 	Version 	Compiler flags
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TC -nologo -W3 -Gy -Fd$(PDBFILE)
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TP -nologo -W3 -Gy -Fd$(PDBFILE)

Configure arguments
--enable-application=browser --enable-update-channel=release --enable-optimize --disable-debug --disable-tests --enable-static --disable-shared --enable-official-branding --enable-svg --enable-canvas --enable-update-packaging

Comment 1

[u178260]

Attachment: Application error dialog screenshot

This is a screenshot of the application error dialog that comes up.

Comment 2

[Adam Guthrie]

Please make sure you're using the mozilla quality feedback agent (talkback) and not Microsoft's. MS's won't give us any useful information. If you don't have talkback installed you can find out how to do so here: http://kb.mozillazine.org/Talkback

Comment 3

[u178260]

Yes, I have sent a couple of quality feedback items using Talkback when Firefox has crashed - but the attached error message comes up as well as Talkback; I thought it might be useful to include it.

Comment 4

[Adam Guthrie]

Please post the talkback IDs of the crash. You can get them by opening up talkback.exe that's located in the main program directory under /extensions/talkback

Comment 5

[u178260]

The Talkback IDs are TB12676468X and TB12676543X sent on 06/12/2005 at 21:53 and 21:55 respectively. Hope this helps.

Comment 6

[Adam Guthrie]

This is the #9 topcrasher for Firefox15 on talkback. 

Incident ID: 12676468
Stack Signature	nsImageWin::DrawTile 2c33fb40
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2005-12-06 13:53:19.0
Platform	Win32
Operating System	Windows NT 5.2 build 3790
Module	firefox.exe + (000e18ed)
URL visited	
User Comments	
Since Last Crash	215930 sec
Total Uptime	215930 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp, line 960
Stack Trace 	
nsImageWin::DrawTile  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp, line 960]
nsRenderingContextImpl::DrawTile  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/shared/nsRenderingContextImpl.cpp, line 425]
nsFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 903]
nsImageFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsImageFrame.cpp, line 1490]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintFloats  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6330]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6266]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsTableCellFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableCellFrame.cpp, line 440]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsTableRowFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowFrame.cpp, line 561]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsTableRowGroupFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 229]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsTableFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1357]
nsTableFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1419]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsTableOuterFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 334]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsContainerFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 209]
nsPageContentFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsPageContentFrame.cpp, line 192]
PresShell::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5808]
nsView::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 316]
nsViewManager::RenderDisplayListElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1460]
nsViewManager::RenderViews  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1375]
nsViewManager::Display  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 3612]
nsSimplePageSequenceFrame::PrintNextPage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp, line 880]
nsPrintEngine::PrintPage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 3550]

Comment 7

[Martijn Wargers (dead)]

Is this still an issue in current trunk builds?

Comment 8

[Marc]

For additional TB incident.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB13490373G
The actual url was not my.yahoo.com but expedia.com. Trying to print a selection of airlines flights and times and prices for travel.

Comment 9

[Martijn Wargers (dead)]

There is reason to believe this could be fixed by bug 312415. Can anyone who experiences this bug, check with trunk (not 1.5 branch) builds if this was fixed at or after 2005-11-29 (that was the day the fix for bug 312415 got in the tree).

Comment 10

[u178260]

I installed Deer Park 2 Alpha (Deer Park 1.6a1, Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9a1) Gecko/20060104 Firefox/1.6a1) and can no longer reproduce the bug, so it seems to have been fixed in Deer Park.

For those who cannot reproduce it, try scrolling down the page until you get to "Links to this post". Then start selecting from the email icon and go up, selecting everything up to and including the evhead logo. This will also select the sidebar, and seems to be even more reliable at crashing Firefox 1.5.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment 10 doesn't answer the question in comment 9 (testing the wrong build date).

Comment 12

[u178260]

I'm not completely familiar with Mozilla trunk builds. Either someone with more knowledge of trunk build could test this, or if someone can point out a relevant Windows-compiled trunk binary, I'll test it.

Comment 13

[Martijn Wargers (dead)]

Ruben, you can download the 2005-11-29 build here:
http://archive.mozilla.org/pub/firefox/nightly/2005-11-29-05-trunk/
And the 2005-11-30 build here:
http://archive.mozilla.org/pub/firefox/nightly/2005-11-30-05-trunk/
If you could test this, that would be great.

Comment 14

[u178260]

Martijn, thanks for the links. I have tested both trunk builds. 2005-11-29 still has this bug; 2005-11-30 seems to have fixed it so the fix is probably a good side-effect of bug 312415 as far as I can see.

Comment 15

[Daniel Veditz [:dveditz]]

Need verification that this is fixed on the trunk, and that 312415 is a probable cause.

Comment 16

[Boris Zbarsky [:bzbarsky]]

I just landed bug 312415 on the branch.  Did this go away there?

Comment 17

[u178260]

I've tested the newest 2006-01-09 nightly and the bug has definitely disappeared. Is there anything else I should test?

Comment 18

[Martijn Wargers (dead)]

You've tested the 2006-01-09 branch build and it doesn't crash, while the 2006-01-08 branch build does crash?
If that's the case, then this bug can be resolved->fixed.

Comment 19

[u178260]

I checked where Boris had checked in the patch and tested versions around that time. 2006-01-08 and before have the bug. 2006-01-09 seems to have it intermittantly, every second time the browser is opened it seems. These are the builds labelled "Mozilla Firefox". I've also tried ones labelled "Deer Park 2" and they don't have this bug at all. Make of that what you will...

Comment 20

[Martijn Wargers (dead)]

Well, probably you need to test with the 2006-01-10 branch builds, as the 2006-01-09 probably doesn't have the fix yet.
(sorry that I have to keep asking)

Comment 21

[u178260]

Right - I want to get this bug closed for good! I've tested every single 2006-01-10 build and the bug is not present. Hopefully this means that it's gone away for good...

Comment 22

[Julian D. A. Wiseman]

(In reply to comment #21)
> I've tested every single 2006-01-10 build and the bug is not present. 

Please also test bug 322829 using the same builds, which is hypothesised to be a relative of this bug. Thanks. 

Comment 23

[Martijn Wargers (dead)]

*** Bug 322829 has been marked as a duplicate of this bug. ***

Comment 24

[Martijn Wargers (dead)]

Ok, based on comment 14 and comment 21, I'm going to mark this bug fixed.
If anyone can still reproduce this bug with branch builds from 2006-01-10 or later, then please reopen this bug.

Comment 25

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Note that dveditz removed blocking1.8.1 and blocking1.8.0.1 nominations.

We see no evidence that this bug is not fixed for those releases by the checkin of bug 312415.  If it's actually not fixed for those releases, we probably would consider *approval* requests for whatever did fix it (although probably for 1.8.0.2).

Comment 26

[Adam Guthrie]

*** Bug 324204 has been marked as a duplicate of this bug. ***