359589 - crash [@ _cairo_win32_surface_create_similar_internal]

Status: RESOLVED DUPLICATE of bug 374272

(Core :: Graphics, defect)

Description

[Brian Polidoro]

A crash occurs from just loading this page of animated gifs.  I'll try and see if I can find if there's a gif in particular that causes the problem.  

Incident ID: 24945183
Stack Signature	_cairo_win32_surface_create_similar_internal 121b0015
Product ID	FirefoxTrunk
Build ID	2006102304
Trigger Time	2006-10-23 15:05:30.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00547b5f)
URL visited	http://tfcgaschamber.com/quick_reply.php?mode=smilies
User Comments	
Since Last Crash	224 sec
Total Uptime	27308 sec
Trigger Reason	Access violation
Source File, Line No.	c:\builds\tinderbox\fx-trunk-cairo\winnt_5.2_depend\mozilla\gfx\cairo\cairo\src\cairo-win32-surface.c, line 404
Stack Trace 	
_cairo_win32_surface_create_similar_internal  [mozilla\gfx\cairo\cairo\src\cairo-win32-surface.c, line 404]
_cairo_win32_surface_create_similar  [mozilla\gfx\cairo\cairo\src\cairo-win32-surface.c, line 416]
_cairo_surface_create_similar_solid  [mozilla\gfx\cairo\cairo\src\cairo-surface.c, line 357]
_moz_cairo_surface_create_similar  [mozilla\gfx\cairo\cairo\src\cairo-surface.c, line 341]
_moz_cairo_push_group_with_content  [mozilla\gfx\cairo\cairo\src\cairo.c, line 422]
gfxContext::PushGroup  [mozilla\gfx\thebes\src\gfxcontext.cpp, line 641]

Comment 1

[Brian Polidoro]

I tried each of the gifs individually but none resulted in a crash.  And loading the page with images turned off still crashes.  

Comment 2

[timeless]

i think i filed this bug against cairo.
https://bugs.freedesktop.org/show_bug.cgi?id=8829

"not our fault" <imo>cairo sucks

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

(In reply to comment #2)
> i think i filed this bug against cairo.
> https://bugs.freedesktop.org/show_bug.cgi?id=8829
> 
> "not our fault" <imo>cairo sucks

Don't be an asshole.

In any case, the patch is right, I'll get it checked in.. but as Owen said in the fd.o bug, if that call is failing there's something else going on.

Comment 4

[timeless]

watch your language. you're responsible for crashing my browser which had valuable data, i'm entitled to express my opinion which i reached based on reading source which i feel is indeed poor.

your language however is unjustifiable.

Comment 5

[Kevin Brosnan]

*** Bug 357822 has been marked as a duplicate of this bug. ***

Comment 6

[gabe]

https://bugs.freedesktop.org/attachment.cgi?id=7665&action=diff

anybody care too check taht in as temporary fix since i cracsh about once every 2 days with this bug

Comment 7

[gabe]

TB27225177Y

Comment 8

[Martijn Wargers (dead)]

Bug 348644 is probably the same as this one, it just has a different way of triggering the crash.

Comment 9

[Brian Polidoro]

With the landing of bug 361592 this crash has changed.  Should a new bug be filed and this bug closed?  Here's the crash report from build 2007011714:

Incident ID: 28461269
Stack Signature	_cairo_gstate_init_copy cc39fcbb
Product ID	FirefoxTrunk
Build ID	2007011704
Trigger Time	2007-01-17 18:45:14.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00516dac)
URL visited	
User Comments	
Since Last Crash	120 sec
Total Uptime	177 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\cairo\cairo\src\cairo-gstate.c, line 158
Stack Trace 	
_cairo_gstate_init_copy  [mozilla\gfx\cairo\cairo\src\cairo-gstate.c, line 158]
_cairo_gstate_init_copy  [mozilla\gfx\cairo\cairo\src\cairo-gstate.c, line 172]
_moz_cairo_matrix_transform_distance  [mozilla\gfx\cairo\cairo\src\cairo-matrix.c, line 333]
_moz_cairo_matrix_transform_bounding_box  [mozilla\gfx\cairo\cairo\src\cairo-matrix.c, line 383]
_moz_cairo_translate  [mozilla\gfx\cairo\cairo\src\cairo.c, line 1042]
gfxContext::CurrentSurface  [mozilla\gfx\thebes\src\gfxcontext.cpp, line 85]

Comment 10

[Brian Polidoro]

So much for my previous comment.  With the two nightly builds since then I don't get the init_copy crash.  I get the c_s_i crash again.  

Comment 11

[Doug Wright]

Attachment: Somewhat minimised testcase

I've managed to create a mostly-reduced testcase for this.

Steps to reproduce:

1) Load testcase (quite likely to crash)
2) Hit F5 (crashes every time)

Comment 12

[Frank Wein [:mcsmurf]]

I have the feeling that this crasher appears somewhat often on trunk recently for me. I cannot prove this with numbers though.

Comment 13

[Doug Wright]

Tentatively forward-duping this against bug 374272.

Comment 14

[Jesse Ruderman]

This did end up being fixed by bug 374272, right?  :)