408310 - 20071213 trunk crash when visiting protopage.com @ all platforms

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P2)

Description

[cris]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b2pre) Gecko/2007121017 Minefield/3.0b2pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b3pre) Gecko/2007121304 Minefield/3.0b3pre

everything was fine with all previous nightly build, but 2007121304 build crash everytime when I visit protopage.com, on all platforms, windiws vista, mac osx tiger, linux (PCLinuxOS4, EEEpc-xandros-easy mode). something changed about how javascripts are interpreted? 

Reproducible: Always

Steps to Reproduce:
1.goto www.protopage.com
2.firefox crashes
Actual Results:  
firefoc crashes

Expected Results:  
should display page properly, as all previous version (release or nightly build)

Comment 1

[philippe (part-time)]

based on hourly builds:
stable: 20071212_0853
crashes: 20071212_0923

http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1197478380&maxdate=1197480179

bug 406626 ? or bug 403578 ?

Comment 2

[philippe (part-time)]

Some Breakpad reports
http://crash-stats.mozilla.com/report/index/a81342ba-aa00-11dc-81a5-001a4bd43ed6?date=2007-12-14-04
http://crash-stats.mozilla.com/report/index/71034575-a9ff-11dc-af1f-001a4bd46e84?date=2007-12-14-04
http://crash-stats.mozilla.com/report/index/52586dc5-aa02-11dc-b6ca-001a4bd43ed6?date=2007-12-14-05

Comment 3

[Mats Palmgren (inactive)]

Backing out bug 403578 fixes the crash for me (Firefox debug build on Linux).

Comment 4

[Alfred Kayser]

Found the issue. For GIF's with a tpixel outside the valid colormap, the realDepth was adjusted, but still for local_colormap the old value was used. And, the memset to clear the extra space in the colormap was also coded wrong, causing the actual crash.
Patch coming up...

Comment 5

[Alfred Kayser]

Attachment: V1: Make sure to use the right paletteSize to prevent crashes...

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Confirming that neither the page from this bug nor the page from bug 408444 crashes with the v1 patch applied to the current trunk on XPSP2.

Comment 8

[Reed Loden [:reed]]

Checking in modules/libpr0n/src/imgContainer.cpp;
/cvsroot/mozilla/modules/libpr0n/src/imgContainer.cpp,v  <--  imgContainer.cpp
new revision: 1.62; previous revision: 1.61
done

Comment 9

[Reed Loden [:reed]]

Er, the last comment was for the wrong bug. This the correct commit log:

Checking in modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp;
/cvsroot/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp,v  <--  nsGIFDecoder2.cpp
new revision: 1.89; previous revision: 1.88
done

Comment 11

[Alfred Kayser]

Confirmed that with this patch is doesn't crash anymore:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3pre) Gecko/2007122005 Minefield/3.0b3pre