444121 - canvas crash during resize on some magic sizes

Status: RESOLVED INCOMPLETE

(Core Graveyard :: GFX, defect)

Description

[Sergey Zh]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9) Gecko/2008052912 Firefox/3.0
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9) Gecko/2008052912 Firefox/3.0

Resizing canvas from js usually works, but CRASHes on some magic width and height values ( 13000 and 20000 on FF3 on my computer , 16000 on FF3.1alfa on my comp). Html with javascript , which generates crash attached.


Reproducible: Always

Steps to Reproduce:
1. Open attached file

Actual Results:  
firefox crash

Expected Results:  
canvas resize

Comment 1

[Sergey Zh]

Attachment: cycle through sizes, to find the "crash" sizes

Comment 2

[Sergey Zh]

Also crashes Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1a1pre) Gecko/2008070502 Minefield/3.1a1pre

Comment 3

[Sergey Zh]

Please wait 1 minute when running attached example , until your firefox crashes.

Comment 4

[Mats Palmgren (inactive)]

Did you submit crash data with Crash Reporter?
http://support.mozilla.com/en-US/kb/Mozilla+Crash+Reporter

If you start Firefox from a Terminal window do you see any error messages?

Comment 5

[Sergey Zh]

(In reply to comment #4)
> Did you submit crash data with Crash Reporter?
> http://support.mozilla.com/en-US/kb/Mozilla+Crash+Reporter
> 
> If you start Firefox from a Terminal window do you see any error messages?
 
I started with clean ~/.mozilla/, with the same crash result. Crash Reporter did NOT appear after crash. 
From terminal window:
# /opt/firefox/firefox
The program 'firefox-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 322400 error_code 11 request_code 53 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

Comment 6

[Mats Palmgren (inactive)]

Thanks for testing.  I can't reproduce it with the 2008070502 build so it's
probably dependent on X server.  Hopefully it will be fixed by bug 424333,
feel free to try the patch there if you do your own builds.

Comment 7

[Daniel Holbert [:dholbert]]

I couldn't reproduce the crash with attachment 328505 [details], either, after giving it a few minutes.

It did make Xorg progressively suck up all my memory, though.  I killed Firefox when Xorg was using 82% of my memory (according to 'top') because my machine was becoming unresponsive.

82% * 2 gigs memory = 1.64 gigs were being used.

I'm running:
 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9) Gecko/2008052912 Firefox/3.0
 Ubuntu Linux 8.04

Comment 8

[Sergey Zh]

This bug happens on OpenSuse 10.3  ( xorg-x11-7.2-135.4 ) with vanilla mozilla.org FF3.0 and FF3.1alfa.

When I rebooted to Ubuntu 8.04 (Xorg 1.4.1 ; 7.3 ) with distro FF3.0 - this bug did not happen on attached example, though FF was killed due to memory pressure within ~30 sec (I have 1GB ram).

I modified attachment a little bit , and got FF3 in Ubuntu 8.04 crashing too. 
Again there is some magic - if resize start from  10000: 
onload="canv_resize(1)"  - it crashes quickly  ( 10000, 20000, ... 490 000, 500 000)
if from 50000:
onload="canv_resize(5)"  - ff does not crash ( 50000, 60000, ... 490 000, 500 000)

terminal:
# firefox
debugger.onModuleDeactivate Attempt to deactive context that is not active http://localhost/moz_canvas_bug.html
The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 27126 error_code 11 request_code 53 minor_code 0)

# firefox
debugger.onModuleDeactivate Attempt to deactive context that is not active http://localhost/moz_canvas_bug.html
The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'RenderBadPicture (invalid Picture parameter)'.
  (Details: serial 11323 error_code 182 request_code 155 minor_code 8)

Comment 9

[Sergey Zh]

Attachment: This example crash FF in Ubuntu 8.04

previous attachment did not crash FF in Ubuntu 8.04, so adding this one. 
Here step in javascript increased from 1000 to 10000.

Comment 10

[Sergey Zh]

after more digging -  the second example  crashes FF3(distro) in Ubuntu when running KDE 3.5. 
When I login into Gnome - FF does not crash , it gets Killed due to memory pressure.