Closed Bug 74066 Opened 23 years ago Closed 23 years ago

Trunk Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage] [@ gklayout.dll + 0x78c8b]

Categories

(Core :: Graphics: ImageLib, defect)

defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: slogan, Assigned: pavlov)

References

Details

(Keywords: crash, topcrash, Whiteboard: [imglib])

Crash Data

Attachments

(1 file)

This is easy to repro, and I have a good stack trace for you.

Prerequisite: you've used IM on the machine, and the signon screen is prefilled 
when you show the buddy list.

Start commercial.
Bring up IM standalone (Tasks->Instant Messenger)
Click to focus in the screen name field
Clear the entry there (backscape, whatever works)
Type in a new screen name. 
You will have crashed by now. Usually happens when I start typing in the screen 
name field.

nsImageBoxFrame::PaintImage(nsImageBoxFrame * const 0x03a99d08, nsIPresContext * 
0x07a5a6d0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 430 + 41 bytes
nsImageBoxFrame::Paint(nsImageBoxFrame * const 0x03a99d08, nsIPresContext * 
0x07a5a6d0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 401
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99d08, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99c78, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99c78, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99be8, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99be8, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99b58, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99b58, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99ac8, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99ac8, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99a38, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99a38, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a8a6f4, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
PresShell::Paint(PresShell * const 0x07ac1084, nsIView * 0x07c22520, 
nsIRenderingContext & {...}, const nsRect & {...}) line 4845 + 34 bytes
nsView::Paint(nsView * const 0x07c22520, nsIRenderingContext & {...}, const 
nsRect & {...}, unsigned int 128, int & 268593909) line 277
nsViewManager::RenderDisplayListElement(DisplayListElement2 * 0x07a80870, 
nsIRenderingContext & {...}) line 1377
nsViewManager::RenderViews(nsIView * 0x07c22520, nsIRenderingContext & {...}, 
const nsRect & {...}, int & 0) line 1302
nsViewManager::Refresh(nsIView * 0x07c22520, nsIRenderingContext * 0x07a5af20, 
const nsRect * 0x0012f698, unsigned int 1) line 885
nsViewManager::DispatchEvent(nsViewManager * const 0x07ac0240, nsGUIEvent * 
0x0012f7d8, nsEventStatus * 0x0012f6dc) line 1895
HandleEvent(nsGUIEvent * 0x0012f7d8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x07c223e4, nsGUIEvent * 0x0012f7d8, 
nsEventStatus & nsEventStatus_eIgnore) line 688 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7d8, nsEventStatus & 
nsEventStatus_eIgnore) line 714
nsWindow::OnPaint() line 3794 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x0012fbb8) line 2825 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x0067033c, unsigned int 15, unsigned int 0, long 
0) line 943 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()


#ifdef USE_IMG2
  nsCOMPtr<imgIContainer> imgCon;
  mImageRequest->GetImage(getter_AddRefs(imgCon)); <----- this line

  if (imgCon) {
    nsPoint p(rect.x, rect.y);
    aRenderingContext.DrawImage(imgCon, &rect, &p);
  }

In the above, mImageRequest is NULL. So, perhaps a nice thing to do is:

if ( mImageRequest ) {
   nsCOMPtr<imgIContainer> imgCon;
   mImageRequest->GetImage(getter_AddRefs(imgCon));

   if (imgCon) {
    nsPoint p(rect.x, rect.y);
    aRenderingContext.DrawImage(imgCon, &rect, &p);
   }
} else {
   assert( blah blah );
i also see this in composer [linux comm bit 2001.04.04.14]:

1. open composer window.
2. insert a table.
3. type some text in a cell or two.
4. select a row [dragging mouse to highlight], or double-click cell to bring up
Table Properties dialog.
5. if selected a row: bring up Table Properties dialog from menu.

result: crash.

talkback trace: Incident ID 28716677 

Build ID                 2001040414 
Product ID                 Netscape6.50 

nsImageBoxFrame::PaintImage() 
nsImageBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
PresShell::Paint() 
nsView::Paint() 
nsViewManager::RenderDisplayListElement() 
nsViewManager::RenderViews() 
nsViewManager::Refresh() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWindow::DoPaint() 
nsWindow::Update() 
nsWindow::Update() 
nsWindow::UpdateIdle() 
libglib-1.2.so.0 + 0x11139 (0x40638139) 
libglib-1.2.so.0 + 0x10186 (0x40637186) 
libglib-1.2.so.0 + 0x10751 (0x40637751) 
libglib-1.2.so.0 + 0x10804 (0x40637804) 
nsAppShell::DispatchNativeEvent() 
nsXULWindow::ShowModal() 
nsWebShellWindow::ShowModal() 
nsContentTreeOwner::ShowAsModal() 
nsWindowWatcher::OpenWindowJS() 
GlobalWindowImpl::OpenInternal() 
GlobalWindowImpl::OpenDialog() 
WindowInternalOpenDialog() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
nsXPCWrappedJSClass::CallMethod() 
nsXPCWrappedJS::CallMethod() 
PrepareAndDispatch() 
nsXPTCStubBase::Stub4() 
nsControllerCommandManager::DoCommand() 
nsEditorController::DoCommand() 
nsEditorShell::DoControllerCommand() 
nsEditorShell::HandleMouseClickOnElement() 
nsEditorShellMouseListener::MouseDown() 
nsEventListenerManager::HandleEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonPressSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x174db (0x4060a4db) 
libglib-1.2.so.0 + 0x10186 (0x40637186) 
libglib-1.2.so.0 + 0x10751 (0x40637751) 
libglib-1.2.so.0 + 0x108f1 (0x406378f1) 
libgtk-1.2.so.0 + 0x8c5b9 (0x4055f5b9) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x189cb (0x402489cb) 
OS: Windows NT → All
Hardware: PC → All
Summary: Crash in image (commercial tree) → Crash in image (commercial tree) [nsImageBoxFrame::PaintImage()]
*** Bug 74762 has been marked as a duplicate of this bug. ***
dogfood+ unless someone can explain how one would work around this.
Whiteboard: [imglib]
2001040910/Linux also crashed in nsImageBoxFrame::PaintImage().

(1) Open Search panel in sidebar.
(2) Click "Edit categories" in category selection list. The dialog doesn't
appear.
(3) Click category selection list again. Mozilla crashes.

Adding topcrash keyword and [@ nsImageBoxFrame::PaintImage] in summary for 
tracking since this is a topcrasher on the trunk.
Keywords: topcrash
Summary: Crash in image (commercial tree) [nsImageBoxFrame::PaintImage()] → Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage]
Also adding [@ gklayout.dll + 0x78c8b] to summary for tracking, since the 
talkback reports are reporting this crash under that stack signature and offset 
according to dupped bug 74762.

Here are some entries I found for that particular stack sig and offset:

gklayout.dll + 0x78c8b (0x60378c8b) 2572b540
         line 
        Build: 2001040306 CrashDate: 2001-04-04 UptimeMinutes: 1409  Total: 1409 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: bug 74762
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28681579
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28681579

gklayout.dll + 0x78c8b (0x60378c8b) 932014f3
         line 
        Build: 2001040306 CrashDate: 2001-04-04 UptimeMinutes: 42  Total: 212 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Crashed trying to drag over and type over some characters in 
the Screen Name field after I had logged off.(I wanted to switch screen anmes)
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28669687
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28669687

gklayout.dll + 0x78c8b (0x60378c8b) 692ea58e
         line 
        Build: 2001040309 CrashDate: 2001-04-03 UptimeMinutes: 52  Total: 158 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: table properties dialog launch
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28634706
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28634706

gklayout.dll + 0x78c8b (0x60378c8b) 932014f3
         line 
        Build: 2001040306 CrashDate: 2001-04-03 UptimeMinutes: 62  Total: 62 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Crash swicthing screen names. Calssic
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28624830
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28624830
Summary: Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage] → Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage] [@ gklayout.dll + 0x78c8b]
Adding Trunk in the summary for tracking
Summary: Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage] [@ gklayout.dll + 0x78c8b] → Trunk Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage] [@ gklayout.dll + 0x78c8b]
This crash has not shown up in Talkback reports for a while, I'm assuming it was 
a similar crash to the one reported in bug 74017 (which has been fixed).  So 
resolving this fixed.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
terri, can you go reproduce this again and if it's not crashing for you, go 
ahead and verify this fixed?  thanks.
Verified no crash mac build 2001050208, linux build 2001050208, windows build 
2001050212
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsImageBoxFrame::PaintImage] [@ gklayout.dll + 0x78c8b]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: