74066 - Trunk Crash in image (commercial tree) [@ nsImageBoxFrame::PaintImage] [@ gklayout.dll + 0x78c8b]

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Syd Logan]

This is easy to repro, and I have a good stack trace for you.

Prerequisite: you've used IM on the machine, and the signon screen is prefilled 
when you show the buddy list.

Start commercial.
Bring up IM standalone (Tasks->Instant Messenger)
Click to focus in the screen name field
Clear the entry there (backscape, whatever works)
Type in a new screen name. 
You will have crashed by now. Usually happens when I start typing in the screen 
name field.

nsImageBoxFrame::PaintImage(nsImageBoxFrame * const 0x03a99d08, nsIPresContext * 
0x07a5a6d0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 430 + 41 bytes
nsImageBoxFrame::Paint(nsImageBoxFrame * const 0x03a99d08, nsIPresContext * 
0x07a5a6d0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 401
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99d08, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99c78, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99c78, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99be8, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99be8, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99b58, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99b58, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99ac8, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99ac8, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a99a38, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
nsBoxFrame::PaintChild(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & {...}, 
const nsRect & {...}, nsIFrame * 0x03a99a38, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1371
nsBoxFrame::PaintChildren(nsIPresContext * 0x07a5a6d0, nsIRenderingContext & 
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 
1507
nsBoxFrame::Paint(nsBoxFrame * const 0x03a8a6f4, nsIPresContext * 0x07a5a6d0, 
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer 
eFramePaintLayer_Overlay) line 1325
PresShell::Paint(PresShell * const 0x07ac1084, nsIView * 0x07c22520, 
nsIRenderingContext & {...}, const nsRect & {...}) line 4845 + 34 bytes
nsView::Paint(nsView * const 0x07c22520, nsIRenderingContext & {...}, const 
nsRect & {...}, unsigned int 128, int & 268593909) line 277
nsViewManager::RenderDisplayListElement(DisplayListElement2 * 0x07a80870, 
nsIRenderingContext & {...}) line 1377
nsViewManager::RenderViews(nsIView * 0x07c22520, nsIRenderingContext & {...}, 
const nsRect & {...}, int & 0) line 1302
nsViewManager::Refresh(nsIView * 0x07c22520, nsIRenderingContext * 0x07a5af20, 
const nsRect * 0x0012f698, unsigned int 1) line 885
nsViewManager::DispatchEvent(nsViewManager * const 0x07ac0240, nsGUIEvent * 
0x0012f7d8, nsEventStatus * 0x0012f6dc) line 1895
HandleEvent(nsGUIEvent * 0x0012f7d8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x07c223e4, nsGUIEvent * 0x0012f7d8, 
nsEventStatus & nsEventStatus_eIgnore) line 688 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7d8, nsEventStatus & 
nsEventStatus_eIgnore) line 714
nsWindow::OnPaint() line 3794 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x0012fbb8) line 2825 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x0067033c, unsigned int 15, unsigned int 0, long 
0) line 943 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()


#ifdef USE_IMG2
  nsCOMPtr<imgIContainer> imgCon;
  mImageRequest->GetImage(getter_AddRefs(imgCon)); <----- this line

  if (imgCon) {
    nsPoint p(rect.x, rect.y);
    aRenderingContext.DrawImage(imgCon, &rect, &p);
  }

In the above, mImageRequest is NULL. So, perhaps a nice thing to do is:

if ( mImageRequest ) {
   nsCOMPtr<imgIContainer> imgCon;
   mImageRequest->GetImage(getter_AddRefs(imgCon));

   if (imgCon) {
    nsPoint p(rect.x, rect.y);
    aRenderingContext.DrawImage(imgCon, &rect, &p);
   }
} else {
   assert( blah blah );

Comment 1

[Syd Logan]

Attachment: patch that may help defer the problem and keep the tree open

Comment 2

[sairuh (rarely reading bugmail)]

i also see this in composer [linux comm bit 2001.04.04.14]:

1. open composer window.
2. insert a table.
3. type some text in a cell or two.
4. select a row [dragging mouse to highlight], or double-click cell to bring up
Table Properties dialog.
5. if selected a row: bring up Table Properties dialog from menu.

result: crash.

talkback trace: Incident ID 28716677 

Build ID                 2001040414 
Product ID                 Netscape6.50 

nsImageBoxFrame::PaintImage() 
nsImageBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
nsBoxFrame::PaintChild() 
nsBoxFrame::PaintChildren() 
nsBoxFrame::Paint() 
PresShell::Paint() 
nsView::Paint() 
nsViewManager::RenderDisplayListElement() 
nsViewManager::RenderViews() 
nsViewManager::Refresh() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWindow::DoPaint() 
nsWindow::Update() 
nsWindow::Update() 
nsWindow::UpdateIdle() 
libglib-1.2.so.0 + 0x11139 (0x40638139) 
libglib-1.2.so.0 + 0x10186 (0x40637186) 
libglib-1.2.so.0 + 0x10751 (0x40637751) 
libglib-1.2.so.0 + 0x10804 (0x40637804) 
nsAppShell::DispatchNativeEvent() 
nsXULWindow::ShowModal() 
nsWebShellWindow::ShowModal() 
nsContentTreeOwner::ShowAsModal() 
nsWindowWatcher::OpenWindowJS() 
GlobalWindowImpl::OpenInternal() 
GlobalWindowImpl::OpenDialog() 
WindowInternalOpenDialog() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
nsXPCWrappedJSClass::CallMethod() 
nsXPCWrappedJS::CallMethod() 
PrepareAndDispatch() 
nsXPTCStubBase::Stub4() 
nsControllerCommandManager::DoCommand() 
nsEditorController::DoCommand() 
nsEditorShell::DoControllerCommand() 
nsEditorShell::HandleMouseClickOnElement() 
nsEditorShellMouseListener::MouseDown() 
nsEventListenerManager::HandleEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonPressSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x174db (0x4060a4db) 
libglib-1.2.so.0 + 0x10186 (0x40637186) 
libglib-1.2.so.0 + 0x10751 (0x40637751) 
libglib-1.2.so.0 + 0x108f1 (0x406378f1) 
libgtk-1.2.so.0 + 0x8c5b9 (0x4055f5b9) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x189cb (0x402489cb) 

Comment 3

[sairuh (rarely reading bugmail)]

*** Bug 74762 has been marked as a duplicate of this bug. ***

Comment 4

[selmer (gone)]

dogfood+ unless someone can explain how one would work around this.

Comment 5

[Koike Kazuhiko]

2001040910/Linux also crashed in nsImageBoxFrame::PaintImage().

(1) Open Search panel in sidebar.
(2) Click "Edit categories" in category selection list. The dialog doesn't
appear.
(3) Click category selection list again. Mozilla crashes.

Comment 6

[Jay Patel [:jay]]

Adding topcrash keyword and [@ nsImageBoxFrame::PaintImage] in summary for 
tracking since this is a topcrasher on the trunk.

Comment 7

[Jay Patel [:jay]]

Also adding [@ gklayout.dll + 0x78c8b] to summary for tracking, since the 
talkback reports are reporting this crash under that stack signature and offset 
according to dupped bug 74762.

Here are some entries I found for that particular stack sig and offset:

gklayout.dll + 0x78c8b (0x60378c8b) 2572b540
         line 
        Build: 2001040306 CrashDate: 2001-04-04 UptimeMinutes: 1409  Total: 1409 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: bug 74762
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28681579
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28681579

gklayout.dll + 0x78c8b (0x60378c8b) 932014f3
         line 
        Build: 2001040306 CrashDate: 2001-04-04 UptimeMinutes: 42  Total: 212 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Crashed trying to drag over and type over some characters in 
the Screen Name field after I had logged off.(I wanted to switch screen anmes)
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28669687
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28669687

gklayout.dll + 0x78c8b (0x60378c8b) 692ea58e
         line 
        Build: 2001040309 CrashDate: 2001-04-03 UptimeMinutes: 52  Total: 158 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: table properties dialog launch
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28634706
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28634706

gklayout.dll + 0x78c8b (0x60378c8b) 932014f3
         line 
        Build: 2001040306 CrashDate: 2001-04-03 UptimeMinutes: 62  Total: 62 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Crash swicthing screen names. Calssic
         Detailed : http://cyclone/reports/incidenttemplate.cfm?bbid=28624830
         StackTrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=28624830

Comment 8

[greer]

Adding Trunk in the summary for tracking

Comment 9

[Jay Patel [:jay]]

This crash has not shown up in Talkback reports for a while, I'm assuming it was 
a similar crash to the one reported in bug 74017 (which has been fixed).  So 
resolving this fixed.

Comment 10

[Jay Patel [:jay]]

terri, can you go reproduce this again and if it's not crashing for you, go 
ahead and verify this fixed?  thanks.

Comment 11

[Terri Preston]

Verified no crash mac build 2001050208, linux build 2001050208, windows build 
2001050212