74087 - 8bit alpha PNG crashes in DrawComposited24 on repaint [@ nsImageWin::DrawComposited24]

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P1)

Description

[Hixie (not reading bugmail)]

STEPS TO REPRODUCE
   1. Go to http://www.damowmow.com/mozilla/crash/11.png
   2. Drag the window off-screen.
   3. Drag the window back on-screen.

ACTUAL RESULTS
   Crash.

TESTED ON
   Windows 2000 Netscape commercial optimised build 2001032904.
   Mozilla CVS trunk debug build of around the same time.

TALKBACK REPORTS
   I filed 23 talkback reports while narrowing this crash down. 
   For example, TB28448300Q.

STACK TRACE
   When using the debug builds, here is the stack trace I got:

nsImageWin::DrawComposited24() line 585 + 24 bytes
nsImageWin::DrawComposited() line 613
nsImageWin::Draw() line 495
nsRenderingContextImpl::DrawImage() line 702 + 69 bytes
nsImageFrame::Paint() line 1014
nsContainerFrame::PaintChild() line 208
nsBlockFrame::PaintChildren() line 6573
nsBlockFrame::Paint() line 6451
nsContainerFrame::PaintChild() line 208
nsBlockFrame::PaintChildren() line 6573
nsBlockFrame::Paint() line 6451
nsContainerFrame::PaintChild() line 208
nsBlockFrame::PaintChildren() line 6573
nsBlockFrame::Paint() line 6451
nsContainerFrame::PaintChild() line 208
nsContainerFrame::PaintChildren() line 152
nsHTMLContainerFrame::Paint() line 109
PresShell::Paint() line 4845 + 34 bytes
nsView::Paint() line 277
nsViewManager::RenderDisplayListElement() line 1377
nsViewManager::RenderViews() line 1302
nsViewManager::Refresh() line 885
nsViewManager::DispatchEvent() line 1895
HandleEvent() line 68
nsWindow::DispatchEvent() line 688 + 10 bytes
nsWindow::DispatchWindowEvent() line 714
nsWindow::OnPaint() line 3794 + 28 bytes
nsWindow::ProcessMessage() line 2825 + 17 bytes
nsWindow::WindowProc() line 943 + 27 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e169a7()
USER32! 77e13eb0()
USER32! 77e16469()
USER32! 77e1a6f8()
nsWindow::WindowProc() line 950 + 31 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e169a7()
USER32! 77e13eb0()
USER32! 77e16469()
USER32! 77e1a6f8()
nsWindow::WindowProc() line 950 + 31 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run() line 408
main1() line 1021 + 32 bytes
main() line 1316 + 37 bytes
mainCRTStartup() line 338 + 17 bytes

assigning to [e-mail] - wrote recent blender code changes
cc'ing [e-mail] - reviewed recent blender code changes
cc'ing [e-mail] - libpr0n person
cc'ing [e-mail] - libpr0n person
cc'ing [e-mail] - might be views related

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I haven't checked in any blender code changes yet. I don't think this is mine.

Comment 2

[saari (gone)]

Pav sez this is due to negative coordinates, giving to him

Comment 3

[Jan Carpenter]

This bug is a topcrasher, added topcrash keyword.  
Added [@ nsImageWin::DrawComposited24] for tracking.  

Here are some URLs that might help repro this crash (no comments were 
available):

     (28510103) URL: 
http://tt.lament.cjb.net/index.html
     (28510109) URL: 
http://tt.lament.cjb.net/index.html
     (28510114) URL: 
http://tt.lament.cjb.net/index.html
     (28510117) URL: 
http://tt.lament.cjb.net/index.html
     (28510199) URL: 
http://tt.lament.cjb.net/weight.html
     (28513630) URL: www.libpr0n.com
     (28525180) URL: http://www.libpr0n.com
     (28563601) URL: http://www.openil.org
     (28564019) URL: http://www.openil.org
     (28574847) URL: http://www.libpr0n.org
     (28638570) URL: www.suse.com


Here's a recent stack trace:

Incident ID 28398509 
nsImageWin::DrawComposited24 
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, line 585] 
nsImageWin::DrawComposited 
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, line 613] 
nsImageWin::Draw [d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, 
line 495] 
nsRenderingContextImpl::DrawImage 
[d:\builds\seamonkey\mozilla\gfx\src\nsRenderingContextImpl.cpp, line 703] 
nsImageFrame::Paint 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1014] 
nsContainerFrame::PaintChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
208] 
nsBlockFrame::PaintChildren 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6573] 
nsBlockFrame::Paint 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6451] 
PresShell::Paint 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4847] 
nsView::Paint [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 277] 
nsViewManager::RenderDisplayListElement 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1377] 
nsViewManager::RenderViews 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1302] 
nsViewManager::Refresh [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, 
line 885] 
nsViewManager::DispatchEvent 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1895] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] 
nsWindow::DispatchEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 692] 
nsWindow::DispatchWindowEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 714] 
nsWindow::OnPaint [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, 
line 3791] 
nsWindow::ProcessMessage 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2826] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 944] 
KERNEL32.DLL + 0x363b (0xbff7363b) 
KERNEL32.DLL + 0x242e7 (0xbff942e7) 

Comment 4

[Stuart Parmenter]

Ian, are you still seeing this?  I'm trying real hard to reproduce this in a 
build from 1:30am tuesday morning or so.  No luck.

Comment 5

[Martin Heusel]

same here with linux build 2001040908 and earlier
crashes with any png loaded
example http://www.texnik.de/images/linuxbioslogo.png

last words:

Gdk-ERROR **: BadMatch (invalid parameter attributes)
  serial 1898739 error_code 8 request_code 73 minor_code 0

Comment 6

[Hixie (not reading bugmail)]

Huh. WORKSFORME. Good, er, work. ;-)

Since this was a topcrash, I'd appreciate it if people could check it on other
platforms and other recent builds to make sure it really is fixed. I only tested
Windows 2000 (both Mozilla Debug and Netscape Commercial Opt builds).

Comment 7

[Jay Patel [:jay]]

From the latest Talkback data, I don't see this crash anymore.

Comment 8

[Stuart Parmenter]

yeah, its fixed.

Comment 9

[Chris Petersen]

Marking verified in the May 24th build.

Comment 10

[Christian :Biesinger (don't email me, ping me on IRC)]

if anyone cares, I see this crash on Netscape 7.0 final (win98) (talkback
10038759W and others as mentioned in the comments of this report), it's pretty
annoying.