8bit alpha PNG crashes in DrawComposited24 on repaint [@ nsImageWin::DrawComposited24]

VERIFIED FIXED in mozilla0.9

Status

()

P1
critical
VERIFIED FIXED
18 years ago
16 years ago

People

(Reporter: ian, Assigned: pavlov)

Tracking

({crash, testcase, topcrash})

Trunk
mozilla0.9
x86
Windows 2000
crash, testcase, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

18 years ago
STEPS TO REPRODUCE
   1. Go to http://www.damowmow.com/mozilla/crash/11.png
   2. Drag the window off-screen.
   3. Drag the window back on-screen.

ACTUAL RESULTS
   Crash.

TESTED ON
   Windows 2000 Netscape commercial optimised build 2001032904.
   Mozilla CVS trunk debug build of around the same time.

TALKBACK REPORTS
   I filed 23 talkback reports while narrowing this crash down. 
   For example, TB28448300Q.

STACK TRACE
   When using the debug builds, here is the stack trace I got:

nsImageWin::DrawComposited24() line 585 + 24 bytes
nsImageWin::DrawComposited() line 613
nsImageWin::Draw() line 495
nsRenderingContextImpl::DrawImage() line 702 + 69 bytes
nsImageFrame::Paint() line 1014
nsContainerFrame::PaintChild() line 208
nsBlockFrame::PaintChildren() line 6573
nsBlockFrame::Paint() line 6451
nsContainerFrame::PaintChild() line 208
nsBlockFrame::PaintChildren() line 6573
nsBlockFrame::Paint() line 6451
nsContainerFrame::PaintChild() line 208
nsBlockFrame::PaintChildren() line 6573
nsBlockFrame::Paint() line 6451
nsContainerFrame::PaintChild() line 208
nsContainerFrame::PaintChildren() line 152
nsHTMLContainerFrame::Paint() line 109
PresShell::Paint() line 4845 + 34 bytes
nsView::Paint() line 277
nsViewManager::RenderDisplayListElement() line 1377
nsViewManager::RenderViews() line 1302
nsViewManager::Refresh() line 885
nsViewManager::DispatchEvent() line 1895
HandleEvent() line 68
nsWindow::DispatchEvent() line 688 + 10 bytes
nsWindow::DispatchWindowEvent() line 714
nsWindow::OnPaint() line 3794 + 28 bytes
nsWindow::ProcessMessage() line 2825 + 17 bytes
nsWindow::WindowProc() line 943 + 27 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e169a7()
USER32! 77e13eb0()
USER32! 77e16469()
USER32! 77e1a6f8()
nsWindow::WindowProc() line 950 + 31 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e169a7()
USER32! 77e13eb0()
USER32! 77e16469()
USER32! 77e1a6f8()
nsWindow::WindowProc() line 950 + 31 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run() line 408
main1() line 1021 + 32 bytes
main() line 1316 + 37 bytes
mainCRTStartup() line 338 + 17 bytes

assigning to roc+moz@cs.cmu.edu - wrote recent blender code changes
cc'ing tor@cs.brown.edu - reviewed recent blender code changes
cc'ing pavlov@netscape.com - libpr0n person
cc'ing saari@netscape.com - libpr0n person
cc'ing kmcclusk@netscape.com - might be views related
(Reporter)

Updated

18 years ago
Keywords: crash, mozilla0.9, testcase
I haven't checked in any blender code changes yet. I don't think this is mine.

Comment 2

18 years ago
Pav sez this is due to negative coordinates, giving to him
Assignee: roc+moz → pavlov

Comment 3

18 years ago
This bug is a topcrasher, added topcrash keyword.  
Added [@ nsImageWin::DrawComposited24] for tracking.  

Here are some URLs that might help repro this crash (no comments were 
available):

     (28510103) URL: 
http://tt.lament.cjb.net/index.html
     (28510109) URL: 
http://tt.lament.cjb.net/index.html
     (28510114) URL: 
http://tt.lament.cjb.net/index.html
     (28510117) URL: 
http://tt.lament.cjb.net/index.html
     (28510199) URL: 
http://tt.lament.cjb.net/weight.html
     (28513630) URL: www.libpr0n.com
     (28525180) URL: http://www.libpr0n.com
     (28563601) URL: http://www.openil.org
     (28564019) URL: http://www.openil.org
     (28574847) URL: http://www.libpr0n.org
     (28638570) URL: www.suse.com


Here's a recent stack trace:

Incident ID 28398509 
nsImageWin::DrawComposited24 
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, line 585] 
nsImageWin::DrawComposited 
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, line 613] 
nsImageWin::Draw [d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, 
line 495] 
nsRenderingContextImpl::DrawImage 
[d:\builds\seamonkey\mozilla\gfx\src\nsRenderingContextImpl.cpp, line 703] 
nsImageFrame::Paint 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1014] 
nsContainerFrame::PaintChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
208] 
nsBlockFrame::PaintChildren 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6573] 
nsBlockFrame::Paint 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6451] 
PresShell::Paint 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4847] 
nsView::Paint [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 277] 
nsViewManager::RenderDisplayListElement 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1377] 
nsViewManager::RenderViews 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1302] 
nsViewManager::Refresh [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, 
line 885] 
nsViewManager::DispatchEvent 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1895] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] 
nsWindow::DispatchEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 692] 
nsWindow::DispatchWindowEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 714] 
nsWindow::OnPaint [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, 
line 3791] 
nsWindow::ProcessMessage 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2826] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 944] 
KERNEL32.DLL + 0x363b (0xbff7363b) 
KERNEL32.DLL + 0x242e7 (0xbff942e7) 
Keywords: topcrash
Summary: 8bit alpha PNG crashes in DrawComposited24 on repaint → 8bit alpha PNG crashes in DrawComposited24 on repaint [@ nsImageWin::DrawComposited24]
(Assignee)

Comment 4

18 years ago
Ian, are you still seeing this?  I'm trying real hard to reproduce this in a 
build from 1:30am tuesday morning or so.  No luck.
(Assignee)

Updated

18 years ago
Status: NEW → ASSIGNED
Component: Views → ImageLib
Keywords: qawanted
Priority: -- → P1
Target Milestone: --- → mozilla0.9

Comment 5

18 years ago
same here with linux build 2001040908 and earlier
crashes with any png loaded
example http://www.texnik.de/images/linuxbioslogo.png

last words:

Gdk-ERROR **: BadMatch (invalid parameter attributes)
  serial 1898739 error_code 8 request_code 73 minor_code 0
(Reporter)

Comment 6

18 years ago
Huh. WORKSFORME. Good, er, work. ;-)

Since this was a topcrash, I'd appreciate it if people could check it on other
platforms and other recent builds to make sure it really is fixed. I only tested
Windows 2000 (both Mozilla Debug and Netscape Commercial Opt builds).

Comment 7

18 years ago
From the latest Talkback data, I don't see this crash anymore.
(Assignee)

Comment 8

18 years ago
yeah, its fixed.
Status: ASSIGNED → RESOLVED
Last Resolved: 18 years ago
Resolution: --- → FIXED

Comment 9

18 years ago
Marking verified in the May 24th build.
Status: RESOLVED → VERIFIED

Updated

18 years ago
Keywords: qawanted
if anyone cares, I see this crash on Netscape 7.0 final (win98) (talkback
10038759W and others as mentioned in the comments of this report), it's pretty
annoying.
Crash Signature: [@ nsImageWin::DrawComposited24]
You need to log in before you can comment on or make changes to this bug.