NGLayout loads the URL, renders the text very, very small, and then crashes. My stack trace makes it sound like something to do with the Intel image code optimizations, but what do I know? h2v2_merged_upsample_mmx(jpeg_decompress_struct * 0x0179d6f8, unsigned char * * * 0x01828210, unsigned int 0, unsigned char * * 0x0012fca0) line 606 h2v2_merged_upsample(jpeg_decompress_struct * 0x0179d6f8, unsigned char * * * 0x01828210, unsigned int 0, unsigned char * * 0x0012fca0) line 326 + 21 bytes merged_2v_upsample(jpeg_decompress_struct * 0x0179d6f8, unsigned char * * * 0x01828210, unsigned int * 0x0182823c, unsigned int 8, unsigned char * * 0x01826910, unsigned int * 0x0012fd08, unsigned int 1) line 194 + 24 bytes process_data_simple_main(jpeg_decompress_struct * 0x0179d6f8, unsigned char * * 0x01826910, unsigned int * 0x0012fd08, unsigned int 1) line 369 + 46 bytes jpeg_read_scanlines(jpeg_decompress_struct * 0x0179d6f8, unsigned char * * 0x01826910, unsigned int 1) line 173 + 28 bytes output_jpeg_scanlines(il_container_struct * 0x013581a0, int -2) line 596 + 18 bytes il_jpeg_write(il_container_struct * 0x013581a0, unsigned char * 0x0176d3b8, long 128) line 835 + 11 bytes IL_StreamWrite(il_container_struct * 0x013581a0, unsigned char * 0x0176d3b8, long 128) line 805 + 18 bytes NetReaderImpl::Write(unsigned char * 0x0176d3b8, long 128) line 92 + 20 bytes ImageConsumer::OnDataAvailable(ImageConsumer * const 0x01368d80, nsIURL * 0x013599c0, nsIInputStream * 0x01357920, int 31) line 234 nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x0125dfb0, nsIURL * 0x013599c0, nsIInputStream * 0x01357920, int 31) line 1331 + 30 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x0135ed10) line 575 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x0135ed14) line 421 + 12 bytes PL_HandleEvent(PLEvent * 0x0135ed14) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01215ea0) line 357 + 9 bytes _md_EventReceiverProc(void * 0x00660244, unsigned int 49353, unsigned int 0, long 18964128) line 675 + 9 bytes USER32! 77e71250() 01215ea0()

Since it crashes here, I'm changing severity appropriately.

Michael, This bug is mine. I have a possible fix for it. -pn

From the stack I'm guessing this is the bug where the mmx code upchucks on image widths < 7. I've run this by the Intel folks. I have a fix to test.

Fix is checked in. Angus, would you test with NGLayout? I'm testing with Mozilla and it works fine. -pn

doesn't crash anymore..

Also verified on my machine with Dec3a build...does not crash...filed new bug for small text problem.