From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.9) Gecko/20020311 BuildID: 2002031104 Going to http://totl.net/ crashes the browser. I do see some page content (text as well as images) before the crash, but almost immediately when things start appearing the browser crashes. Reproducible: Always Steps to Reproduce: 1. Go to http://totl.net/ Talkback incident ID's: TB3986640Q, TB3940791G, TB3940760W This crash did not occur on mozilla 0.9.8 The totl website allows you to select several different front pages through the 'Configure Menu' link. The crash happened on the newest of these, called 'Marvin' (the bottom right choice on the config page). This page should be the default for new visitors. I have not yet tested the other front pages. Using the URL view-source:http://totl.net/ I did manage to correctly retrieve the source. It contains some javascript that fades the bgcolor of the page, which is called several times using setTimeout(), these however are called with the first timeout at 15 seconds, which should be far after the crash.

I have now tested the other frontpages as well (through the mmenu configuration at http://totl.net/Config/ ), and the frontpage config calles 'Even more new' (bottom left) also crashes the browser. The others show without problems. Talkback ID for this crash is TB3991088E

WFM, 2002030803 Win 98.

Crashes me too. TB399476K WinME 2002031104

Adding reduced page as testcase. It only seems to crash moz when both the table cell background and the image it contains are the same png. Doing some more testing.

Talkback ID for first attachment crash is: TB3994764K This problem doesn't seem to occur with any png. Here is another testcase that _doesn't_ crash, where all I have done is change the png used for the background and img src. I'm leaving off here as I don't think I can do much more.

Stephen, can you retreive Talkback data please: TB3994764K ?

nsImageWin::DrawTile [d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, line 799] nsRenderingContextImpl::DrawTile [d:\builds\seamonkey\mozilla\gfx\src\nsRenderingContextImpl.cpp, line 968] nsCSSRendering::PaintBackgroundWithSC [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSRendering.cpp, line 3123] nsCSSRendering::PaintBackground [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSRendering.cpp, line 2586] nsTableCellFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 442] nsTableRowFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 661] nsTableRowFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 604] nsTableRowGroupFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 295] nsTableRowFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 604] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsContainerFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 197] nsTableFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1460] nsTableFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1502] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsTableOuterFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 376] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsBlockFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5520] nsBlockFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5392] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsBlockFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5520] nsBlockFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5392] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsContainerFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 197] nsHTMLContainerFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 135] CanvasFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 390] PresShell::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5711] nsView::Paint [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 280] nsViewManager::RenderDisplayListElement [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1175] nsViewManager::RenderViews [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1124] nsViewManager::Refresh [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 719] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1709] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 891] nsWindow::OnPaint [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4510] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3399] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131] KERNEL32.DLL + 0x3613 (0xbff63613) KERNEL32.DLL + 0x248f7 (0xbff848f7) 0x00648c16 0x00058f64

wfm using build 2002031303 on Win2k, both URL (with Marvin layout) and testcase.

*** This bug has been marked as a duplicate of 128282 ***

Why was this bug marked as a duplicate of fixed bug 128282? This is a problem in 0.9.9 and bug 128282 was fixed before that I think.