gklayout.dll!nsCanvasRenderingContext2D::CairoSurfaceFromElement(nsIDOMElement * imgElt=0x05dfd060, _cairo_surface * * aCairoSurface=0x0012ec00, unsigned char * * imgData=0x0012ec08, int * widthOut=0x0012ec18, int * heightOut=0x0012ebbc, nsIURI * * uriOut=0x0012ec0c) Line 1708 + 0x3 bytes C++ gklayout.dll!nsCanvasRenderingContext2D::DrawImage() Line 1392 + 0x3c bytes C++ The line it crashed on is: PRUint8 b = *inrowrgb++; i and j were 0. There were a few of these in the console: WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(canvas->UpdateImageFrame())) failed: file i:/smtrunk1/mozilla/layout/generic/nsHTMLCanvasFrame.cpp, line 204 win32 trunk cairo SeaMonkey.

Load the testcase, choose "OK" to crash.

This regressed between 2006-03-23 and 2006-03-26.

This is probably fallout from pav's patch to fix the image decoders; most likely I won't fix it unless it's a trivial fix, because new code for canvas will be going in very shortly.

(In reply to comment #4) > This is probably fallout from pav's patch to fix the image decoders; most > likely I won't fix it unless it's a trivial fix, because new code for canvas > will be going in very shortly. > How long is "very shortly"? (days is fine, but if it's weeks I'll have to use different builds locally)

Ideally days; I'll know more for sure tomorrow. The only thing that's blocking it is getting linux turned on, which should be ready now with the symbol renaming patch.

This looks fixed to me. 2006-04-01 Win XP -> Crash 2006-05-11 Win XP -> No crash

Yeah, works for me too in current trunk build, marking wfm.