**** observed with 2000-06-30 M17 **** Steps to reproduce: -open messenger; -select a message; -hit PrintScrn on the keyboard; -open Composer; - go Edit|Paste: //note: application crashes

here is a stack: MSVCRT.dll + 0x1637 (0x78001637) nsClipboard::GetNativeDataOffClipboard [d:\builds\seamonkey\mozilla\widget\src\windows\nsClipboard.cpp, line 442] nsClipboard::GetDataFromDataObject [d:\builds\seamonkey\mozilla\widget\src\windows\nsClipboard.cpp, line 595] nsClipboard::GetNativeClipboardData [d:\builds\seamonkey\mozilla\widget\src\windows\nsClipboard.cpp, line 676] nsBaseClipboard::GetData [d:\builds\seamonkey\mozilla\widget\src\xpwidgets\nsBaseClipboard.cpp, line 115] nsHTMLEditor::Paste [d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditor.cpp, line 4899] nsHTMLEditorLog::Paste [d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditorLog.cpp, line 358] nsPasteCommand::DoCommand [d:\builds\seamonkey\mozilla\editor\base\nsEditorCommands.cpp, line 167] nsControllerCommandManager::DoCommand [d:\builds\seamonkey\mozilla\rdf\content\src\nsControllerCommandManager.cpp, line 190] nsEditorController::DoCommand [d:\builds\seamonkey\mozilla\editor\base\nsEditorController.cpp, line 199] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] nsXPCWrappedNativeClass::CallWrappedMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativeclass.cpp, line 915] WrappedNative_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 195] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 717] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2521] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 733] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2817] nsJSContext::CallEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 850] nsJSEventListener::HandleEvent [d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] nsEventListenerManager::HandleEventSubType [d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 773] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 1653] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3350] PresShell::HandleDOMEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3956] nsMenuFrame::Execute [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 1429] nsMenuFrame::HandleEvent [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 323] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3925] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3843] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 782] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 755] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 755] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 755] nsViewManager2::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1389] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 69] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 564] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 581] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3681] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3886] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2801] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 830] USER32.dll + 0x124c (0x77e7124c)

Mike, this looks like yours. Here is the stack, you may want to take out the assert until it can handle images. NTDLL! 77f7629c() nsDebug::Assertion(const char * 0x0139acf8, const char * 0x0139acf4, const char * 0x0139acc4, int 501) line 246 + 13 bytes nsClipboard::GetNativeDataOffClipboard(IDataObject * 0x00155ba0, unsigned int 0, unsigned int 8, void * * 0x0012bde0, unsigned int * 0x0012bdcc) line 501 + 35 bytes nsClipboard::GetDataFromDataObject(IDataObject * 0x00155ba0, unsigned int 0, nsIWidget * 0x00000000, nsITransferable * 0x03d552a0) line 592 + 25 bytes nsClipboard::GetNativeClipboardData(nsClipboard * const 0x02bde5c0, nsITransferable * 0x03d552a0, int 1) line 671 + 17 bytes nsBaseClipboard::GetData(nsBaseClipboard * const 0x02bde5c0, nsITransferable * 0x03d552a0, int 1) line 113 + 20 bytes nsHTMLEditor::Paste(nsHTMLEditor * const 0x03c63ee0, int 1) line 4897 + 36 bytes

Adding crash keyword

nominating since i have a fix (just remove the assert).

ok, this is a bit worse than i thought: when the clipboard code gets the image, it picks through the headers to find the bit depth, which in this case is 32. Passing that to nsImageWin::Init() causes another assert because a depth of 32bits is not expected (only 8 and 24 are). Looks like a win32 gfx problem. Pushing to pnunn per our discussion, cc'ing kevin and don.

Putting on [nsbeta2+] radar for beta2 fix.

I just talked to Mike to get a sense of how critical the fix is for this bug. He said this code can be commented out to prevent the crash. Commenting out the code means that the clipboard can't be used to paste in images. It can still be used to paste in text. I don't want to lose the 'fixablity' of this bug, but I do have a bug that presents more dire consequences if not fixed soon (bug#30852). -p

Mike: Would this patch take care of the crash? (my local tree is hoarked.) -p

duh. 2nd patch compiles. -p

pam, your patch would leak, I'm just going to comment out the entire CF_DIB case.

oh wait, i can do better than that!

temp fix in the clipboard code checked in. now we no longer assert or crash, but this bug is still lurking because WinGFX doesn't handle 32-bit images. what should we do with this bug now? removing crash keyword.

Adding crash keyword

Reassigning to dcone. He will make changes to support 32 bit images on WIN32.

Application no longer crashes.. I have the fix for 32 and 16 bit images, but that will not get the paste to work since pasting an image does not work at any depth. This is no longer a nsbeta2+ since crashing no longer occurs (Mike Pinkertons fix) I just have a fix to have pasting work at any depth (when it starts working). I will create two new bugs, pasting an image does not work and another that nsImageWin needs 16 and 32 bit depths to work for paste. These will have the beta3 milestones on them.

Adding topcrash Keyword.

The crash no longer occurs in the July 24th build. Marking verified. Tested under Windows 98.

dcone: you wrote you'd file a bug on pasting images not working. Did you? Such a bug was independantly filed on Aug. 6th: bug 47838 "can't paste screen capture in mail composer". Just wondering if it's a dup or not.