app_server crash when creating a window

[humdinger]

This is hrev48639.

I had this app_server crash when (I suspect, but I can't remember perfectly) opened an image with WonderBrush (complete report attached):

Debug information for team /boot/system/servers/app_server (684):
CPU(s): 8x Intel Core™ i7-4712MQ
Memory: 15.92 GiB total, 662.30 MiB used
Haiku revision: hrev48639 Jan  9 2015 10:42:28 (BePC)

Active Threads:
	thread 684: picasso (main)
[...]
state: Exception (Segment violation)

Frame		IP			Function Name
-----------------------------------------------
0x72c29090	0xd41f98	ServerWindow::MakeWindow(BRect, char*, window_look, window_feel, uint32, uint32) + 0x58 
	Disassembly:
		ServerWindow::MakeWindow(BRect, char*, window_look, window_feel, uint32, uint32):
		0x00d41f40:               55  push %ebp
		0x00d41f41:             89e5  mov %esp, %ebp
		0x00d41f43:           83ec1c  sub $0x1c, %esp
		0x00d41f46:               57  push %edi
		0x00d41f47:               56  push %esi
		0x00d41f48:               53  push %ebx
		0x00d41f49:       e800000000  call 0xd41f4e
		0x00d41f4e:               5b  pop %ebx
		0x00d41f4f:     81c3a6210f00  add $0xf21a6, %ebx
		0x00d41f55:   c745f800000000  mov $0x0, -0x8(%ebp)
		0x00d41f5c:           83c4f8  add $0xfffffff8, %esp
		0x00d41f5f:     8b83ec0a0000  mov 0xaec(%ebx), %eax
		0x00d41f65:               50  push %eax
		0x00d41f66:       68ec030000  push $0x3ec
		0x00d41f6b:       e800e2fbff  call 0xd00170
		0x00d41f70:             89c7  mov %eax, %edi
		0x00d41f72:           83c410  add $0x10, %esp
		0x00d41f75:             89fe  mov %edi, %esi
		0x00d41f77:             85ff  test %edi, %edi
		0x00d41f79:             745b  jz 0xd41fd6
		0x00d41f7b:         c645ff01  mov $0x1, -0x1(%ebp)
		0x00d41f7f:   c745f801000000  mov $0x1, -0x8(%ebp)
		0x00d41f86:           83c4f4  add $0xfffffff4, %esp
		0x00d41f89:           83c4f4  add $0xfffffff4, %esp
		0x00d41f8c:           8b5508  mov 0x8(%ebp), %edx
		0x00d41f8f:           8b4240  mov 0x40(%edx), %eax
		0x00d41f92:           83c054  add $0x54, %eax
		0x00d41f95:           8b4034  mov 0x34(%eax), %eax
		0x00d41f98:           8b4828  mov 0x28(%eax), %ecx <--

	Frame memory:
		[0x72c29048]  ...rp...........   88 90 c2 72 70 1f d4 00 ec 03 00 00 a1 c6 05 02
		[0x72c29058]  ...rN....@...n..   98 90 c2 72 4e 1f d4 00 f4 40 e3 00 d8 6e c7 19
		[0x72c29068]  .n......d....<+.   b0 6e c7 19 ab e1 fd 01 64 00 00 00 18 3c 2b 18
		[0x72c29078]  .n...........n..   b0 6e c7 19 94 e1 fd 01 01 00 00 00 00 6e c7 01
		[0x72c29088]  ...rE...           d8 90 c2 72 45 8d d3 00
0x72c290e0	0xd38d43	ServerWindow::Init(BRect, window_look, window_feel, uint32, uint32) + 0xd7 
0x72c29180	0xd2a7af	ServerApp::_CreateWindow(int32, BPrivate::LinkReceiver&, &) + 0x323 
0x72c29dc0	0xd23b62	ServerApp::_DispatchMessage(int32, BPrivate::LinkReceiver&) + 0x836 
0x72c29e70	0xd2a3e1	ServerApp::_MessageLooper() + 0x18d 
0x72c29ea0	0xd1d116	MessageLooper::_message_thread(void*) + 0x26 
0x72c29ec8	0x1fdef31	thread_entry + 0x21 
00000000	0x60693250	commpage_thread_exit + 0 

[humdinger]

app_server crash

[waddlesplash]

Can anyone reproduce this?

[humdinger]

I have opened many images in WonderBrush since, but can't remember this sort of crash. Reproducing it appears to be difficult and not necessarily dependant on WonderBrush...

[waddlesplash]

Actually I just realized this is a duplicate of #7831.

[nielx]

Remove milestone for tickets with status = closed and resolution != fixed