1017 - Crash in DisplayPixmap()

Status: VERIFIED FIXED

(MozillaClassic Graveyard :: XFE, defect, P1)

Description

[Ramiro Estrugo]

Do: Edit->editToolbars ... BOOM...crash with the following stack trace:


Program received signal SIGSEGV, Segmentation fault.
0x80b34de in _IMGCB_DisplayPixmap (img_cb=0x8599b60, op=12, dpy_cx=0x8597e00,
    image=0x8630680, mask=0x0, x=0, y=0, x_offset=0, y_offset=0, width=50,
    height=50, req_w=0, req_h=0) at images.c:667
667         Drawable drawable = fe_drawable->xdrawable;

#0  0x80b34de in _IMGCB_DisplayPixmap (img_cb=0x8599b60, op=12,
    dpy_cx=0x8597e00, image=0x8630680, mask=0x0, x=0, y=0, x_offset=0,
    y_offset=0, width=50, height=50, req_w=0, req_h=0) at images.c:667
#1  0x404c1aaa in IL_DisplaySubImage (image_req=0x8634c60, x=0, y=0,
    x_offset=0, y_offset=0, width=50, height=50) at if.cpp:2200
#2  0x403c8daa in lo_DisplayImageWithoutCompositor (context=0x8597e00,
    image=0x863b00c) at laydisp.c:429
#3  0x403c923f in lo_ClipImage (context=0x8597e00, image=0x863b00c, x=0, y=0,
    width=1073741823, height=1073741823) at laydisp.c:565
#4  0x403c97d3 in lo_DisplayElement (context=0x8597e00, tptr=0x863b00c,
    base_x=0, base_y=0, x=0, y=0, width=1073741823, height=1073741823)
    at laydisp.c:744
#5  0x403f6023 in lo_DisplayLine (context=0x8597e00, state=0x8636600,
    line_num=0, x=0, y=0, w=1073741823, h=1073741823) at layout.c:2879
#6  0x403fcb5f in lo_UpdateStateAfterFlushingLine (context=0x8597e00,
    state=0x8636600, linefeed=0x863b0b0, inRelayout=0 '\000') at layout.c:8164
#7  0x403f4abf in lo_FlushLineList (context=0x8597e00, state=0x8636600,
    break_type=0, clear_type=0, breaking=0 '\000') at layout.c:1611
#8  0x4041ff04 in lo_InsertLineBreak (context=0x8597e00, state=0x8636600,
    break_type=0, clear_type=0, breaking=0 '\000') at laytext.c:673
#9  0x40420506 in lo_SetLineBreakState (context=0x8597e00, state=0x8636600,
    breaking=0 '\000', break_type=0, linefeed_state=1, relayout=0 '\000')
    at laytext.c:963
#10 0x403f659c in lo_CloseOutLayout (context=0x8597e00, state=0x8636600)
    at layout.c:3218
#11 0x403f7d4d in LO_ProcessTag (data_object=0x8553900, tag=0x0, status=1)
    at layout.c:4422
#12 0x4043765d in EDT_ProcessTag (data_object=0x8553900, tag=0x0, status=1)
    at editor.cpp:963
#13 0x404df414 in PA_MDLComplete (stream=0x86348a0) at pa_parse.c:1743
#14 0x404dddd9 in pa_check_doc_data_count (stream=0x86348a0) at pa_parse.c:390
#15 0x404de0c7 in PA_DropDocData (stream=0x86348a0) at pa_parse.c:538
#16 0x404de147 in pa_cleanup_after_netlib (stream=0x86348a0) at pa_parse.c:553
#17 0x404de169 in pa_netlib_stream_complete (stream=0x86348a0)
    at pa_parse.c:559
#18 0x404fee27 in net_CvtCharCodeComplete (stream=0x8634820) at net_junk.c:53
#19 0x404b9abc in IL_ViewStream (format_out=1, newshack=0x0, urls=0x85e6000,
    cx=0x8597e00) at external.cpp:310
#20 0x4029c775 in NET_StreamBuilder (format_out=1, URL_s=0x85e6000,
    context=0x8597e00) at mkstream.c:242
#21 0x402bc79f in NET_CacheConverter (format_out=1, converter_obj=0x0,
    URL_s=0x85e6000, window_id=0x8597e00) at mkcache.c:1688
#22 0x4029c775 in NET_StreamBuilder (format_out=65, URL_s=0x85e6000,
    context=0x8597e00) at mkstream.c:242
#23 0x4030a064 in net_setup_http_stream (ce=0x855b800) at mkhttp.c:2763
#24 0x4030b189 in net_ProcessHTTP (ce=0x855b800) at mkhttp.c:3404
#25 0x4029066f in NET_ProcessNet (ready_fd=0x8439e00, fd_type=2)
    at mkgeturl.c:3369
#26 0x4029b701 in net_process_net_timer_callback (closure=0x0)
    at mkselect.c:189
#27 0x80d86b8 in fe_do_timeout (p=0x85f4720, id=0xbfffd40c) at xfe.c:2946
#28 0x408ea8ad in XtAppProcessEvent ()
#29 0x80beed2 in fe_EventLoop () at mozilla.c:1133
#30 0x80c2191 in main (argc=1, argv=0xbfffec84) at mozilla.c:3421

Comment 1

[ramiro]

Same thing happens when you do Bookmarks->Edit Bookmarks or
Window->Tools->History.

Comment 2

[ramiro]

This only happens if MOZ_SELECTOR_BAR is defined.

Comment 3

[Radha on family leave (not reading bugmail)]

Fix checked in. Please verify.

Comment 4

[rubydoo123]

asking ramiro to verify bug

Comment 5

[ramiro]

This bug is in the old code base.  If i remember correctly, radha fixed it.

It doesnt matter to the gecko code base.

Marking verified.