236881 - Crash in nsRenderingContextGTK::FillRect

Status: RESOLVED INCOMPLETE

(Core Graveyard :: GFX: Gtk, defect)

Description

[Boris Zbarsky [:bzbarsky]]

BUILD: 2004-03-07-08 GTK1 nightly, but make sure to test builds WITHOUT the
patch to bug 57607 (which I just landed) in them.   This seems to be
timing-sensitive, and that patch changes the timing.

Steps to reproduce:
1)  Load URL in URL field
2)  We crash

Stack:

#0  0x402ebeb6 in gdk_draw_rectangle () from /usr/lib/libgdk-1.2.so.0
#1  0x41e7affb in nsRenderingContextGTK::FillRect(int, int, int, int)
(this=0x883df48, 
    aX=0, aY=0, aWidth=14308, aHeight=8722)
    at
/home/bzbarsky/mozilla/debug/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp:969
#2  0x41e7af34 in nsRenderingContextGTK::FillRect(nsRect const&) (this=0x883df48, 
    aRect=@0xbfffdc00)
    at
/home/bzbarsky/mozilla/debug/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp:944
#3  0x4129b231 in nsCSSRendering::PaintBackgroundColor(nsIPresContext*,
nsIRenderingContext&, nsIFrame*, nsRect const&, nsStyleBackground const&,
nsStyleBorder const&, nsStylePadding const&, int) (aPresContext=0x8718a58,
aRenderingContext=@0x883df48, 
    aForFrame=0x882480c, aBgClipArea=@0xbfffddd0, aColor=@0xbfffde70, 
    aBorder=@0x883b1a8, aPadding=@0x883b660, aCanPaintNonWhite=1)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/style/src/nsCSSRendering.cpp:3309
#4  0x4129a113 in nsCSSRendering::PaintBackgroundWithSC(nsIPresContext*,
nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBackground
const&, nsStyleBorder const&, nsStylePadding const&, int)
(aPresContext=0x8718a58, aRenderingContext=@0x883df48, 
    aForFrame=0x882480c, aDirtyRect=@0xbfffe0c0, aBorderArea=@0xbfffded0, 
    aColor=@0xbfffde70, aBorder=@0x883b1a8, aPadding=@0x883b660,
aUsePrintSettings=1)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/style/src/nsCSSRendering.cpp:2864

Analysis:

(gdb) frame 1
#1  0x41e7affb in nsRenderingContextGTK::FillRect(int, int, int, int)
(this=0x883df48, 
    aX=0, aY=0, aWidth=14308, aHeight=8722)
    at
/home/bzbarsky/mozilla/debug/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp:969
969       ::gdk_draw_rectangle(mSurface->GetDrawable(), mGC,
(gdb) p mSurface->GetDrawable()
$7 = (_GdkWindow *) 0x4

That looks very wrong to me....

Comment 1

[Mats Palmgren (inactive)]

GTK1 has been removed on trunk so this would only be an issue for branches.
There doesn't seem to be any talkbacks reported with
nsRenderingContextGTK::FillRect on the stack.  WORKSFORME?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Unless the new code has the same issue with bogus surfaces of course.  And note the timing stuff.

I really don't care what you do with the bug, since it's not like it'll get fixed no matter what we do with it.