299679 - Occasional crashes when unloading/loading documents in custom XULrunner app with dynamically loaded overlays [@ 0x0000030b000000ef - nsIView::GetPosition

Status: RESOLVED INCOMPLETE

(Core :: Web Painting, defect)

Description

[Rob Adams]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8b2) Gecko/20050701 Firefox/1.0+
Build Identifier: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8b2) Gecko/20050701 Firefox/1.0+

Here is a stack trace from the crash.

#0  0x0000000000eaef00 in ?? ()
#1  0x00002aaaabaf64a3 in ComputePlaceholderContainment () from
../../../dist/bin/libxul.so
#2  0x00002aaaabaf6581 in nsViewManager::BuildDisplayList () from
../../../dist/bin/libxul.so
#3  0x00002aaaabaf38e3 in nsViewManager::BuildRenderingDisplayList () from
../../../dist/bin/libxul.so
#4  0x00002aaaabaf29ff in nsViewManager::Refresh () from ../../../dist/bin/libxul.so
#5  0x00002aaaabaf5a7f in nsViewManager::DispatchEvent () from
../../../dist/bin/libxul.so
#6  0x00002aaaabaee406 in HandleEvent () from ../../../dist/bin/libxul.so
#7  0x00002aaaabe083c7 in nsCommonWidget::DispatchEvent () from
../../../dist/bin/libxul.so
#8  0x00002aaaabdff7b3 in nsWindow::OnExposeEvent () from
../../../dist/bin/libxul.so
#9  0x00002aaaabe04367 in expose_event_cb () from ../../../dist/bin/libxul.so
#10 0x00002aaaacb30b6b in _gtk_marshal_BOOLEAN__BOXED () from
/usr/lib/libgtk-x11-2.0.so.0
#11 0x00002aaaad552c70 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#12 0x00002aaaad563267 in g_signal_stop_emission () from
/usr/lib/libgobject-2.0.so.0
#13 0x00002aaaad5643dd in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#14 0x00002aaaad564a43 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#15 0x00002aaaacc08c95 in gtk_widget_activate () from /usr/lib/libgtk-x11-2.0.so.0
#16 0x00002aaaacb2f509 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#17 0x00002aaaace58845 in gdk_window_clear_area_e () from
/usr/lib/libgdk-x11-2.0.so.0
#18 0x00002aaaace5891b in gdk_window_process_all_updates () from
/usr/lib/libgdk-x11-2.0.so.0
#19 0x00002aaaace5899a in gdk_window_process_all_updates () from
/usr/lib/libgdk-x11-2.0.so.0
#20 0x00002aaaad7b523d in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#21 0x00002aaaad7b83df in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#22 0x00002aaaad7b868a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#23 0x00002aaaacb2e820 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#24 0x00002aaaabe06b2d in nsAppShell::Run () from ../../../dist/bin/libxul.so
#25 0x00002aaaabdc2d50 in nsAppStartup::Run () from ../../../dist/bin/libxul.so
#26 0x00002aaaab62d297 in XRE_main () from ../../../dist/bin/libxul.so
#27 0x000000000040273b in main ()

Reproducible: Always

Comment 1

[Rob Adams]

Note that this crash occurs with a a pure XUL/javascript app, so is actually a
gecko bug.

Comment 2

[Andrew Schultz]

ComputePlaceholderContainmentis in views

is there some way we can reproduce this crash?  It will be hard to fix without a
way to reproduce the crash.  Can you build xulrunner with symbols or even a
debug version?

Comment 3

[Rob Adams]

I'm trying to come up with a test case but I'm having trouble narrowing down the
cause of the crash.  In the meantime I'll see if I can't post a better stack trace.

Comment 4

[Rob Adams]

I think that this problem is likely with dynamically loaded overlays, as when I
disable the part of the interface that uses them I can't reproduce the crash.

Debug Build stack trace and output

###!!! ASSERTION: Already have a document.  Unbind first!: '!GetCurrentDoc()',
file /home/readams/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 610
Break: at file /home/readams/mozilla/content/base/src/nsGenericDOMDataNode.cpp,
line 610

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 46912577060000 (LWP 6217)]
0x0000030b000000ef in ?? ()
(gdb) bt
#0  0x0000030b000000ef in ?? ()
#1  0x00002aaaaba66b69 in nsIView::GetPosition (this=0xf19f80) at nsIView.h:166
#2  0x00002aaaabd8202f in nsViewManager::ComputeViewOffset (aView=0xf19f80) at
/home/readams/mozilla/view/src/nsViewManager.cpp:4106
#3  0x00002aaaabd7e99b in nsViewManager::BuildDisplayList (this=0x97b0e0,
aView=0xf19f80, aRect=@0x7fffffbe7400, aEventProcessing=0, aCaptured=0, 
    aDisplayList=0x7fffffbe7320, aPool=@0x7fffffbe72e0) at
/home/readams/mozilla/view/src/nsViewManager.cpp:2356
#4  0x00002aaaabd7c4e5 in nsViewManager::BuildRenderingDisplayList
(this=0x97b0e0, aRootView=0xf19f80, aRegion=@0x7fffffbe73d0,
aDisplayList=0x7fffffbe7320, 
    aPool=@0x7fffffbe72e0, aIgnoreCoveringWidgets=0, aIgnoreOutsideClipping=0)
at /home/readams/mozilla/view/src/nsViewManager.cpp:1281
#5  0x00002aaaabd7b5a0 in nsViewManager::Refresh (this=0x97b0e0, aView=0xf19f80,
aContext=0xf0a080, aRegion=0xf278b0, aUpdateFlags=1)
    at /home/readams/mozilla/view/src/nsViewManager.cpp:872
#6  0x00002aaaabd7e03b in nsViewManager::DispatchEvent (this=0x97b0e0,
aEvent=0x7fffffbe74c0, aStatus=0x7fffffbe751c) at
/home/readams/mozilla/view/src/nsViewManager.cpp:2032
#7  0x00002aaaabd75d73 in HandleEvent (aEvent=0x7fffffbe7570) at
/home/readams/mozilla/view/src/nsView.cpp:171
#8  0x00002aaaac0b2ccb in nsCommonWidget::DispatchEvent (this=0xf1a040,
aEvent=0x7fffffbe7570, aStatus=@0x7fffffbe7554)
    at /home/readams/mozilla/widget/src/gtk2/nsCommonWidget.cpp:219
#9  0x00002aaaac0a9b32 in nsWindow::OnExposeEvent (this=0xf1a040,
aWidget=0xf19f80, aEvent=0x7fffffbe75f0) at
/home/readams/mozilla/widget/src/gtk2/nsWindow.cpp:1311
#10 0x00002aaaac0ae2ab in expose_event_cb (widget=0x947d90,
event=0x7fffffbe7ca0) at /home/readams/mozilla/widget/src/gtk2/nsWindow.cpp:3572
#11 0x00002aaaacf11b6b in _gtk_marshal_BOOLEAN__BOXED () from
/usr/lib/libgtk-x11-2.0.so.0
#12 0x00002aaaad933c70 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#13 0x00002aaaad944267 in g_signal_stop_emission () from
/usr/lib/libgobject-2.0.so.0
#14 0x00002aaaad9453dd in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#15 0x00002aaaad945a43 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#16 0x00002aaaacfe9c95 in gtk_widget_activate () from /usr/lib/libgtk-x11-2.0.so.0
#17 0x00002aaaacf10509 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#18 0x00002aaaad239845 in gdk_window_clear_area_e () from
/usr/lib/libgdk-x11-2.0.so.0
#19 0x00002aaaad23991b in gdk_window_process_all_updates () from
/usr/lib/libgdk-x11-2.0.so.0
#20 0x00002aaaad23999a in gdk_window_process_all_updates () from
/usr/lib/libgdk-x11-2.0.so.0
#21 0x00002aaaadb9669d in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#22 0x00002aaaadb9983f in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#23 0x00002aaaadb99aea in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#24 0x00002aaaacf0f820 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#25 0x00002aaaac0b11a9 in nsAppShell::Run (this=0x7d3b70) at
/home/readams/mozilla/widget/src/gtk2/nsAppShell.cpp:139
#26 0x00002aaaac06ac86 in nsAppStartup::Run (this=0x7d3af0) at
/home/readams/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:145
#27 0x00002aaaab82661a in XRE_main (argc=-4292704, argv=0x7fffffbe7fa0,
aAppData=0x7fffffbe7f70) at /home/readams/mozilla/toolkit/xre/nsAppRunner.cpp:2212
#28 0x00000000004033b5 in main (argc=1, argv=0x7fffffbe8ab0) at
/home/readams/mozilla/xulrunner/app/nsXULRunnerApp.cpp:408
(gdb) 

Comment 5

[Steve England [:stevee]]

Rob, do you still see this with the latest build?

Comment 6

[Wayne Mery (:wsmwk)]

reporter writes "I don't know whether it was fixed or not; I no longer have that app.  I don't remember if I ever managed to find a workaround."

related?  (I didn't read any of these, none have crash in summary)
bug 343794 nglayout.debug.disable_xul_cache = true breaks dynamic overlay loading
bug 330458 Cannot dynamically load an overlay using document.loadOverlay until a previous overlay is completely loaded
bug 399634 <radiogroup persists="value"> fails when loaded dynamically via document.loadOverlay

Comment 7

[Wayne Mery (:wsmwk)]

7 years after report, I doubt there's info useful against the current code base.