402785 - Abort, debug build: "cairo_scaled_font_destroy: Assertion `scaled_font->ref_count > 0' failed"

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Daniel Holbert [:dholbert]]

Steps to reproduce:
 1. Go to www.meebo.com
 2. Log into an AIM account.
 3. Close the window. (exiting Firefox)

I get these assertions and errors:

==========
###!!! ASSERTION: no user stylesheets in styleset, but we have one!: 'numBefore > 0', file /scratch/work/builds/trunk.07-11-06.11-22/mozilla/layout/base/nsPresShell.cpp, line 1826
###!!! ASSERTION: Uh, IsInModalState() called w/o a reachable top window?: 'Error', file /scratch/work/builds/trunk.07-11-06.11-22/mozilla/dom/src/base/nsGlobalWindow.cpp, line 5245
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!
This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file /scratch/work/builds/trunk.07-11-06.11-22/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 679
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!
==========


After all that, I abort with this message:

==========
firefox-bin: /build/buildd/libcairo-1.4.10/src/cairo-scaled-font.c:617: cairo_scaled_font_destroy: Assertion `scaled_font->ref_count > 0' failed.
==========

This final assertion & abort occurs in /usr/lib/libpangocairo-1.0.so.0

Tentatively filing this bug in "fonts" component because the abort happens in cairo_scaled_font_destroy.  But maybe this fits better in GFX -- feel free to move it if appropriate.

Comment 1

[Daniel Holbert [:dholbert]]

Jesse pointed out that the abort is covered by bug 399556, which has been fixed in release builds.  (I checked, and I don't get the abort in a current release build.  I just get it in debug builds.)

Leaving this bug open (and renaming it) to track fixing the issue in debug builds.

Comment 2

[Karl Tomlinson (:karlt)]

I only started seeing this after upgrading pango 1.16.5->1.18.3 and
gtk+ 2.10.14->2.12.1.

Comment 3

[Mats Palmgren (inactive)]

I get this crash reliable when quitting after running the Mochitests
in a debug build on Linux.  Maybe it's the same problem as in bug 398084 -
someone is keeping objects alive past module shutdown?

Comment 4

[Karl Tomlinson (:karlt)]

I'm not getting this anymore and I haven't changed pango/gtk versions.

Comment 5

[Mats Palmgren (inactive)]

I get this in an up-to-date build when running:
firefox -reftest layout/reftests/reftest.list

Comment 6

[Jesse Ruderman]

Which reftest file triggers it?

Comment 7

[Mats Palmgren (inactive)]

Attachment: reftest.list

This list triggers it in about 60% of the runs.  Removing more files makes it
less crash prone.

Comment 8

[Mats Palmgren (inactive)]

Forgot: the path is layout/reftests/bugs/

Comment 9

[Jesse Ruderman]

Can you get the list down to fewer unique files by repeating some files?

Comment 10

[Karl Tomlinson (:karlt)]

The patch for bug 405268 seems to have fixed this for me.
(And I'm not reproducing with Mats' reftest.list.)
That patch freed some leaking PangoItems which I think would have had references to PangoFonts.

Comment 11

[Mats Palmgren (inactive)]

I've updated my tree and now I can't reproduce it.  I then rolled back
gfxPangoFonts.cpp to rev. 1.123 and the problem came back, so bug 405268
is a confirmed fix for me. Thanks Karl.

Comment 12

[Karl Tomlinson (:karlt)]

Thanks for checking, Mats.
I'm tentatively marking fixed, and not fixing what isn't broken,
but I'm still a bit concerned that we should not pango_fc_font_map_shutdown
down until after closing the display at least, as gtk/gdk might be using a PangoFont.
If anyone else still sees this, please reopen.