Closed Bug 4086 Opened 25 years ago Closed 25 years ago

Tinderbox/apprunner crashes, assert in nsViewManager::Refresh()

Categories

(Core Graveyard :: Tracking, defect, P1)

x86
Linux

Tracking

(Not tracked)

VERIFIED DUPLICATE of bug 4363

People

(Reporter: mcafee, Assigned: michaelp)

References

()

Details

Linux, works on viewer, crashes for apprunner.

Page loads Ok, but as soon as you scroll the big table
into view it crashes.

#0  0x40ac36a1 in __kill ()
#1  0x40ac34cf in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40ac46df in abort () at ../sysdeps/generic/abort.c:83
#3  0x407d2fba in PR_Abort () at prlog.c:461
#4  0x4002f286 in nsDebug::Abort (aFile=0x40d2ee00 "nsViewManager.cpp",
    aLine=468) at nsDebug.cpp:93
#5  0x4002f2ea in nsDebug::Break (aFile=0x40d2ee00 "nsViewManager.cpp",
    aLine=468) at nsDebug.cpp:108
#6  0x4002f42d in nsDebug::Assertion (
    aStr=0x40d2eea0 "recursive painting not permitted",
    aExpr=0x40d2ee88 "!(PR_TRUE == mPainting)",
    aFile=0x40d2ee00 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:140
#7  0x40d2ad7f in nsViewManager::Refresh (this=0x82939a8, aView=0x82821e8,
    aContext=0x81f3fe8, rect=0xbfffa808, aUpdateFlags=1)
    at nsViewManager.cpp:468
#8  0x40d2b8b6 in nsViewManager::DispatchEvent (this=0x82939a8,
    aEvent=0xbfffa8c8, aStatus=@0xbfffa84c) at nsViewManager.cpp:1626
(More stack frames follow...)
(gdb) bt
#0  0x40ac36a1 in __kill ()
#1  0x40ac34cf in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40ac46df in abort () at ../sysdeps/generic/abort.c:83
#3  0x407d2fba in PR_Abort () at prlog.c:461
#4  0x4002f286 in nsDebug::Abort (aFile=0x40d2ee00 "nsViewManager.cpp",
    aLine=468) at nsDebug.cpp:93
#5  0x4002f2ea in nsDebug::Break (aFile=0x40d2ee00 "nsViewManager.cpp",
    aLine=468) at nsDebug.cpp:108
#6  0x4002f42d in nsDebug::Assertion (
    aStr=0x40d2eea0 "recursive painting not permitted",
    aExpr=0x40d2ee88 "!(PR_TRUE == mPainting)",
    aFile=0x40d2ee00 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:140
#7  0x40d2ad7f in nsViewManager::Refresh (this=0x82939a8, aView=0x82821e8,
    aContext=0x81f3fe8, rect=0xbfffa808, aUpdateFlags=1)
    at nsViewManager.cpp:468
#8  0x40d2b8b6 in nsViewManager::DispatchEvent (this=0x82939a8,
    aEvent=0xbfffa8c8, aStatus=@0xbfffa84c) at nsViewManager.cpp:1626
#9  0x40d23378 in HandleEvent (aEvent=0xbfffa8c8) at nsView.cpp:63
#10 0x4008d112 in nsWidget::DispatchEvent (this=0x8137360, event=0xbfffa8c8,
    aStatus=@0xbfffa888) at nsWidget.cpp:840
#11 0x4008cff0 in nsWidget::DispatchWindowEvent (this=0x8137360,
    event=0xbfffa8c8) at nsWidget.cpp:800
#12 0x4008e0b1 in nsWindow::OnPaint (this=0x8137360, event=@0xbfffa8c8)
    at nsWindow.cpp:430
#13 0x40089e01 in handle_draw_event (w=0x827ef00, area=0xbfffac70, p=0x8137360)
    at nsGtkEventHandler.cpp:417
#14 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x827ef00,
    func=0x40089dac <handle_draw_event(_GtkWidget *, _GdkRectangle *, void *)>,
func_data=0x8137360, args=0xbfffa9a8) at gtkmarshal.c:216
#15 0x408cf11a in gtk_handlers_run (handlers=0x82fe930, signal=0xbfffa964,
    object=0x827ef00, params=0xbfffa9a8, after=0) at gtksignal.c:1909
#16 0x408ce624 in gtk_signal_real_emit (object=0x827ef00, signal_id=8,
    params=0xbfffa9a8) at gtksignal.c:1469
#17 0x408cc934 in gtk_signal_emit (object=0x827ef00, signal_id=8)
    at gtksignal.c:552
#18 0x40900894 in gtk_widget_draw (widget=0x827ef00, area=0xbfffac70)
    at gtkwidget.c:2310
#19 0x40898593 in gtk_layout_draw (widget=0x8293e20, area=0xbfffafd4)
    at gtklayout.c:637
#20 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x8293e20,
    func=0x40898488 <gtk_layout_draw>, func_data=0x0, args=0xbfffad0c)
    at gtkmarshal.c:216
#21 0x408ce4e1 in gtk_signal_real_emit (object=0x8293e20, signal_id=8,
    params=0xbfffad0c) at gtksignal.c:1432
#22 0x408cc934 in gtk_signal_emit (object=0x8293e20, signal_id=8)
    at gtksignal.c:552
#23 0x40900894 in gtk_widget_draw (widget=0x8293e20, area=0xbfffafd4)
    at gtkwidget.c:2310
#24 0x40898593 in gtk_layout_draw (widget=0x824b3b8, area=0xbfffb338)
    at gtklayout.c:637
Severity: normal → major
Priority: P3 → P2
Is this one of those "this isn't supposed to be
a fatal abort" cases?
is there a more complete stack trace? this basically points to someone causing
a synchronous paint while painting is already in progress. the assert is a
heads up to let folks that they've pulled a no-no with the view code (rather
than something wrong with the view code itself)... this should be a fatal abort
because someone's doing something *really* wrong to hit this.
i can't reproduce this with the URL in the bug form (above),
but I can by bonking on the tinderbox personal toolbar button.

More complete stack trace to follow.  It's 161 frames deep,
you asked for it :-)

#0  0x40ac36a1 in __kill ()
#1  0x40ac34cf in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40ac46df in abort () at ../sysdeps/generic/abort.c:83
#3  0x407d2fba in PR_Abort () at prlog.c:461
#4  0x4002f286 in nsDebug::Abort (aFile=0x40d2ee00 "nsViewManager.cpp",
    aLine=468) at nsDebug.cpp:93
#5  0x4002f2ea in nsDebug::Break (aFile=0x40d2ee00 "nsViewManager.cpp",
    aLine=468) at nsDebug.cpp:108
#6  0x4002f42d in nsDebug::Assertion (
    aStr=0x40d2eea0 "recursive painting not permitted",
    aExpr=0x40d2ee88 "!(PR_TRUE == mPainting)",
    aFile=0x40d2ee00 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:140
#7  0x40d2ad7f in nsViewManager::Refresh (this=0x8293998, aView=0x8282588,
    aContext=0x8327160, rect=0xbfffa798, aUpdateFlags=1)
    at nsViewManager.cpp:468
#8  0x40d2b8b6 in nsViewManager::DispatchEvent (this=0x8293998,
    aEvent=0xbfffa858, aStatus=@0xbfffa7dc) at nsViewManager.cpp:1626
#9  0x40d23378 in HandleEvent (aEvent=0xbfffa858) at nsView.cpp:63
#10 0x4008d112 in nsWidget::DispatchEvent (this=0x8137478, event=0xbfffa858,
    aStatus=@0xbfffa818) at nsWidget.cpp:840
#11 0x4008cff0 in nsWidget::DispatchWindowEvent (this=0x8137478,
    event=0xbfffa858) at nsWidget.cpp:800
#12 0x4008e0b1 in nsWindow::OnPaint (this=0x8137478, event=@0xbfffa858)
    at nsWindow.cpp:430
#13 0x40089e01 in handle_draw_event (w=0x8282640, area=0xbfffac00, p=0x8137478)
    at nsGtkEventHandler.cpp:417
#14 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x8282640,
    func=0x40089dac <handle_draw_event(_GtkWidget *, _GdkRectangle *, void *)>,
func_data=0x8137478, args=0xbfffa938) at gtkmarshal.c:216
#15 0x408cf11a in gtk_handlers_run (handlers=0x82feb30, signal=0xbfffa8f4,
    object=0x8282640, params=0xbfffa938, after=0) at gtksignal.c:1909
#16 0x408ce624 in gtk_signal_real_emit (object=0x8282640, signal_id=8,
    params=0xbfffa938) at gtksignal.c:1469
#17 0x408cc934 in gtk_signal_emit (object=0x8282640, signal_id=8)
    at gtksignal.c:552
#18 0x40900894 in gtk_widget_draw (widget=0x8282640, area=0xbfffac00)
    at gtkwidget.c:2310
#19 0x40898593 in gtk_layout_draw (widget=0x8293e60, area=0xbfffaf64)
    at gtklayout.c:637
#20 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x8293e60,
    func=0x40898488 <gtk_layout_draw>, func_data=0x0, args=0xbfffac9c)
    at gtkmarshal.c:216
#21 0x408ce4e1 in gtk_signal_real_emit (object=0x8293e60, signal_id=8,
    params=0xbfffac9c) at gtksignal.c:1432
#22 0x408cc934 in gtk_signal_emit (object=0x8293e60, signal_id=8)
    at gtksignal.c:552
#23 0x40900894 in gtk_widget_draw (widget=0x8293e60, area=0xbfffaf64)
    at gtkwidget.c:2310
#24 0x40898593 in gtk_layout_draw (widget=0x824b1f0, area=0xbfffb2c8)
    at gtklayout.c:637
#25 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x824b1f0,
    func=0x40898488 <gtk_layout_draw>, func_data=0x0, args=0xbfffb000)
    at gtkmarshal.c:216
#26 0x408ce4e1 in gtk_signal_real_emit (object=0x824b1f0, signal_id=8,
    params=0xbfffb000) at gtksignal.c:1432
#27 0x408cc934 in gtk_signal_emit (object=0x824b1f0, signal_id=8)
    at gtksignal.c:552
#28 0x40900894 in gtk_widget_draw (widget=0x824b1f0, area=0xbfffb2c8)
    at gtkwidget.c:2310
#29 0x40898593 in gtk_layout_draw (widget=0x824ab70, area=0xbfffb62c)
    at gtklayout.c:637
#30 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x824ab70,
    func=0x40898488 <gtk_layout_draw>, func_data=0x0, args=0xbfffb364)
    at gtkmarshal.c:216
#31 0x408ce4e1 in gtk_signal_real_emit (object=0x824ab70, signal_id=8,
    params=0xbfffb364) at gtksignal.c:1432
#32 0x408cc934 in gtk_signal_emit (object=0x824ab70, signal_id=8)
    at gtksignal.c:552
#33 0x40900894 in gtk_widget_draw (widget=0x824ab70, area=0xbfffb62c)
    at gtkwidget.c:2310
#34 0x40898593 in gtk_layout_draw (widget=0x8203820, area=0xbfffb990)
    at gtklayout.c:637
#35 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x8203820,
    func=0x40898488 <gtk_layout_draw>, func_data=0x0, args=0xbfffb6c8)
    at gtkmarshal.c:216
#36 0x408ce4e1 in gtk_signal_real_emit (object=0x8203820, signal_id=8,
    params=0xbfffb6c8) at gtksignal.c:1432
#37 0x408cc934 in gtk_signal_emit (object=0x8203820, signal_id=8)
    at gtksignal.c:552
#38 0x40900894 in gtk_widget_draw (widget=0x8203820, area=0xbfffb990)
    at gtkwidget.c:2310
#39 0x40898593 in gtk_layout_draw (widget=0x817d2c0, area=0xbfffbccc)
    at gtklayout.c:637
#40 0x4090a591 in gtk_marshal_NONE__POINTER (object=0x817d2c0,
    func=0x40898488 <gtk_layout_draw>, func_data=0x0, args=0xbfffba2c)
    at gtkmarshal.c:216
#41 0x408ce4e1 in gtk_signal_real_emit (object=0x817d2c0, signal_id=8,
    params=0xbfffba2c) at gtksignal.c:1432
#42 0x408cc934 in gtk_signal_emit (object=0x817d2c0, signal_id=8)
    at gtksignal.c:552
#43 0x40900894 in gtk_widget_draw (widget=0x817d2c0, area=0x0)
    at gtkwidget.c:2310
#44 0x40897c03 in gtk_layout_thaw (layout=0x817d2c0) at gtklayout.c:335
#45 0x4008e17c in nsWindow::EndResizingChildren (this=0x817d038)
    at nsWindow.cpp:452
#46 0x40d27636 in nsScrollingView::SetPosition (this=0x8203510, aX=0, aY=0)
    at nsScrollingView.cpp:522
#47 0x40d2c233 in nsViewManager::MoveViewTo (this=0x817cde0, aView=0x8203510,
    aX=0, aY=0) at nsViewManager.cpp:1876
#48 0x40402ae3 in nsFrame::DidReflow (this=0x82034a8, aPresContext=@0x8136bb0,
    aStatus=1) at nsFrame.cpp:995
#49 0x40424f57 in nsScrollFrame::DidReflow (this=0x82034a8,
    aPresContext=@0x8136bb0, aStatus=1) at nsScrollFrame.cpp:102
#50 0x4043033b in ViewportFrame::Reflow (this=0x81b7780,
    aPresContext=@0x8136bb0, aDesiredSize=@0xbfffc044,
    aReflowState=@0xbfffbf60, aStatus=@0xbfffbf5c) at nsViewportFrame.cpp:439
#51 0x4040b43e in nsHTMLReflowCommand::Dispatch (this=0x8229428,
    aPresContext=@0x8136bb0, aDesiredSize=@0xbfffc044, aMaxSize=@0xbfffc034,
    aRendContext=@0x839df38) at nsHTMLReflowCommand.cpp:165
#52 0x40420f18 in PresShell::ProcessReflowCommands (this=0x8180b78)
    at nsPresShell.cpp:1178
#53 0x4041f71b in PresShell::ExitReflowLock (this=0x8180b78)
    at nsPresShell.cpp:623
#54 0x40421f9d in PresShell::AttributeChanged (this=0x8180b78,
    aDocument=0x8131058, aContent=0x8209d6c, aAttribute=0x817dd18, aHint=-1)
    at nsPresShell.cpp:1590
#55 0x40ce7788 in XULDocumentImpl::AttributeChanged (this=0x8131058,
    aChild=0x8209d6c, aAttribute=0x817dd18, aHint=-1) at nsXULDocument.cpp:1413
#56 0x40431e74 in nsGenericHTMLElement::UnsetAttribute (this=0x8209d74,
    aNameSpaceID=3, aAttribute=0x817dd18, aNotify=1)
    at nsGenericHTMLElement.cpp:740
#57 0x4044e44e in nsHTMLDivElement::UnsetAttribute (this=0x8209d60,
    aNameSpaceID=3, aAttribute=0x817dd18, aNotify=1) at nsHTMLDivElement.cpp:67
#58 0x403bbfc4 in nsGenericElement::RemoveAttribute (this=0x8209d74,
    aName=@0xbfffc1dc) at nsGenericElement.cpp:420
#59 0x4044ed32 in nsHTMLDivElement::RemoveAttribute (this=0x8209d60,
    aName=@0xbfffc1dc) at nsHTMLDivElement.cpp:51
#60 0x40cca8fc in RDFElementImpl::UnsetAttribute (this=0x8205ed0,
    aNameSpaceID=0, aName=0x817dd18, aNotify=1) at nsRDFElement.cpp:1896
#61 0x40ce3a7d in RDFXULBuilderImpl::RemoveAttribute (this=0x8136478,
    aElement=0x8205ee0, aProperty=0x8310ea0, aValue=0x81fd988)
    at nsRDFXULBuilder.cpp:1909
#62 0x40cdedac in RDFXULBuilderImpl::OnUnassert (this=0x8136478,
    aSubject=0x81efd28, aPredicate=0x8310ea0, aObject=0x81fd988)
    at nsRDFXULBuilder.cpp:821
#63 0x40cb0ee3 in CompositeDataSourceImpl::OnUnassert (this=0x8136370,
    subject=0x81efd28, predicate=0x8310ea0, object=0x81fd988)
    at nsCompositeDataSource.cpp:1017
#64 0x40cb4dcf in InMemoryDataSource::Unassert (this=0x8137f58,
    source=0x81efd28, property=0x8310ea0, target=0x81fd988)
    at nsInMemoryDataSource.cpp:1342
#65 0x40cb05e3 in CompositeDataSourceImpl::Unassert (this=0x8136370,
    source=0x81efd28, property=0x8310ea0, target=0x81fd988)
    at nsCompositeDataSource.cpp:753
#66 0x40ce06f3 in RDFXULBuilderImpl::OnSetAttribute (this=0x8136478,
    aElement=0x8205ed0, aName=@0xbfffc548, aValue=@0xbfffc5a4)
    at nsRDFXULBuilder.cpp:1235
#67 0x40ceb0cb in XULDocumentImpl::OnSetAttribute (this=0x8131058,
    aElement=0x8205ed0, aName=@0xbfffc548, aValue=@0xbfffc5a4)
    at nsXULDocument.cpp:2822
#68 0x40cc7c06 in RDFElementImpl::SetAttribute (this=0x8205ed0,
    aName=@0xbfffc548, aValue=@0xbfffc5a4) at nsRDFElement.cpp:853
#69 0x40c18013 in setAttribute (shell=0x812c848,
    id=0x40c24b50 "Browser:Status", name=0x40c24b4b "text", value=@0xbfffc5a4)
    at nsBrowserAppCore.cpp:551
#70 0x40c18f48 in nsBrowserAppCore::OnStatus (this=0x812d7a0, aURL=0x831bad0,
    aMsg=0x82293a8) at nsBrowserAppCore.cpp:877
#71 0x4021c145 in nsWebShell::OnStatus (this=0x824a840, aURL=0x831bad0,
    aMsg=0x82293a8) at nsWebShell.cpp:2337
#72 0x4021422b in nsDocumentBindInfo::OnStatus (this=0x832d5f0,
    aURL=0x831bad0, aMsg=0x82293a8) at nsDocLoader.cpp:1663
#73 0x401f68e2 in stub_Progress (context=0x83d3918,
    msg=0x83100a8 "Connect: Contacting host: cvs-mirror.mozilla.org...")
    at nsStubContext.cpp:362
#74 0x401d3703 in NET_Progress (context=0x83d3918,
    msg=0x83100a8 "Connect: Contacting host: cvs-mirror.mozilla.org...")
    at mkutils.c:98
#75 0x401c1a1f in net_start_first_connect (
    host=0x8310248 "cvs-mirror.mozilla.org", sock=0x804f950,
    window_id=0x83d3918, tcp_con_data=0x84647b0, error_msg=0x8310be0,
    localIP=0) at mkconect.c:872
#76 0x401c23d5 in NET_BeginConnect (
    url=0x8336090
"http://cvs-mirror.mozilla.org/webtools/tinderbox/1afi003r.gif",
ip_address_string=0x0, prot_name=0x401099c5 "HTTP", def_port=80,
    sock=0x8310c4c, dummy=0 '\000', tcp_con_data=0x83d3abc,
    window_id=0x83d3918, error_msg=0x8310be0, socks_host=0, socks_port=0,
    localIP=0) at mkconect.c:1259
#77 0x400fcae9 in net_start_http_connect (ce=0x83360d8) at mkhttp.c:498
#78 0x401041a1 in net_ProcessHTTP (ce=0x83360d8) at mkhttp.c:3442
#79 0x401040da in net_HTTPLoad (ce=0x83360d8) at mkhttp.c:3418
#80 0x401c7416 in NET_GetURL (URL_s=0x8310ad8, output_format=102,
    window_id=0x83d3918,
    exit_routine=0x401f09a4 <bam_exit_routine(URL_Struct_ *, int, MWContext_
*)>) at mkgeturl.c:3034
#81 0x401ef0b1 in nsNetlibService::OpenStream (this=0x804e5b0, aUrl=0x831bad0,
    aConsumer=0x832d5f0) at nsNetService.cpp:433
#82 0x40213f5e in nsDocumentBindInfo::Bind (this=0x832d5f0, aURL=0x831bad0,
    aListener=0x832d5c0) at nsDocLoader.cpp:1572
#83 0x40213241 in nsDocLoaderImpl::OpenStream (this=0x824ace8, aUrl=0x831bad0,
    aConsumer=0x832d5c0) at nsDocLoader.cpp:1187
#84 0x401f0621 in NS_OpenURL (aURL=0x831bad0, aConsumer=0x832d5c0)
    at nsNetService.cpp:1156
#85 0x400a97b9 in ImageNetContextImpl::GetURL (this=0x8137d88, aURL=0x8381298,
    aLoadMethod=NET_NORMAL_RELOAD, aReader=0x8326298)
    at nsImageNetContextAsync.cpp:490
#86 0x4075f37c in IL_GetImage (
    image_url=0x83253c8
"http://cvs-mirror.mozilla.org/webtools/tinderbox/1afi003r.gif",
img_cx=0x82855e0, obs_list=0x84617e0, background_color=0xbfffd500,
    req_width=0, req_height=0, flags=0, opaque_cx=0x8285070) at if.cpp:1918
#87 0x400aa2f3 in ImageRequestImpl::Init (this=0x8137ac0,
    aGroupContext=0x82855e0,
    aUrl=0x83253c8
"http://cvs-mirror.mozilla.org/webtools/tinderbox/1afi003r.gif",
aObserver=0x8137a78, aBackgroundColor=0x8468a88, aWidth=0, aHeight=0,
    aFlags=0, aNetContext=0x8285070) at nsImageRequest.cpp:107
#88 0x400a7e4e in ImageGroupImpl::GetImage (this=0x82855a8,
    aUrl=0x83253c8
"http://cvs-mirror.mozilla.org/webtools/tinderbox/1afi003r.gif",
aObserver=0x8137a78, aBackgroundColor=0x8468a88, aWidth=0, aHeight=0,
    aFlags=0) at nsImageGroup.cpp:233
#89 0x403cbbf2 in nsFrameImageLoader::Init (this=0x8137a78,
    aPresContext=0x82799f8, aGroup=0x82855a8, aURL=@0x8468a94,
    aBackgroundColor=0x8468a88, aTargetFrame=0x8468ce0,
    aDesiredSize=@0xbfffd6dc, aCallBack=0, aNeedSizeUpdate=0,
    aNeedErrorNotification=0) at nsFrameImageLoader.cpp:156
#90 0x403d1bbd in nsPresContext::StartLoadImage (this=0x82799f8,
    aURL=@0x8468a94, aBackgroundColor=0x8468a88, aTargetFrame=0x8468ce0,
    aDesiredSize=@0xbfffd6dc, aCallBack=0, aNeedSizeUpdate=0,
    aNeedErrorNotification=0, aLoaderResult=0xbfffd6e8)
    at nsPresContext.cpp:734
#91 0x4050d8b6 in nsCSSRendering::PaintBackground (aPresContext=@0x82799f8,
    aRenderingContext=@0x83af8a8, aForFrame=0x8468ce0, aDirtyRect=@0xbfffd7dc,
    aBorderArea=@0xbfffd794, aColor=@0x8468a7c, aSpacing=@0x8468abc, aDX=0,
    aDY=0) at nsCSSRendering.cpp:1676
#92 0x40534ecd in nsTableCellFrame::Paint (this=0x8468ce0,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffd7dc, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableCellFrame.cpp:153
#93 0x405485f1 in nsTableRowFrame::PaintChildren (this=0x84652d0,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffd86c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableRowFrame.cpp:348
#94 0x40548495 in nsTableRowFrame::Paint (this=0x84652d0,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffd86c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableRowFrame.cpp:304
#95 0x4054b8ce in nsTableRowGroupFrame::PaintChildren (this=0x8464ff8,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffd904, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableRowGroupFrame.cpp:288
#96 0x4054b791 in nsTableRowGroupFrame::Paint (this=0x8464ff8,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffd904, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableRowGroupFrame.cpp:246
#97 0x403ffe22 in nsContainerFrame::PaintChild (this=0x8464af8,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffda38, aFrame=0x8464ff8,
    aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:276
#98 0x403ffc8a in nsContainerFrame::PaintChildren (this=0x8464af8,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffda38, aWhichLayer=eFramePaintLayer_Underlay)
    at nsContainerFrame.cpp:216
#99 0x4053e32a in nsTableFrame::Paint (this=0x8464af8,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffda38, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableFrame.cpp:2315
#100 0x403ffe22 in nsContainerFrame::PaintChild (this=0x8464a98,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdb20, aFrame=0x8464af8,
    aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:276
#101 0x403ffc8a in nsContainerFrame::PaintChildren (this=0x8464a98,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdb20, aWhichLayer=eFramePaintLayer_Underlay)
    at nsContainerFrame.cpp:216
#102 0x40545523 in nsTableOuterFrame::Paint (this=0x8464a98,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdb20, aWhichLayer=eFramePaintLayer_Underlay)
    at nsTableOuterFrame.cpp:138
#103 0x403ffe22 in nsContainerFrame::PaintChild (this=0x8283408,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdc2c, aFrame=0x8464a98,
    aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:276
#104 0x403fba04 in nsBlockFrame::PaintChildren (this=0x8283408,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdc2c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsBlockFrame.cpp:4335
#105 0x403fb853 in nsBlockFrame::Paint (this=0x8283408,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdc2c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsBlockFrame.cpp:4287
#106 0x403ffe22 in nsContainerFrame::PaintChild (this=0x8283078,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdf2c, aFrame=0x8283408,
    aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:276
#107 0x403fba04 in nsBlockFrame::PaintChildren (this=0x8283078,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdf2c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsBlockFrame.cpp:4335
#108 0x403fb853 in nsBlockFrame::Paint (this=0x8283078,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdf2c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsBlockFrame.cpp:4287
#109 0x403f2829 in nsAreaFrame::Paint (this=0x8283078,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffdf2c, aWhichLayer=eFramePaintLayer_Underlay)
    at nsAreaFrame.cpp:222
#110 0x403ffe22 in nsContainerFrame::PaintChild (this=0x827efd0,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffe184, aFrame=0x8283078,
    aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:276
#111 0x403ffc8a in nsContainerFrame::PaintChildren (this=0x827efd0,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffe184, aWhichLayer=eFramePaintLayer_Underlay)
    at nsContainerFrame.cpp:216
#112 0x4040977b in nsHTMLContainerFrame::Paint (this=0x827efd0,
    aPresContext=@0x82799f8, aRenderingContext=@0x83af8a8,
    aDirtyRect=@0xbfffe184, aWhichLayer=eFramePaintLayer_Underlay)
    at nsHTMLContainerFrame.cpp:78
#113 0x40422948 in PresShell::Paint (this=0x8294058, aView=0x8282fd0,
    aRenderingContext=@0x83af8a8, aDirtyRect=@0xbfffe184)
    at nsPresShell.cpp:1873
#114 0x40d24b7d in nsView::Paint (this=0x8282fd0, rc=@0x83af8a8,
    rect=@0xbfffe184, aPaintFlags=0, aResult=@0xbfffe1bc) at nsView.cpp:622
#115 0x40d23fcd in nsView::Paint (this=0x8282588, rc=@0x83af8a8,
    rect=@0xbfffe24c, aPaintFlags=0, aResult=@0xbfffe25c) at nsView.cpp:384
#116 0x40d2b037 in nsViewManager::RenderViews (this=0x8293998,
    aRootView=0x8282588, aRC=@0x83af8a8, aRect=@0xbfffe24c,
    aResult=@0xbfffe25c) at nsViewManager.cpp:1246
#117 0x40d2aec4 in nsViewManager::Refresh (this=0x8293998, aView=0x8282588,
    aContext=0x83af8a8, rect=0xbfffe2e0, aUpdateFlags=0)
    at nsViewManager.cpp:519
#118 0x40d2b8b6 in nsViewManager::DispatchEvent (this=0x8293998,
    aEvent=0xbfffe3a0, aStatus=@0xbfffe324) at nsViewManager.cpp:1626
#119 0x40d23378 in HandleEvent (aEvent=0xbfffe3a0) at nsView.cpp:63
#120 0x4008d112 in nsWidget::DispatchEvent (this=0x8137478, event=0xbfffe3a0,
    aStatus=@0xbfffe360) at nsWidget.cpp:840
#121 0x4008cff0 in nsWidget::DispatchWindowEvent (this=0x8137478,
    event=0xbfffe3a0) at nsWidget.cpp:800
#122 0x4008e0b1 in nsWindow::OnPaint (this=0x8137478, event=@0xbfffe3a0)
    at nsWindow.cpp:430
#123 0x40089e75 in handle_expose_event (w=0x8282640, event=0xbfffe74c,
    p=0x8137478) at nsGtkEventHandler.cpp:432
#124 0x4090a3c9 in gtk_marshal_BOOL__POINTER (object=0x8282640,
    func=0x40089e14 <handle_expose_event(_GtkWidget *, _GdkEventExpose *, void
*)>, func_data=0x8137478, args=0xbfffe484) at gtkmarshal.c:32
#125 0x408cf11a in gtk_handlers_run (handlers=0x82feb10, signal=0xbfffe440,
    object=0x8282640, params=0xbfffe484, after=0) at gtksignal.c:1909
#126 0x408ce624 in gtk_signal_real_emit (object=0x8282640, signal_id=25,
    params=0xbfffe484) at gtksignal.c:1469
#127 0x408cc934 in gtk_signal_emit (object=0x8282640, signal_id=25)
    at gtksignal.c:552
#128 0x40901a84 in gtk_widget_event (widget=0x8282640, event=0xbfffe74c)
    at gtkwidget.c:2784
#129 0x40898ca3 in gtk_layout_expose_area (layout=0x8282640, x=0, y=321,
    width=596, height=100) at gtklayout.c:867
#130 0x40898fcc in gtk_layout_adjustment_changed (adjustment=0x82826b8,
    layout=0x8282640) at gtklayout.c:1037
#131 0x4090a6eb in gtk_marshal_NONE__NONE (object=0x82826b8,
    func=0x40898cdc <gtk_layout_adjustment_changed>, func_data=0x8282640,
    args=0xbfffe914) at gtkmarshal.c:363
#132 0x408cf11a in gtk_handlers_run (handlers=0x82fec30, signal=0xbfffe8d0,
    object=0x82826b8, params=0xbfffe914, after=0) at gtksignal.c:1909
#133 0x408ce624 in gtk_signal_real_emit (object=0x82826b8, signal_id=57,
    params=0xbfffe914) at gtksignal.c:1469
#134 0x408cc934 in gtk_signal_emit (object=0x82826b8, signal_id=57)
    at gtksignal.c:552
#135 0x40837f10 in gtk_adjustment_value_changed (adjustment=0x82826b8)
    at gtkadjustment.c:163
#136 0x4008df86 in nsWindow::Scroll (this=0x8137478, aDx=0, aDy=-100,
    aClipRect=0x0) at nsWindow.cpp:383
#137 0x40d27a8e in nsScrollingView::HandleScrollEvent (this=0x830f808,
    aEvent=0xbfffed84, aEventFlags=28) at nsScrollingView.cpp:669
#138 0x40d2653b in ScrollBarView::HandleEvent (this=0x8282b88,
    aEvent=0xbfffed84, aEventFlags=28, aStatus=@0xbfffecd8)
    at nsScrollingView.cpp:89
#139 0x40d2bc90 in nsViewManager::DispatchEvent (this=0x8293998,
    aEvent=0xbfffed84, aStatus=@0xbfffecd8) at nsViewManager.cpp:1708
#140 0x40d23378 in HandleEvent (aEvent=0xbfffed84) at nsView.cpp:63
#141 0x400841b9 in nsScrollbar::OnScroll (this=0x830f648, aEvent=@0xbfffed84,
    cPos=3801) at nsScrollbar.cpp:406
#142 0x4008a44f in handle_scrollbar_value_changed (adj=0x8282bf8, p=0x830f648)
    at nsGtkEventHandler.cpp:712
#143 0x4090a6eb in gtk_marshal_NONE__NONE (object=0x8282bf8,
    func=0x4008a3a8 <handle_scrollbar_value_changed(_GtkAdjustment *, void *)>,
func_data=0x830f648, args=0xbfffee64) at gtkmarshal.c:363
#144 0x408cf11a in gtk_handlers_run (handlers=0x82fe870, signal=0xbfffee1c,
    object=0x8282bf8, params=0xbfffee64, after=0) at gtksignal.c:1909
#145 0x408ce624 in gtk_signal_real_emit (object=0x8282bf8, signal_id=57,
    params=0xbfffee64) at gtksignal.c:1469
#146 0x408ccc27 in gtk_signal_emit_by_name (object=0x8282bf8,
    name=0x40919b55 "value_changed") at gtksignal.c:618
#147 0x408c19cb in gtk_range_default_vmotion (range=0x830f2c0, xdelta=2,
    ydelta=11) at gtkrange.c:675
#148 0x408c2998 in gtk_range_motion_notify (widget=0x830f2c0, event=0x812d928)
    at gtkrange.c:1024
#149 0x4090a3c9 in gtk_marshal_BOOL__POINTER (object=0x830f2c0,
    func=0x408c277c <gtk_range_motion_notify>, func_data=0x0, args=0xbffff230)
    at gtkmarshal.c:32
#150 0x408ce65b in gtk_signal_real_emit (object=0x830f2c0, signal_id=22,
    params=0xbffff230) at gtksignal.c:1484
#151 0x408cc934 in gtk_signal_emit (object=0x830f2c0, signal_id=22)
    at gtksignal.c:552
#152 0x40901a84 in gtk_widget_event (widget=0x830f2c0, event=0x812d928)
    at gtkwidget.c:2784
#153 0x408a1851 in gtk_propagate_event (widget=0x830f2c0, event=0x812d928)
    at gtkmain.c:1321
#154 0x408a0b86 in gtk_main_do_event (event=0x812d928) at gtkmain.c:778
#155 0x40946e86 in gdk_event_dispatch (source_data=0x0,
    current_time=0xbffff5b0, user_data=0x0) at gdkevents.c:2086
#156 0x40972d53 in g_main_dispatch (current_time=0xbffff5b0) at gmain.c:644
#157 0x409732df in g_main_iterate (block=1, dispatch=1) at gmain.c:851
#158 0x40973461 in g_main_run (loop=0x812d170) at gmain.c:909
#159 0x408a05f7 in gtk_main () at gtkmain.c:501
#160 0x400823c0 in nsAppShell::Run (this=0x80e9fb8) at nsAppShell.cpp:152
#161 0x40017cd1 in nsAppShellService::Run (this=0x80e9b70)
    at nsAppShellService.cpp:178
#162 0x804a47c in main (argc=1, argv=0xbffff6d4) at nsAppRunner.cpp:337
cool. thanks - that's exactly what i needed.

the basic sequence of things is:
1) we get a paint message and begin drawing the content.
2) along the way an image needs to draw and an image fetch is made.
3) netlib synchronously calls back with status messages which are triggering
   attribute changes in layout/style.
4) the attribute changes trigger a reflow which repositions views/widgets.
5) when we are done positioning the widgets after the reflow, gtk asks for a
   synchronous refresh of any damaged area.
6) we end up back in the paint code and bad things ensue.

soooo, possible things are:

1) why does gtk issue a synchronous refresh? it can do refreshes asynchronously
   and this would seem like the right thing to do (and make this one case go
   away).
2) the attribute changes are causing a reflow and the general rule that we have
   had in nglayout all along is to never do anything in a Paint() method that
   can cause a reflow or you get the above results.
3) maybe netlib should not be synchronously calling back with the
   messages which cause the attribute change stuff.
adding ramiro
Priority: P2 → P1
I'm seeing this same behavior, same stack trace, when
visiting http://www.nytimes.com.  Works in viewer,
crashes in apprunner.
QA Contact: 3853 → 4079
Target Milestone: M3
sujay, check with mcafee on which build this was.  All reports show that the M3
official Linux build at:
ftp://sweetlou/products/client/seamonkey/linux_glibc/2.0/x86/Mar_18-M3/
was ok.  Still true?
Jan, I just tried that build you indicatedabove  again and it runs fine for me.

I jumped to a site with tables and no crash for me..I even tried
that URL indicated above, but its Not Found. I'll go ahead and try
viewer, but my guess is that will work fine also...
more comments. Now I am able to get that URL above to work .
I scrolled all the way up and down on that page and it works fine.

I used this build:

ftp://sweetlou/products/client/seamonkey/linux_glibc/2.0/x86/Mar_18-M3/

On this URL:

http://cvs-mirror.mozilla.org/webtools/tinderbox/showbuilds.cgi?tree=SeaMonkey&hours=12&nocrap=1

And apprunner doesn't crash for me.
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → WORKSFORME
This is working for me now, marking so.
Status: RESOLVED → VERIFIED
marking verified.
Status: VERIFIED → REOPENED
Status: REOPENED → RESOLVED
Closed: 25 years ago25 years ago
Resolution: WORKSFORME → DUPLICATE
*** This bug has been marked as a duplicate of 4363 ***
Status: RESOLVED → VERIFIED
verified in 3/29 build.
Moving all Apprunner bugs past and present to Other component temporarily whilst
don and I set correct component.  Apprunner component will be deleted/retired
shortly.
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.