435838 - Crash when scrolling with windowless plugins

Status: RESOLVED DUPLICATE of bug 435764

(Core Graveyard :: Plug-ins, defect)

Description

[Benjamin Otte]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en; rv:1.9b5) Gecko Epiphany/2.22
Build Identifier: Ubuntu Hardy 3.0~b5+nobinonly-0ubuntu3

This bug was filed as http://bugs.freedesktop.org/show_bug.cgi?id=16103 - from the stacktrace this looks like it's a Mozilla fault.

Reproducible: Always

Steps to Reproduce:
1. Install swfdec-mozilla (or any other Flash plugin that supports windowless mode. 
2. Go to http://www.leparisien.fr (the site is dynamic, it works on the version from 2008-05-27)
3. Slowly scroll to the bottom
Actual Results:  
When the bottom Flash comes into view, the browser segfaults

Expected Results:  
It scrolls to the bottom.

(gdb) where
#0  cairo_draw_with_xlib (cr=0xb49d400, callback=0xb78a45dc <NativeRendering>, closure=0xbfc821d4, dpy=0x0, width=138, height=298, 
    is_opaque=CAIRO_XLIB_DRAWING_OPAQUE, capabilities=27, result=0x0) at cairo-xlib-utils.c:329
#1  0xb78a46c1 in gfxXlibNativeRenderer::Draw (this=0xbfc82224, dpy=0x0, ctx=0xb49dc80, width=138, height=298, flags=0, output=0x0)
    at gfxXlibNativeRenderer.cpp:101
#2  0xb725b7bf in nsPluginInstanceOwner::Paint (this=0x9ecf850, aRenderingContext=@0xb534a78, aDirtyRect=@0xbfc822c4) at nsObjectFrame.cpp:4019
#3  0xb725b82d in nsObjectFrame::PaintPlugin (this=0xa0fc010, aRenderingContext=@0xb534a78, aDirtyRect=@0xbfc822c4) at nsObjectFrame.cpp:1389
#4  0xb725b87f in PaintPlugin (aFrame=0xa0fc010, aCtx=0xb534a78, aDirtyRect=@0xbfc82380, aPt=@0xbfc82318) at nsObjectFrame.cpp:1085
#5  0xb724c890 in nsDisplayGeneric::Paint (this=0xa940be4, aBuilder=0xbfc8245c, aCtx=0xb534a78, aDirtyRect=@0xbfc82380)
    at ./../../../../../base/nsDisplayList.h:838
#6  0xb7204c95 in nsDisplayList::Paint (this=0xa940cb8, aBuilder=0xbfc8245c, aCtx=0xb534a78, aDirtyRect=@0xbfc82380) at nsDisplayList.cpp:294
#7  0xb7205fb9 in nsDisplayClip::Paint (this=0xa940cac, aBuilder=0xbfc8245c, aCtx=0xb534a78, aDirtyRect=@0xbfc82740) at nsDisplayList.cpp:691
#8  0xb7204c95 in nsDisplayList::Paint (this=0xbfc82454, aBuilder=0xbfc8245c, aCtx=0xb534a78, aDirtyRect=@0xbfc82740) at nsDisplayList.cpp:294
#9  0xb7212deb in nsLayoutUtils::PaintFrame (aRenderingContext=0xb534a78, aFrame=0x8c80790, aDirtyRegion=@0xbfc82720, aBackground=4294967295)
    at nsLayoutUtils.cpp:875
#10 0xb721ac3a in PresShell::Paint (this=0x8c7cb38, aView=0x0, aRenderingContext=0xb534a78, aDirtyRegion=@0xbfc82720) at nsPresShell.cpp:5436
#11 0xb745eee0 in nsViewManager::RenderViews (this=0x8c78f08, aView=0x8c78f68, aRC=@0xb534a78, aRegion=@0xbfc827f0) at nsViewManager.cpp:614
#12 0xb745f18f in nsViewManager::Refresh (this=0x8c78f08, aView=0x962b580, aContext=0xb534a78, aRegion=0xa9417c0, aUpdateFlags=1)
    at nsViewManager.cpp:502
#13 0xb74600d9 in nsViewManager::DispatchEvent (this=0x8c78f08, aEvent=0xbfc829cc, aStatus=0xbfc82960) at nsViewManager.cpp:1140
#14 0xb745b271 in HandleEvent (aEvent=0xbfc829cc) at nsView.cpp:168
#15 0xb77a5230 in nsCommonWidget::DispatchEvent (this=0x98db270, aEvent=0xbfc829cc, aStatus=@0xbfc82ab8) at nsCommonWidget.cpp:158
#16 0xb779f2ab in nsWindow::OnExposeEvent (this=0x98db270, aWidget=0x8160788, aEvent=0xbfc83114) at nsWindow.cpp:1763
#17 0xb77a1d14 in expose_event_cb (widget=0x8160788, event=0xbfc83114) at nsWindow.cpp:4512
#18 0xb678a8d4 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#19 0x08160788 in ?? ()
#20 0xbfc83114 in ?? ()
#21 0x00000000 in ?? ()

Comment 1

[Benjamin Otte]

Oops, Silvian already filed this as bug 435764.