444916 - crash in nsRuleNode::GetStyleBackground

Status: RESOLVED DUPLICATE of bug 444894

(Core :: Layout, defect)

Description

[sam morris]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en; rv:1.9) Gecko/20080528 Epiphany/2.22
Build Identifier: gecko-1.9

Epiphany keeps crashing with the following backtrace. It is triggered by changing the text size. It is not 100% reproducible however.

Distribution: Fedora release 8.92 (Rawhide)
Gnome Release: 2.22.0 2008-03-29 (Red Hat, Inc)
BugBuddy Version: 2.22.0

System: Linux 2.6.25-0.172.rc7.git4.fc9.i686 #1 SMP Fri Mar 28 21:46:59 EDT
2008 i686
X Vendor: The X.Org Foundation
X Vendor Release: 10499901
Selinux: No
Accessibility: Disabled
GTK+ Theme: Nodoka
Icon Theme: Crux

Memory status: size: 168525824 vsize: 168525824 resident: 37216256 share:
22851584 rss: 37216256 rss_rlim: 4294967295
CPU usage: start_time: 1206978566 rtime: 117 utime: 86 stime: 31 cutime:1
cstime: 7 timeout: 0 it_real_value: 0 frequency: 100

Backtrace was generated from '/usr/bin/epiphany'

[Thread debugging using libthread_db enabled]
[New Thread 0xb80a7730 (LWP 27867)]
[New Thread 0xb24acb90 (LWP 27878)]
[New Thread 0xb3c11b90 (LWP 27877)]
[New Thread 0xb4612b90 (LWP 27874)]
[New Thread 0xb5013b90 (LWP 27873)]
[New Thread 0xb5a14b90 (LWP 27872)]
[New Thread 0xb641cb90 (LWP 27868)]
0x00110416 in __kernel_vsyscall ()
#0  0x00110416 in __kernel_vsyscall ()
#1  0x003ca05b in waitpid () from /lib/libpthread.so.0
#2  0x006c3d87 in IA__g_spawn_sync (working_directory=<value optimized out>, 
    argv=<value optimized out>, envp=<value optimized out>, 
    flags=<value optimized out>, child_setup=<value optimized out>, 
    user_data=<value optimized out>, standard_output=<value optimized out>, 
    standard_error=<value optimized out>, exit_status=<value optimized out>, 
    error=<value optimized out>) at gspawn.c:374
#3  0x006c40cc in IA__g_spawn_command_line_sync (
    command_line=<value optimized out>, standard_output=) at gspawn.c:682
#4  0x0097d253 in run_bug_buddy (appname=<value optimized out>, 
    pid=<value optimized out>, minidump_path=0x0) at gnome-breakpad.cc:213
#5  0x0097d7d8 in check_if_gdb (callback_context=0x0) at gnome-breakpad.cc:283
#6  0x0097d893 in google_breakpad::ExceptionHandler::InternalWriteMinidump (
    this=0x9875c0, signo=11, sighandler_ebp=3221065896, sig_ctx=0xbffd9094)
    at ../google-breakpad/src/client/linux/handler/exception_handler.cc:226
#7  0x0097de23 in google_breakpad::ExceptionHandler::HandleException (
    signo=11)
    at ../google-breakpad/src/client/linux/handler/exception_handler.cc:197
#8  0x034d3a6d in nsProfileLock::FatalSignalHandler (
    signo=<value optimized out>) at nsProfileLock.cpp:216
#9  <signal handler called>
#10 0x03723b7b in nsRuleNode::GetStyleBackground (this=<value optimized out>, 
    aContext=<value optimized out>, aComputeData=<value optimized out>)
    at nsRuleNode.h:215
#11 0x03726f35 in nsStyleContext::GetStyleBackground (
    this=<value optimized out>) at nsStyleStructList.h:79
#12 0x037274ce in nsStyleContext::CalcStyleDifference (
    this=<value optimized out>, aOther=<value optimized out>)
    at nsStyleContext.cpp:472
#13 0x036544af in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1058
#14 0x03654a6b in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1125
#15 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#16 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#17 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#18 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#19 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#20 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#21 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#22 0x036547ab in nsFrameManager::ReResolveStyleContext (
    this=<value optimized out>, aPresContext=<value optimized out>, 
    aFrame=<value optimized out>, aParentContent=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1404
#23 0x03654c10 in nsFrameManager::ComputeStyleChangeFor (
    this=<value optimized out>, aFrame=<value optimized out>, 
    aChangeList=<value optimized out>, aMinChange=<value optimized out>)
    at nsFrameManager.cpp:1470
#24 0x0363c047 in nsCSSFrameConstructor::RebuildAllStyleData (
    this=<value optimized out>, aExtraHint=<value optimized out>)
    at nsCSSFrameConstructor.cpp:13415
#25 0x0364f5ed in DocumentViewerImpl::SetTextZoom (
    this=<value optimized out>, aTextZoom=<value optimized out>)
    at nsPresContext.h:470
#26 0x080c786a in EphyBrowser::SetZoom (this=0x9235d10, aZoom=1.18920708)
    at EphyBrowser.cpp:906
#27 0x080ba1ab in impl_set_zoom (embed=0x91d18b8, zoom=1.18920708)
    at mozilla-embed.cpp:620
#28 0x080ef00d in ephy_embed_set_zoom (embed=0x91d18b8, zoom=1.18920708)
    at ephy-embed.c:627
#29 0x0807a4ca in ephy_window_set_zoom (window=0x8fad130, zoom=1.18920708)
    at ephy-window.c:3727
#30 0x0808ac15 in window_cmd_view_zoom_in (action=0x91ff200, window=0x8fad130)
    at window-commands.c:576
#31 0x008d08b4 in IA__g_cclosure_marshal_VOID__VOID (
    closure=<value optimized out>, return_value=) at gmarshal.c:77
#32 0x008c312b in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#33 0x008d7995 in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:2440
#34 0x008d8ece in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#35 0x008d9336 in IA__g_signal_emit (instance=) at gsignal.c:2243
#36 0x00a33aa2 in _gtk_action_emit_activate (action=) at gtkaction.c:877
#37 0x00a33b69 in IA__gtk_action_activate (action=) at gtkaction.c:904
#38 0x008d08b4 in IA__g_cclosure_marshal_VOID__VOID (
    closure=<value optimized out>, return_value=) at gmarshal.c:77
#39 0x008c312b in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#40 0x008d7995 in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:2440
#41 0x008d8ece in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#42 0x008d91dd in IA__g_signal_emit_by_name (instance=<value optimized out>, 
    detailed_signal=<value optimized out>) at gsignal.c:2267
#43 0x00c60223 in button_clicked (widget=) at gtktoolbutton.c:667
#44 0x008d08b4 in IA__g_cclosure_marshal_VOID__VOID (
    closure=<value optimized out>, return_value=) at gmarshal.c:77
#45 0x008c312b in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#46 0x008d7995 in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:2440
#47 0x008d8ece in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#48 0x008d9336 in IA__g_signal_emit (instance=) at gsignal.c:2243
#49 0x00a4e961 in IA__gtk_button_clicked (button=) at gtkbutton.c:889
#50 0x00a4fdc2 in gtk_real_button_released (button=) at gtkbutton.c:1484
#51 0x008d08b4 in IA__g_cclosure_marshal_VOID__VOID (
    closure=<value optimized out>, return_value=) at gmarshal.c:77
#52 0x008c18a9 in g_type_class_meta_marshal (closure=<value optimized out>, 
    return_value=) at gclosure.c:567
#53 0x008c312b in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#54 0x008d71ee in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:2370
#55 0x008d8ece in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2199
#56 0x008d9336 in IA__g_signal_emit (instance=) at gsignal.c:2243
#57 0x00a4e8ba in IA__gtk_button_released (button=) at gtkbutton.c:881
#58 0x00a4fbb2 in gtk_button_button_release (widget=) at gtkbutton.c:1377
#59 0x00b5511a in _gtk_marshal_BOOLEAN__BOXED (closure=) at gtkmarshalers.c:84
#60 0x008c18a9 in g_type_class_meta_marshal (closure=<value optimized out>, 
    return_value=) at gclosure.c:567
#61 0x008c312b in IA__g_closure_invoke (closure=<value optimized out>, 
    return_value=<value optimized out>, n_param_values=<value optimized out>, 
    param_values=<value optimized out>, invocation_hint=<value optimized out>)
    at gclosure.c:490
#62 0x008d763d in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:2478
#63 0x008d8d58 in IA__g_signal_emit_valist (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=<value optimized out>) at gsignal.c:2209
#64 0x008d9336 in IA__g_signal_emit (instance=) at gsignal.c:2243
#65 0x00cc691c in gtk_widget_event_internal (widget=) at gtkwidget.c:4678
#66 0x00cc6444 in IA__gtk_widget_event (widget=) at gtkwidget.c:4478
#67 0x00b536d7 in IA__gtk_propagate_event (widget=) at gtkmain.c:2336
#68 0x00b521c1 in IA__gtk_main_do_event (event=) at gtkmain.c:1556
#69 0x0015dfac in gdk_event_dispatch (source=) at gdkevents-x11.c:2351
#70 0x0068b068 in IA__g_main_context_dispatch (context=<value optimized out>)
    at gmain.c:2003
#71 0x0068e713 in g_main_context_iterate (context=<value optimized out>, 
    block=<value optimized out>, dispatch=<value optimized out>, self=)
    at gmain.c:2636
#72 0x0068ec32 in IA__g_main_loop_run (loop=<value optimized out>)
    at gmain.c:2844
#73 0x00b518e9 in IA__gtk_main () at gtkmain.c:1163
#74 0x080719d8 in main (argc=1, argv=0xbffdc924) at ephy-main.c:726

Thread 7 (Thread 0xb641cb90 (LWP 27868)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x002ee5d7 in __poll (fds=<value optimized out>, 
    nfds=<value optimized out>, timeout=<value optimized out>)
    at ../sysdeps/unix/sysv/linux/poll.c:87
        resultvar = <value optimized out>
        oldtype = <value optimized out>
        result = <value optimized out>
#2  0x02915b34 in ?? () from /lib/libnspr4.so
No symbol table info available.
#3  0x03532dd9 in nsSocketTransportService::Poll (this=<value optimized out>, 
    wait=<value optimized out>, interval=)
    at nsSocketTransportService2.cpp:349
        pollList = <value optimized out>
        pollCount = <value optimized out>
        pollTimeout = <value optimized out>
        ts = <value optimized out>
        rv = <value optimized out>
        passedInterval = <value optimized out>
#4  0x035332ee in nsSocketTransportService::DoPollIteration (
    this=<value optimized out>, wait=<value optimized out>)
    at nsSocketTransportService2.cpp:644
        i = <value optimized out>
        pollInterval = <value optimized out>
        n = <value optimized out>
#5  0x035335aa in nsSocketTransportService::OnProcessNextEvent (
    this=<value optimized out>, thread=<value optimized out>, 
    mayWait=<value optimized out>, depth=<value optimized out>)
    at nsSocketTransportService2.cpp:523
        val = <value optimized out>
#6  0x03ceaf9a in nsThread::ProcessNextEvent (this=<value optimized out>, 
    mayWait=<value optimized out>, result=<value optimized out>)
    at nsThread.cpp:497
        notifyGlobalObserver = 1
        obs = 
Thread 6 (Thread 0xb5a14b90 (LWP 27872)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x003c63b2 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
No locals.
#2  0x02912dbe in ?? () from /lib/libnspr4.so
No symbol table info available.
#3  0x02913be0 in PR_WaitCondVar () from /lib/libnspr4.so
No symbol table info available.
#4  0x03cee64e in TimerThread::Run (this=<value optimized out>)
    at TimerThread.cpp:345
        waitFor = <value optimized out>
        lock = 
Thread 5 (Thread 0xb5013b90 (LWP 27873)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x003c6085 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
No locals.
#2  0x02913c57 in PR_WaitCondVar () from /lib/libnspr4.so
No symbol table info available.
#3  0x03b0aa2d in nsSSLThread::Run (this=<value optimized out>)
    at nsSSLThread.cpp:964
        threadLock = 
Thread 4 (Thread 0xb4612b90 (LWP 27874)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x003c6085 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
No locals.
#2  0x02913c57 in PR_WaitCondVar () from /lib/libnspr4.so
No symbol table info available.
#3  0x03b0bb9d in nsCertVerificationThread::Run (this=<value optimized out>)
    at nsCertVerificationThread.cpp:138
        threadLock = 
Thread 3 (Thread 0xb3c11b90 (LWP 27877)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x003c63b2 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
No locals.
#2  0x02912dbe in ?? () from /lib/libnspr4.so
No symbol table info available.
#3  0x02913be0 in PR_WaitCondVar () from /lib/libnspr4.so
No symbol table info available.
#4  0x02913cd7 in PR_Wait () from /lib/libnspr4.so
No symbol table info available.
#5  0x03ced13b in nsThreadPool::Run (this=<value optimized out>)
    at ../../dist/include/xpcom/nsAutoLock.h:340
        now = <value optimized out>
        timeout = <value optimized out>
        mon = 
Thread 2 (Thread 0xb24acb90 (LWP 27878)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x003c63b2 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
No locals.
#2  0x02912dbe in ?? () from /lib/libnspr4.so
No symbol table info available.
#3  0x02913be0 in PR_WaitCondVar () from /lib/libnspr4.so
No symbol table info available.
#4  0x0353ccfb in nsHostResolver::GetHostToLookup (
    this=<value optimized out>, result=) at nsHostResolver.cpp:595
        delta = <value optimized out>
        lock = 
Thread 1 (Thread 0xb80a7730 (LWP 27867)):
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x003ca05b in waitpid () from /lib/libpthread.so.0
No locals.
#2  0x006c3d87 in IA__g_spawn_sync (working_directory=<value optimized out>, 
    argv=<value optimized out>, envp=<value optimized out>, 
    flags=<value optimized out>, child_setup=<value optimized out>, 
    user_data=<value optimized out>, standard_output=<value optimized out>, 
    standard_error=<value optimized out>, exit_status=<value optimized out>, 
    error=<value optimized out>) at gspawn.c:374
        outpipe = <value optimized out>
        errpipe = <value optimized out>
        pid = <value optimized out>
        fds = #0  0x00110416 in __kernel_vsyscall ()
The program is running.  Quit anyway (and detach it)? (y or n) [answered Y;
input not from terminal]


Reproducible: Sometimes

Steps to Reproduce:
1. Resize text
2.
3.
Actual Results:  
Crash

Expected Results:  
No crash

Forwarded from <http://bugzilla.gnome.org/show_bug.cgi?id=525357>. You can see many, many, many duplicates with similar backtraces.

Comment 1

[sam morris]

Recipe to reproduce this 100% reliably with 1.9 rc2:

 1. Go to http://erlang.org/
 2. Increase text size

Comment 2

[sam morris]

Attachment: backtrace with rc2

And here's the backtrace. Attached since it is too large for a comment.