447719 - Epiphany crashes when I try to enlarge the font [@ nsPresContext::AllocateFromShell - nsRuleNode::ComputeBackgroundData]

Status: RESOLVED DUPLICATE of bug 444894

(Core :: Layout, defect)

Description

[Alvaro Herrera]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en; rv:1.9) Gecko/20080528 Epiphany/2.22
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en; rv:1.9) Gecko/20080528 Epiphany/2.22

The browser crashes when I try to enlarge the fonts.

I reported this to the Epiphany devs, but they determined that it is a bug in the Xulrunner component, so they asked me to report it here.  I tried to reproduce it with Firefox, but it doesn't actually crash.

This is the bug I reported:
http://bugzilla.gnome.org/show_bug.cgi?id=544361
It's been said to be a duplicate of this other bug:
http://bugzilla.gnome.org/show_bug.cgi?id=543589

Reproducible: Always




This is the backtrace as captured by Bug Buddy.

#6  <signal handler called>
#7  0x0ec3c1da in ?? ()
#8  0xb6131201 in nsPresContext::AllocateFromShell (this=0xc353b18, aSize=20)
    at ../../dist/include/layout/nsPresContext.h:253
#9  0xb612aa84 in nsRuleNode::ComputeBackgroundData (this=0x10ee549c, 
    aStartStruct=0x0, aData=@0xbfa686d8, aContext=0xe0c5710, 
    aHighestNode=0x10ee544c, aRuleDetail=nsRuleNode::eRuleFullReset, 
    aInherited=0) at nsStyleStruct.h:151
#10 0xb612f5fd in nsRuleNode::WalkRuleTree (this=0x10ee549c, 
    aSID=eStyleStruct_Background, aContext=0xe0c5710, aRuleData=0xbfa68728, 
    aSpecificData=0xbfa686d8) at nsStyleStructList.h:79
#11 0xb612fac3 in nsRuleNode::GetBackgroundData (this=0x10ee549c, 
    aContext=0xe0c5710) at nsRuleNode.cpp:1211
#12 0xb612fb31 in nsRuleNode::GetStyleBackground (this=0x10ee549c, 
    aContext=0xe0c5710, aComputeData=1) at nsStyleStructList.h:79
#13 0xb61326e9 in nsStyleContext::GetStyleBackground (this=0xea00954)
    at nsStyleStructList.h:79
#14 0xb6132c82 in nsStyleContext::CalcStyleDifference (this=0xe1c2594, 
    aOther=0xe0c5710) at nsStyleContext.cpp:472
#15 0xb606fcdf in nsFrameManager::ReResolveStyleContext (this=0xe2e62fc, 
    aPresContext=0xe1f8230, aFrame=0xd96dec8, aParentContent=0x0, 
    aChangeList=0xbfa688ec, aMinChange=0) at nsFrameManager.cpp:1058
#16 0xb60703d2 in nsFrameManager::ComputeStyleChangeFor (this=0xe2e62fc, 
    aFrame=0xd96dec8, aChangeList=0xbfa688ec, aMinChange=0)
    at nsFrameManager.cpp:1470
#17 0xb605974f in nsCSSFrameConstructor::RestyleElement (this=0xc2e0a48, 
    aContent=0xe2d9e70, aPrimaryFrame=0xd96dec8, 
    aMinHint=<value optimized out>) at nsCSSFrameConstructor.cpp:10067
#18 0xb60598b3 in nsCSSFrameConstructor::ProcessOneRestyle (this=0xc2e0a48, 
    aContent=0xe2d9e70, aRestyleHint=<value optimized out>, aChangeHint=0)
    at nsCSSFrameConstructor.cpp:13377
#19 0xb60599de in nsCSSFrameConstructor::ProcessPendingRestyles (
    this=0xc2e0a48) at nsCSSFrameConstructor.cpp:13471
#20 0xb607e150 in PresShell::DoFlushPendingNotifications (this=0xe2e62e0, 
    aType=Flush_Style, aInterruptibleReflow=0) at nsPresShell.cpp:4548
#21 0xb607e219 in PresShell::FlushPendingNotifications (this=0xe2e62e0, 
    aType=Flush_Style) at nsPresShell.cpp:4514
#22 0xb60489d5 in nsCSSFrameConstructor::RestyleEvent::Run (this=0x0)
    at nsCSSFrameConstructor.cpp:13544
#23 0xb6661686 in nsThread::ProcessNextEvent (this=0x8eeab30, mayWait=0, 
    result=0xbfa69158) at nsThread.cpp:510
#24 0xb663389a in NS_ProcessPendingEvents_P (thread=0x8eeab30, timeout=20)
    at nsThreadUtils.cpp:181
#25 0xb65b7b6e in nsBaseAppShell::NativeEventCallback (this=0x9aa0710)
    at nsBaseAppShell.cpp:121
#26 0xb65a3530 in nsAppShell::EventProcessorCallback (source=0x9ba8798, 
    condition=G_IO_IN, data=0x9aa0710) at nsAppShell.cpp:69
#27 0xb70af7cd in g_io_unix_dispatch (source=0x9a70af8, 
    callback=0xb65a3504 <nsAppShell::EventProcessorCallback(_GIOChannel*,
GIOCondition, void*)>, user_data=0x9aa0710)
    at /tmp/buildd/glib2.0-2.16.4/glib/giounix.c:162
#28 0xb70792f1 in IA__g_main_context_dispatch (context=0x8ec7ae0)
    at /tmp/buildd/glib2.0-2.16.4/glib/gmain.c:2012
#29 0xb707c983 in g_main_context_iterate (context=0x8ec7ae0, block=1, 
    dispatch=1, self=0x8e9e470)
    at /tmp/buildd/glib2.0-2.16.4/glib/gmain.c:2645
#30 0xb707cea2 in IA__g_main_loop_run (loop=0x9128e80)
    at /tmp/buildd/glib2.0-2.16.4/glib/gmain.c:2853
#31 0xb77bab99 in IA__gtk_main ()
    at /tmp/buildd/gtk+2.0-2.12.11/gtk/gtkmain.c:1163
#32 0x080770a8 in main (argc=1, argv=0xbfa6a514)
    at /build/buildd/epiphany-browser-2.22.3/src/ephy-main.c:744

Comment 1

[Alvaro Herrera]

Sorry, I pasted the backtrace for the other guy's crash.  The crash I can reproduce looks like this (bt full, after I disabled bug buddy):

#0  0x00007f4ef836622b in raise () from /lib/libpthread.so.0
No symbol table info available.
#1  0x00007f4ef1ef8391 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:212
        unblock_sigs = {__val = {1024, 0 <repeats 15 times>}}
        oldact = <value optimized out>
#2  <signal handler called>
No symbol table info available.
#3  nsPresContext::AllocateFromShell (this=<value optimized out>, aSize=24)
    at ../../dist/include/layout/nsPresContext.h:253
No locals.
#4  0x00007f4ef20fd948 in nsRuleNode::ComputeBackgroundData (this=0x279b8d0, 
    aStartStruct=0x0, aData=@0x7fff07f123d0, aContext=0x279bad8, 
    aHighestNode=0x279b840, aRuleDetail=nsRuleNode::eRulePartialReset, 
    aInherited=0) at nsStyleStruct.h:151
        parentContext = (nsStyleContext *) 0x279b648
        bg = <value optimized out>
        parentBG = <value optimized out>
        inherited = <value optimized out>
        parentFlags = <value optimized out>
#5  0x00007f4ef2102700 in nsRuleNode::WalkRuleTree (this=0x279b8d0, 
    aSID=eStyleStruct_Background, aContext=0x279bad8, aRuleData=0x7fff07f12470, 
    aSpecificData=0x7fff07f123d0) at nsStyleStructList.h:79
        startStruct = (void *) 0x18
        ruleNode = (nsRuleNode *) 0x0
        highestNode = (nsRuleNode *) 0x279b840
        rootNode = (nsRuleNode *) 0x2382070
        detail = nsRuleNode::eRulePartialReset
        isReset = <value optimized out>
        res = <value optimized out>
#6  0x00007f4ef2102c4d in nsRuleNode::GetBackgroundData (this=0x279b8d0, 
    aContext=0x279bad8) at nsRuleNode.cpp:1211
        colorData = {<nsCSSColor> = {<nsCSSStruct> = {<No data fields>}, 
    mColor = {mUnit = eCSSUnit_Null, mValue = {mInt = -233940851, 
        mFloat = -2.81945105e+30, mString = 0x7f4ef20e588d, mColor = 4061026445, 
        mArray = 0x7f4ef20e588d, mURL = 0x7f4ef20e588d, 
        mImage = 0x7f4ef20e588d}}, mBackColor = {mUnit = eCSSUnit_Null, 
      mValue = {mInt = 1124859904, mFloat = 140, mString = 0x430c0000, 
        mColor = 1124859904, mArray = 0x430c0000, mURL = 0x430c0000, 
        mImage = 0x430c0000}}, mBackImage = {mUnit = eCSSUnit_Image, mValue = {
        mInt = 36780224, mFloat = 1.30201927e-37, mString = 0x23138c0, 
        mColor = 36780224, mArray = 0x23138c0, mURL = 0x23138c0, 
        mImage = 0x23138c0}}, mBackRepeat = {mUnit = eCSSUnit_Null, mValue = {
        mInt = 8, mFloat = 1.12103877e-44, mString = 0x8, mColor = 8, 
        mArray = 0x8, mURL = 0x8, mImage = 0x8}}, mBackAttachment = {
      mUnit = eCSSUnit_Null, mValue = {mInt = 0, mFloat = 0, mString = 0x0, 
        mColor = 0, mArray = 0x0, mURL = 0x0, mImage = 0x0}}, mBackPosition = {
      mXValue = {mUnit = eCSSUnit_Null, mValue = {mInt = 0, mFloat = 0, 
          mString = 0x0, mColor = 0, mArray = 0x0, mURL = 0x0, mImage = 0x0}}, 
      mYValue = {mUnit = eCSSUnit_Null, mValue = {mInt = 0, mFloat = 0, 
          mString = 0x0, mColor = 0, mArray = 0x0, mURL = 0x0, mImage = 0x0}}}, 
    mBackClip = {mUnit = eCSSUnit_Null, mValue = {mInt = 0, mFloat = 0, 
        mString = 0x0, mColor = 0, mArray = 0x0, mURL = 0x0, mImage = 0x0}}, 
    mBackOrigin = {mUnit = eCSSUnit_Null, mValue = {mInt = 0, mFloat = 0, 
        mString = 0x0, mColor = 0, mArray = 0x0, mURL = 0x0, mImage = 0x0}}, 
    mBackInlinePolicy = {mUnit = eCSSUnit_Null, mValue = {mInt = 133244048, 
        mFloat = 3.62831392e-34, mString = 0x7fff07f12490, mColor = 133244048, 
        mArray = 0x7fff07f12490, mURL = 0x7fff07f12490, 
        mImage = 0x7fff07f12490}}}, <No data fields>}
        ruleData = {mSIDs = 4, mCanStoreInRuleTree = 1 '\001', 
  mIsImportantRule = 0 '\0', mLevel = 3 '\003', mPresContext = 0x2445ae0, 
  mStyleContext = 0x279bad8, mPostResolveCallback = 0, mFontData = 0x0, 
  mDisplayData = 0x0, mMarginData = 0x0, mListData = 0x0, mPositionData = 0x0, 
  mTableData = 0x0, mColorData = 0x7fff07f123d0, mContentData = 0x0, 
  mTextData = 0x0, mUserInterfaceData = 0x0, mXULData = 0x0, mSVGData = 0x0, 
  mColumnData = 0x0}
#7  0x00007f4ef2102cb3 in nsRuleNode::GetStyleBackground (this=0x1400000000, 
    aContext=0x18, aComputeData=133243856) at nsStyleStructList.h:79
        data = (const nsStyleBackground *) 0x1987ba0
#8  0x00007f4ef2105e48 in nsStyleContext::CalcStyleDifference (this=0x24e8b10, 
    aOther=0x279bad8) at nsStyleContext.cpp:472
        otherBackground = <value optimized out>
        thisBackground = <value optimized out>
        hint = 7
        compare = 1
#9  0x00007f4ef20479e6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e8cd8, aParentContent=0x24b0bc0, 
    aChangeList=0x7fff07f12df0, aMinChange=7) at nsFrameManager.cpp:1058
        oldColor = <value optimized out>
        newColor = <value optimized out>
        localContent = (class nsIContent *) 0x249a950
        content = (class nsIContent *) 0x249a950
        parentContext = (nsStyleContext *) 0x279b648
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x0
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x24e87b0
        newContext = <value optimized out>
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = (nsStyleContext *) 0x24e8b10
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#10 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e87b0, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24e8cd8
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x24b0bc0
        content = (class nsIContent *) 0x24b0bc0
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x0
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x24e8508
        newContext = (nsStyleContext *) 0x279b648
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#11 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e8508, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24e87b0
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x24b0b40
        content = (class nsIContent *) 0x24b0b40
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x0
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x24e8100
        newContext = (nsStyleContext *) 0x279ea90
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#12 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e8100, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24e8508
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x24a1180
        content = (class nsIContent *) 0x24a1180
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x0
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x24e7190
        newContext = (nsStyleContext *) 0x279e798
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#13 0x00007f4ef2047eb7 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e8088, aParentContent=0x24a10b0, 
    aChangeList=0x7fff07f12df0, aMinChange=7) at nsFrameManager.cpp:1125
        localContent = (class nsIContent *) 0x24a1180
        content = (class nsIContent *) 0x24a1180
        parentContext = <value optimized out>
        providerIsChild = 1
        pseudoTag = (class nsIAtom * const) 0x18df340
        resolvedChild = <value optimized out>
        providerFrame = (class nsIFrame *) 0x7fff07f123d0
        newContext = <value optimized out>
        contextIndex = <value optimized out>
        assumeDifferenceHint = <value optimized out>
        oldContext = (nsStyleContext *) 0x24e7fb8
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#14 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e7190, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24e8088
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x24a10b0
        content = (class nsIContent *) 0x24a10b0
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x0
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x24e6b40
        newContext = (nsStyleContext *) 0x24e6c80
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#15 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24e6b40, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24e7190
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x2443450
        content = (class nsIContent *) 0x2443450
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x0
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x0
        newContext = (nsStyleContext *) 0x24e6760
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#16 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x2450098, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24e6b40
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x2443450
        content = (class nsIContent *) 0x2443450
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x18df418
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x24502d0
        newContext = (nsStyleContext *) 0x24e6458
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#17 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x24502d0, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x2450098
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x2443450
        content = (class nsIContent *) 0x2443450
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x18df478
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x244ffa0
        newContext = (nsStyleContext *) 0x258eeb8
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#18 0x00007f4ef2047cb6 in nsFrameManager::ReResolveStyleContext (this=0x244e048, 
    aPresContext=0x2445ae0, aFrame=0x244ffa0, 
    aParentContent=<value optimized out>, aChangeList=0x7fff07f12df0, 
    aMinChange=7) at nsFrameManager.cpp:1404
        child = (class nsIFrame *) 0x24502d0
        listIndex = 0
        childList = <value optimized out>
        localContent = (class nsIContent *) 0x0
        content = (class nsIContent *) 0x0
        parentContext = <value optimized out>
        providerIsChild = 0
        pseudoTag = (class nsIAtom * const) 0x18df460
        resolvedChild = (class nsIFrame *) 0x0
        providerFrame = (class nsIFrame *) 0x0
        newContext = (nsStyleContext *) 0x24e3a60
        contextIndex = <value optimized out>
        assumeDifferenceHint = 0
        oldContext = <value optimized out>
        styleSet = (nsStyleSet *) 0x244cc70
        isAccessibilityActive = 0
        isVisible = 0
#19 0x00007f4ef20480a4 in nsFrameManager::ComputeStyleChangeFor (this=0x244e048, 
    aFrame=0x244ffa0, aChangeList=0x7fff07f12df0, aMinChange=7)
    at nsFrameManager.cpp:1470
        frameChange = <value optimized out>
        topLevelChange = 7
        frame = (class nsIFrame *) 0x244ffa0
        frame2 = (class nsIFrame *) 0x244ffa0
        propTable = (nsPropertyTable *) 0x2445ba0
#20 0x00007f4ef20316ca in nsCSSFrameConstructor::RebuildAllStyleData (
    this=0x244ce30, aExtraHint=7) at nsCSSFrameConstructor.cpp:13422
        rv = <value optimized out>
        changeList = {mArray = 0x7fff07f12e00, mArraySize = 10, mCount = 1, 
  mBuffer = {{mFrame = 0x244ffa0, mContent = 0x0, mHint = 7}, {
      mFrame = 0x7f4ef24122f6, mContent = 0x80004002, mHint = 37434288}, {
      mFrame = 0x0, mContent = 0x7f4ef2041bf5, mHint = 4157763104}, {
      mFrame = 0x7fff07f12eb0, mContent = 0x7fff07f12f30, mHint = 4060349231}, {
      mFrame = 0x7f4ef2d3ced0, mContent = 0x201cff0, mHint = 0}, {
      mFrame = 0x7fff07f12ee8, mContent = 0x4f5410, mHint = 133246720}, {
      mFrame = 0x7fff07f12ee8, mContent = 0x4d96ac, mHint = 34651952}, {
      mFrame = 0x7fff07f12ebc, mContent = 0x210bf68, mHint = 0}, {
      mFrame = 0x2104618, mContent = 0x7f12f20, mHint = 133246832}, {
      mFrame = 0x23b33b0, mContent = 0x7fff07f12f60, mHint = 133246832}}}
#21 0x00007f4ef2043a32 in DocumentViewerImpl::SetTextZoom (this=0x23b33b0, 
    aTextZoom=1.18920708) at nsPresContext.h:475
        batch = {mRootVM = {<nsCOMPtr_base> = {
      mRawPtr = 0x2446960}, <No data fields>}}
        ZoomInfo = {mZoom = 1.18920708}
        pc = (class nsPresContext *) 0x1400000000
#22 0x0000000000485755 in EphyBrowser::SetZoom (this=<value optimized out>, 
    aZoom=1.18920708)
    at /home/joss/deb/build-area/epiphany-browser-2.22.3/embed/mozilla/EphyBrowser.cpp:1195
        contentViewer = {<nsCOMPtr_base> = {
    mRawPtr = 0x23b33b0}, <No data fields>}
        mdv = {<nsCOMPtr_base> = {mRawPtr = 0x23b33c8}, <No data fields>}
#23 0x0000000000478e81 in impl_set_zoom (embed=0x1ef8180, zoom=1.18920708)
    at /home/joss/deb/build-area/epiphany-browser-2.22.3/embed/mozilla/mozilla-embed.cpp:620
        browser = (EphyBrowser *) 0x1400000000
        rv = <value optimized out>
        __PRETTY_FUNCTION__ = "void impl_set_zoom(EphyEmbed*, float)"

Comment 2

[Alvaro Herrera]

More info from the core file.  I installed a newer Xulrunner package (from debian Unstable), and got a new core file.  Additionally, the "this" object is displayed below.

(gdb) bt full 6
#0  0x00007f551ccdf22b in raise () from /lib/libpthread.so.0
No symbol table info available.
#1  0x00007f5516871049 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:212
        unblock_sigs = {__val = {1024, 0 <repeats 15 times>}}
        oldact = <value optimized out>
#2  <signal handler called>
No symbol table info available.
#3  nsPresContext::AllocateFromShell (this=<value optimized out>, aSize=24) at ../../dist/include/layout/nsPresContext.h:253
No locals.
#4  0x00007f5516a7692c in nsRuleNode::ComputeBackgroundData (this=0x2310888, aStartStruct=0x0, aData=@0x7fff2c888d50, aContext=0x2310a90, 
    aHighestNode=0x23107f8, aRuleDetail=nsRuleNode::eRulePartialReset, aInherited=0) at nsStyleStruct.h:151
        parentContext = (nsStyleContext *) 0x2310600
        bg = <value optimized out>
        parentBG = <value optimized out>
        inherited = <value optimized out>
        parentFlags = <value optimized out>
#5  0x00007f5516a7b6e4 in nsRuleNode::WalkRuleTree (this=0x2310888, aSID=eStyleStruct_Background, aContext=0x2310a90, 
    aRuleData=0x7fff2c888df0, aSpecificData=0x7fff2c888d50) at nsStyleStructList.h:79
        startStruct = <value optimized out>
        ruleNode = (nsRuleNode *) 0x0
        highestNode = (nsRuleNode *) 0x23107f8
        rootNode = (nsRuleNode *) 0x24ddf30
        detail = <value optimized out>
        isReset = <value optimized out>
        res = <value optimized out>
(More stack frames follow...)
(gdb) frame 4
#4  0x00007f5516a7692c in nsRuleNode::ComputeBackgroundData (this=0x2310888, aStartStruct=0x0, aData=@0x7fff2c888d50, aContext=0x2310a90, 
    aHighestNode=0x23107f8, aRuleDetail=nsRuleNode::eRulePartialReset, aInherited=0) at nsStyleStruct.h:151
151     in nsStyleStruct.h
(gdb) p *this
$1 = {mPresContext = 0x2312980, mParent = 0x2310840, mRule = 0x0, static ChildrenHashOps = {
    allocTable = 0x7f5516f73fdf <PL_DHashAllocTable>, freeTable = 0x7f5516f73f82 <PL_DHashFreeTable>, 
    hashKey = 0x7f5516a7d4a4 <nsRuleNode::ChildrenHashHashKey(PLDHashTable*, void const*)>, 
    matchEntry = 0x7f5516a7273c <nsRuleNode::ChildrenHashMatchEntry(PLDHashTable*, PLDHashEntryHdr const*, void const*)>, 
    moveEntry = 0x7f5516f73fe6 <PL_DHashMoveEntryStub>, clearEntry = 0x7f5516f73dd2 <PL_DHashClearEntryStub>, 
    finalize = 0x7f5516f737f4 <PL_DHashFinalizeStub>, initEntry = 0}, mChildrenTaggedPtr = 0x0, mStyleData = {
    static gInfo = 0x7f55176cde50, mInheritedData = 0x0, mResetData = 0x0}, mDependentBits = 1074172624, mNoneBits = 18688, 
  static gLangService = 0x0}

Comment 3

[Reinout van Schouwen]

The stack trace looks suspiciously similar to the one in bug 444894. (Compare frame 6 and below from comment #1 to frame 1 and below in bug 444894, comment #1)

Comment 4

[Alvaro Herrera]

FWIW I can reproduce the crashes in the website mentioned in #444894 and #444916 too.