557785 - SeaMonkey crashes with 'RenderBadPicture (invalid Picture parameter)'

Status: RESOLVED DUPLICATE of bug 522635

(SeaMonkey :: General, defect)

Description

[Tristan Miller]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100317 SUSE/2.0.4-3.2 SeaMonkey/2.0.4
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100317 SUSE/2.0.4-3.2 SeaMonkey/2.0.4

After several minutes or hours of browsing, SeaMonkey inevitably crashes.  There doesn't seem to be any particular action which triggers the crash.

Reproducible: Always

Steps to Reproduce:
1. Use SeaMonkey for several minutes or hours.

Actual Results:  
2. SeaMonkey crashes and the following is output to the console:

$ seamonkey
*** nss-shared-helper: Shared database disabled (set NSS_USE_SHARED_DB to enable).
The program 'seamonkey-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'RenderBadPicture (invalid Picture parameter)'.
  (Details: serial 2670157 error_code 158 request_code 148 minor_code 7)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)


Expected Results:  
2. SeaMonkey should not have crashed.

This problem seems to be fairly new and has been reported elsewhere on the Web:
<http://bbs.archlinux.org/viewtopic.php?pid=734172>
<http://forums.mozillazine.org/viewtopic.php?f=5&t=1837985>

Comment 1

[lenochod]

(In reply to comment #0)
> $ seamonkey
> *** nss-shared-helper: Shared database disabled (set NSS_USE_SHARED_DB to
> enable).

http://forums.opensuse.org/get-help-here/applications/406193-b-nss-shared-helper-warning-firefox-b.html

> The program 'seamonkey-bin' received an X Window System error.
> This probably reflects a bug in the program.
> The error was 'RenderBadPicture (invalid Picture parameter)'.
>   (Details: serial 2670157 error_code 158 request_code 148 minor_code 7)
>   (Note to programmers: normally, X errors are reported asynchronously;
>    that is, you will receive the error a while after causing it.
>    To debug your program, run it with the --sync command line
>    option to change this behavior. You can then get a meaningful
>    backtrace from your debugger if you break on the gdk_x_error() function.)

Bug 500105 (will land on SeaMonkey 2.1 ?) or Bug 444121

Is package from ftp server mozilla or repository Linux distribution? If it is from repository Linux distribution, please test version from http://www.seamonkey-project.org/ .

Comment 2

[Samuel Sieb]

This is bug 522635 which was fixed in 1.9.2.  However, Seamonkey is still using 1.9.1.  We either need a patch for 1.9.1 or Seamonkey to move to a later version.

Comment 3

[Ian Neal]

Could you give some examples of sites it always happens on?

Comment 4

[Samuel Sieb]

That's the problem.  It doesn't always happen at the same spot.  It may take five minutes or five hours.  But sooner or later it will just crash.  Sometimes when opening a webpage, sometimes when closing a tab, sometimes even while switching virtual desktops!  I ran Seamonkey with --sync and got a stack trace that pointed at this issue.  I don't have it any more, but if necessary I could get another one.

Comment 5

[Samuel Sieb]

I have a stack trace:

#11 0x00c87121 in _XError (dpy=0xb754d000, rep=0x68648250) at XlibInt.c:3103
#12 0x00c8d957 in process_responses (dpy=<value optimized out>, wait_for_first_event=0, current_error=0xbfe2cdac, current_request=112013228) at xcb_io.c:214
#13 0x00c8e016 in _XReply (dpy=0xb754d000, rep=0xbfe2cde0, extra=0, discard=1) at xcb_io.c:464
#14 0x00c81708 in XSync (dpy=0xb754d000, discard=0) at Sync.c:48
#15 0x00c81896 in _XSyncFunction (dpy=0xb754d000) at Synchro.c:37
#16 0x00df0ebf in XRenderFreePicture (dpy=<value optimized out>, picture=<value optimized out>) at Picture.c:242
#17 0x0039c0bc in _cairo_xlib_surface_finish (abstract_surface=0x68874240) at cairo-xlib-surface.c:298
#18 0x0037ffae in cairo_surface_finish (surface=0x68874240) at cairo-surface.c:530
#19 0x00380048 in cairo_surface_destroy (surface=0x68874240) at cairo-surface.c:435
#20 0x08d5a8f8 in gfxASurface::Release (this=0xa4fc8f40) at gfxASurface.cpp:102
#21 0x082f5161 in assign_assuming_AddRef (this=0x752edb00) at ../../../dist/include/xpcom/nsAutoPtr.h:944
#22 assign_with_AddRef (this=0x752edb00) at ../../../dist/include/xpcom/nsAutoPtr.h:928
#23 operator= (this=0x752edb00) at ../../../dist/include/xpcom/nsAutoPtr.h:1003
#24 nsWindow::Destroy (this=0x752edb00) at nsWindow.cpp:787
#25 0x085b42eb in nsView::~nsView (this=0x68735e80, __in_chrg=<value optimized out>) at nsView.cpp:272
#26 0x085b4383 in nsView::~nsView (this=0x68735e80, __in_chrg=<value optimized out>) at nsView.cpp:281
#27 0x0837bf5d in nsFrame::Destroy (this=0xa66de6dc) at nsFrame.cpp:535
#28 0x08375886 in nsContainerFrame::Destroy (this=0xa66de6dc) at nsContainerFrame.cpp:305
#29 0x0834095c in nsFrameManager::Destroy (this=0x7416241c) at nsFrameManager.cpp:292
#30 0x08356b7d in PresShell::Destroy (this=0x74162400) at nsPresShell.cpp:1949
#31 0x0833a748 in DocumentViewerImpl::DestroyPresShell (this=0xa294ff50) at nsDocumentViewer.cpp:4329
#32 0x0833c1d6 in DocumentViewerImpl::Destroy (this=0xa294ff50) at nsDocumentViewer.cpp:1603
#33 0x089093fd in nsSHEntry::~nsSHEntry (this=0x6944dc10, __in_chrg=<value optimized out>) at nsSHEntry.cpp:163
#34 0x0890961c in nsSHEntry::Release (this=0x6944dc10) at nsSHEntry.cpp:182
#35 0x00f49e55 in nsCOMPtr_base::~nsCOMPtr_base (this=<value optimized out>, __in_chrg=<value optimized out>) at nsCOMPtr.cpp:81
#36 0x08909c6e in ~nsCOMPtr (this=0xa5a41ba0, __in_chrg=<value optimized out>) at ../../../dist/include/xpcom/nsCOMPtr.h:469
#37 nsSHTransaction::~nsSHTransaction (this=0xa5a41ba0, __in_chrg=<value optimized out>) at nsSHTransaction.cpp:54
#38 0x08909cb3 in nsSHTransaction::~nsSHTransaction (this=0xa5a41ba0, __in_chrg=<value optimized out>) at nsSHTransaction.cpp:54
#39 0x08909a27 in nsSHTransaction::Release (this=0xa5a41ba0) at nsSHTransaction.cpp:61
#40 0x00f49e55 in nsCOMPtr_base::~nsCOMPtr_base (this=<value optimized out>, __in_chrg=<value optimized out>) at nsCOMPtr.cpp:81
#41 0x08909cb3 in nsSHTransaction::~nsSHTransaction (this=0xaa6c6040, __in_chrg=<value optimized out>) at nsSHTransaction.cpp:54
#42 0x08909a27 in nsSHTransaction::Release (this=0xaa6c6040) at nsSHTransaction.cpp:61
#43 0x00f49e55 in nsCOMPtr_base::~nsCOMPtr_base (this=<value optimized out>, __in_chrg=<value optimized out>) at nsCOMPtr.cpp:81
#44 0x0890ad13 in nsSHistory::~nsSHistory (this=0xa9889340, __in_chrg=<value optimized out>) at nsSHistory.cpp:142
#45 0x08909d7a in nsSHistory::Release (this=0xa9889340) at nsSHistory.cpp:149
#46 0x08198381 in XPCJSRuntime::GCCallback (cx=0xb7509e00, status=JSGC_END) at xpcjsruntime.cpp:776
#47 0x00e95e54 in jsds_GCCallbackProc (cx=0xb7509e00, status=JSGC_END) at jsd_xpc.cpp:531
#48 0x085bbd9a in DOMGCCallback (cx=0xb7509e00, status=JSGC_END) at nsJSEnvironment.cpp:3714
#49 0x006b4725 in js_GC (cx=0xb7509e00, gckind=<value optimized out>) at jsgc.cpp:3792
#50 0x0068347c in JS_GC (cx=0xb7509e00) at jsapi.cpp:2459
#51 0x0817fab8 in nsXPConnect::Collect (this=0xb7515d60) at nsXPConnect.cpp:477
#52 0x00fa1e23 in nsCycleCollector::Collect (this=0xb7543000, aTryCollections=1) at nsCycleCollector.cpp:2389
#53 0x00fa202f in nsCycleCollector_collect () at nsCycleCollector.cpp:3048
#54 0x085bbf47 in nsJSContext::CC () at nsJSEnvironment.cpp:3534
#55 0x085bc3c1 in nsUserActivityObserver::Observe (this=0xb4d486e0, aSubject=0x0, aTopic=<value optimized out>, aData=0x0) at nsJSEnvironment.cpp:266
#56 0x00f5f1d3 in nsObserverList::NotifyObservers (this=0xb294ed58, aSubject=0x0, aTopic=0x8f00a8a "user-interaction-inactive", someData=0x0)
    at nsObserverList.cpp:130
#57 0x00f5f59f in nsObserverService::NotifyObservers (this=0xb75fd340, aSubject=0x0, aTopic=0x8f00a8a "user-interaction-inactive", someData=0x0)
    at nsObserverService.cpp:181
#58 0x08524e5f in nsUITimerCallback::Notify (this=0xb3fdd030, aTimer=0xb3fdc070) at nsEventStateManager.cpp:355
#59 0x00f95a01 in nsTimerImpl::Fire (this=0xb3fdc070) at nsTimerImpl.cpp:423
#60 0x00f95bb0 in nsTimerEvent::Run (this=0x8966cb50) at nsTimerImpl.cpp:512
#61 0x00f91949 in nsThread::ProcessNextEvent (this=0xb75ea060, mayWait=1, result=0xbfe316cc) at nsThread.cpp:521
#62 0x00f50a90 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=1) at nsThreadUtils.cpp:247
#63 0x082d9228 in nsBaseAppShell::Run (this=0xb5b22b50) at nsBaseAppShell.cpp:170
#64 0x08a3a5df in nsAppStartup::Run (this=0xb5b6a700) at nsAppStartup.cpp:193
#65 0x0807c008 in XRE_main (argc=2, argv=0xbfe31c74, aAppData=0xb750e380) at nsAppRunner.cpp:3321
#66 0x08077e0e in main (argc=2, argv=0xbfe31c74) at nsSuiteApp.cpp:103

Comment 6

[Samuel Sieb]

I applied the big patch from bug 522635 and rebuilt the rpm.  I haven't had any more crashes or any other issues since then.

Comment 7

[Julian Klein]

I've got the same problem with Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.11) Gecko/20100722 SeaMonkey/2.0.6 under Ubuntu Linux 10.4. Package coming from the Ubuntu repositories. Installed Add-Ons: Adblockplus, DOM-Manager, Enigmail (disabled due to probs with gpg)

laptop:~$ seamonkey
The program 'seamonkey-2.0-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'RenderBadPicture (invalid Picture parameter)'.
  (Details: serial 1042827 error_code 172 request_code 152 minor_code 7)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

Comment 9

[Tristan Miller]

Related bug from openSUSE: https://bugzilla.novell.com/show_bug.cgi?id=622375

Comment 10

[Mason]

I have opened bug 591503 in which I describe two methods that crash Seamonkey
consistently for me.

Comment 11

[chAlx]

Similar bug 603601 (not reappears for some time in v2.0.10).

Comment 12

[Philip Chee]

https://bugzilla.mozilla.org/show_bug.cgi?id=522635#c52
Patch for Bug 522635 was back ported to 1.9.1 on 2010-10-26 02:40:30 PDT