Attachment 172408 Details for Bug 254138 – crash in gtk2drawing.c:555

crash in gtk2drawing.c:555

firefox-2.0.0.6-3.fc8.x86_64-crash-in-gtk2drawing.c.log (text/plain), 14.81 KB, created by Peter Kovář on 2007-08-24 12:54:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Peter Kovář

Created: 2007-08-24 12:54:11 UTC

Size: 14.81 KB

patch

obsolete

>*** glibc detected *** /usr/src/redhat/BUILD/mozilla/dist/bin/firefox-bin: double free or corruption (out): 0x0000000000e2e890 ***
>======= Backtrace: =========
>/lib64/libc.so.6[0x33c8470782]
>/lib64/libc.so.6(cfree+0x8c)[0x33c8473e7c]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgfx_gtk.so[0x2aaab5adae2e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgfx_gtk.so[0x2aaab5af3c1e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab4efdcd3]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab4efe7a6]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab4f3c1da]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5012785]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab501281e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab501281e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab501281e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab501281e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab501281e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5024702]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5013796]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab50133b4]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab501281e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab4f1d690]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab514b9b7]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab514dc90]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab515150a]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5151e7d]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab5153fee]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libgklayout.so[0x2aaab514b756]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libwidget_gtk2.so[0x2aaab306426e]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libwidget_gtk2.so[0x2aaab30600b6]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libwidget_gtk2.so[0x2aaab306014c]
>/usr/lib64/libgtk-x11-2.0.so.0[0x3617361a51]
>/lib64/libgobject-2.0.so.0(g_closure_invoke+0x109)[0x33cd80b169]
>/lib64/libgobject-2.0.so.0[0x33cd81aa81]
>/lib64/libgobject-2.0.so.0(g_signal_emit_valist+0x60d)[0x33cd81bc9d]
>/lib64/libgobject-2.0.so.0(g_signal_emit+0x83)[0x33cd81c0a3]
>/usr/lib64/libgtk-x11-2.0.so.0[0x3617483a6e]
>/usr/lib64/libgtk-x11-2.0.so.0(gtk_main_do_event+0x405)[0x361735a865]
>/usr/lib64/libgdk-x11-2.0.so.0[0x3616e3347a]
>/usr/lib64/libgdk-x11-2.0.so.0(gdk_window_process_all_updates+0x8b)[0x3616e336bb]
>/usr/lib64/libgdk-x11-2.0.so.0[0x3616e33719]
>/usr/lib64/libgdk-x11-2.0.so.0[0x3616e1aa6e]
>/lib64/libglib-2.0.so.0(g_main_context_dispatch+0x1c3)[0x33ca82ef13]
>/lib64/libglib-2.0.so.0[0x33ca83220d]
>/lib64/libglib-2.0.so.0(g_main_loop_run+0x1ca)[0x33ca83251a]
>/usr/lib64/libgtk-x11-2.0.so.0(gtk_main+0xa3)[0x361735aba3]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libwidget_gtk2.so[0x2aaab3063176]
>/usr/src/redhat/BUILD/mozilla/dist/bin/components/libtoolkitcomps.so[0x2aaab3b4b812]
>/usr/src/redhat/BUILD/mozilla/dist/bin
>Program received signal SIGABRT, Aborted.
>[Switching to Thread 46912536112544 (LWP 32434)]
>0x00000033c8430895 in raise () from /lib64/libc.so.6
>(gdb) bt
>#0  0x00000033c8430895 in raise () from /lib64/libc.so.6
>#1  0x00000033c8432340 in abort () from /lib64/libc.so.6
>#2  0x00000033c846902b in __libc_message () from /lib64/libc.so.6
>#3  0x00000033c8470782 in _int_free () from /lib64/libc.so.6
>#4  0x00000033c8473e7c in free () from /lib64/libc.so.6
>#5  0x00002aaab5adae2e in moz_gtk_widget_paint (widget=MOZ_GTK_DROPDOWN, drawable=0xb08cd0, rect=<value optimized out>, cliprect=0x7fff40231ac0, state=0x7fff40231b00, flags=1076043344) at gtk2drawing.c:555
>#6  0x00002aaab5af3c1e in nsNativeThemeGTK::DrawWidgetBackground (this=0xb3c3e0, aContext=0x2aaab8444960, aFrame=0x2aaab846f138, aWidgetType=<value optimized out>, aRect=<value optimized out>, aClipRect=<value optimized out>) at nsNativeThemeGTK.cpp:464
>#7  0x00002aaab4efdcd3 in nsCSSRendering::PaintBackgroundWithSC (aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aForFrame=0x2aaab846f138, aDirtyRect=@0x7fff40231f10, aBorderArea=@0x7fff40231e50, aColor=@0x2aaab8301138, aBorder=@0x173fe20, aPadding=@0x173fea0, aUsePrintSettings=0, aBGClipRect=0x0) at nsCSSRendering.cpp:2837
>#8  0x00002aaab4efe7a6 in nsCSSRendering::PaintBackground (aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aForFrame=0x2aaab846f138, aDirtyRect=@0x7fff40231f10, aBorderArea=@0x7fff40231e50, aBorder=@0x173fe20, aPadding=@0x173fea0, aUsePrintSettings=0, aBGClipRect=0x0) at nsCSSRendering.cpp:2761
>#9  0x00002aaab4f3c1da in nsFrame::PaintSelf (this=0x2aaab846f138, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40231f10, aSkipSides=0, aUsePrintBackgroundSettings=0) at nsFrame.cpp:932
>#10 0x00002aaab5012785 in nsBoxFrame::Paint (this=0x2aaab846f138, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40231f10, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1425
>#11 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232080, aFrame=0x2aaab846f138, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#12 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab846eca0, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232080, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#13 0x00002aaab501281e in nsBoxFrame::Paint (this=0x2aaab846eca0, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232080, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1447
>#14 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff402321f0, aFrame=0x2aaab846eca0, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#15 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab846ec08, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff402321f0, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#16 0x00002aaab501281e in nsBoxFrame::Paint (this=0x2aaab846ec08, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff402321f0, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1447
>#17 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232360, aFrame=0x2aaab846ec08, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#18 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab846eb70, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232360, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#19 0x00002aaab501281e in nsBoxFrame::Paint (this=0x2aaab846eb70, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232360, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1447
>#20 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff402324d0, aFrame=0x2aaab846eb70, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#21 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab846e910, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff402324d0, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#22 0x00002aaab501281e in nsBoxFrame::Paint (this=0x2aaab846e910, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff402324d0, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1447
>#23 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232640, aFrame=0x2aaab846e910, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#24 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab846e878, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232640, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#25 0x00002aaab501281e in nsBoxFrame::Paint (this=0x2aaab846e878, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232640, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1447
>#26 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232850, aFrame=0x2aaab846e878, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#27 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab83c0560, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232850, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#28 0x00002aaab5024702 in nsGroupBoxFrame::Paint (this=0x2aaab83c0560, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232850, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsGroupBoxFrame.cpp:211
>#29 0x00002aaab5013796 in nsBoxFrame::PaintChild (this=<value optimized out>, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232a50, aFrame=0x2aaab83c0560, aWhichLayer=eFramePaintLayer_Underlay, aFlags=0) at nsBoxFrame.cpp:1492
>#30 0x00002aaab50133b4 in nsBoxFrame::PaintChildren (this=0x2aaab8309608, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232a50, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1617
>#31 0x00002aaab501281e in nsBoxFrame::Paint (this=0x2aaab8309608, aPresContext=0x2aaab80ee5c0, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232a50, aWhichLayer=eFramePaintLayer_Underlay, aFlags=<value optimized out>) at nsBoxFrame.cpp:1447
>#32 0x00002aaab4f1d690 in PresShell::Paint (this=0x2aaab80dcc10, aView=<value optimized out>, aRenderingContext=@0x2aaab8444960, aDirtyRect=@0x7fff40232a50) at nsPresShell.cpp:5869
>#33 0x00002aaab514b9b7 in nsView::Paint (this=0x2aaab830a7d0, rc=@0x2aaab8444960, rect=@0x7fff40232a50, aPaintFlags=<value optimized out>, aResult=<value optimized out>) at nsView.cpp:314
>#34 0x00002aaab514dc90 in nsViewManager::RenderDisplayListElement (this=<value optimized out>, element=0x1472b00, aRC=0x2aaab8444960) at nsViewManager.cpp:1458
>#35 0x00002aaab515150a in nsViewManager::RenderViews (this=0x2aaab80c1fe0, aRootView=<value optimized out>, aRC=@0x2aaab8444960, aRegion=@0x7fff40232c60, aRCSurface=0x17becd0, aDisplayList=@0x7fff40232d90) at nsViewManager.cpp:1373
>#36 0x00002aaab5151e7d in nsViewManager::Refresh (this=0x2aaab80c1fe0, aView=0x2aaab830a550, aContext=0x2aaab8444960, aRegion=0x2aaab84c37d0, aUpdateFlags=<value optimized out>) at nsViewManager.cpp:929
>#37 0x00002aaab5153fee in nsViewManager::DispatchEvent (this=0x2aaab80c1fe0, aEvent=0x7fff40232f50, aStatus=0x7fff40232f1c) at nsViewManager.cpp:2051
>#38 0x00002aaab514b756 in HandleEvent (aEvent=0x7fff40232f50) at nsView.cpp:171
>#39 0x00002aaab306426e in nsCommonWidget::DispatchEvent (this=0x2aaab830baf0, aEvent=0x7fff40232f50, aStatus=@0x7fff40232ff8) at nsCommonWidget.cpp:219
>#40 0x00002aaab30600b6 in nsWindow::OnExposeEvent (this=0x2aaab830baf0, aWidget=<value optimized out>, aEvent=0x7fff40233730) at nsWindow.cpp:1459
>#41 0x00002aaab306014c in expose_event_cb (widget=0xee4da0, event=0x7fff40233730) at nsWindow.cpp:3797
>#42 0x0000003617361a51 in _gtk_marshal_BOOLEAN__BOXED (closure=0x2aaab809d2a0, return_value=0x7fff40233220, n_param_values=<value optimized out>, param_values=0x7fff40233320, invocation_hint=<value optimized out>, marshal_data=0x2aaab3060124) at gtkmarshalers.c:84
>#43 0x00000033cd80b169 in g_closure_invoke () from /lib64/libgobject-2.0.so.0
>#44 0x00000033cd81aa81 in __cxa_pure_virtual () from /lib64/libgobject-2.0.so.0
>#45 0x00000033cd81bc9d in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
>#46 0x00000033cd81c0a3 in g_signal_emit () from /lib64/libgobject-2.0.so.0
>#47 0x0000003617483a6e in gtk_widget_event_internal (widget=0xee4da0, event=0x7fff40233730) at gtkwidget.c:4674
>#48 0x000000361735a865 in IA__gtk_main_do_event (event=0x7fff40233730) at gtkmain.c:1499
>#49 0x0000003616e3347a in gdk_window_process_updates_internal (window=0x2aaab830d490) at gdkwindow.c:2366
>#50 0x0000003616e336bb in IA__gdk_window_process_all_updates () at gdkwindow.c:2429
>#51 0x0000003616e33719 in gdk_window_update_idle (data=0x7eb2) at gdkwindow.c:2288
>#52 0x0000003616e1aa6e in gdk_threads_dispatch (data=0xe4d260) at gdk.c:470
>#53 0x00000033ca82ef13 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
>#54 0x00000033ca83220d in __cxa_pure_virtual () from /lib64/libglib-2.0.so.0
>#55 0x00000033ca83251a in g_main_loop_run () from /lib64/libglib-2.0.so.0
>#56 0x000000361735aba3 in IA__gtk_main () at gtkmain.c:1144
>#57 0x00002aaab3063176 in nsAppShell::Run (this=0x7885d0) at nsAppShell.cpp:139
>#58 0x00002aaab3b4b812 in nsAppStartup::Run (this=0x788550) at nsAppStartup.cpp:151
>#59 0x00000000004086a2 in XRE_main (argc=0, argv=<value optimized out>, aAppData=<value optimized out>) at nsAppRunner.cpp:2711
>#60 0x00000033c841dd58 in __libc_start_main () from /lib64/libc.so.6
>#61 0x00000000004039c9 in _start ()
>

Actions: View

Attachments on bug 254138: 172408