i've added the viewer tests to apprunner, under Debug | Viewer. Linux: demo #2 works in viewer, crashes apprunner: #0 0x40b266a1 in __kill () #1 0x40b264cf in raise (sig=6) at ../sysdeps/posix/raise.c:27 #2 0x40b276df in abort () at ../sysdeps/generic/abort.c:83 #3 0x4083813a in PR_Abort () at prlog.c:461 #4 0x4002f426 in nsDebug::Abort (aFile=0x40eb6394 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:93 #5 0x4002f48a in nsDebug::Break (aFile=0x40eb6394 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:108 #6 0x4002f5cd in nsDebug::Assertion (aStr=0x40eb6434 "recursive painting not permitted", aExpr=0x40eb641c "!(PR_TRUE == mPainting)", aFile=0x40eb6394 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:140 #7 0x40eb2223 in nsViewManager::Refresh (this=0x82d1420, aView=0x82c3cc8, aContext=0x8366f18, rect=0xbfffa0f0, aUpdateFlags=1) at nsViewManager.cpp:468 #8 0x40eb2d5a in nsViewManager::DispatchEvent (this=0x82d1420, aEvent=0xbfffa1b0, aStatus=@0xbfffa134) at nsViewManager.cpp:1626 #9 0x40eaa688 in HandleEvent (aEvent=0xbfffa1b0) at nsView.cpp:63 #10 0x40098bf6 in nsWidget::DispatchEvent (this=0x82c3d58, event=0xbfffa1b0, aStatus=@0xbfffa170) at nsWidget.cpp:888 #11 0x40098ad4 in nsWidget::DispatchWindowEvent (this=0x82c3d58, event=0xbfffa1b0) at nsWidget.cpp:848 #12 0x40099b95 in nsWindow::OnPaint (this=0x82c3d58, event=@0xbfffa1b0) at nsWindow.cpp:439 #13 0x400958a9 in handle_draw_event (w=0x82c2578, area=0xbfffa558, p=0x82c3d58) at nsGtkEventHandler.cpp:504 #14 0x4096d591 in gtk_marshal_NONE__POINTER (object=0x82c2578, func=0x40095854 <handle_draw_event(_GtkWidget *, _GdkRectangle *, void *)>, func_data=0x82c3d58, args=0xbfffa290) at gtkmarshal.c:216 #15 0x4093211a in gtk_handlers_run (handlers=0x833b0f0, signal=0xbfffa24c, object=0x82c2578, params=0xbfffa290, after=0) at gtksignal.c:1909 #16 0x40931624 in gtk_signal_real_emit (object=0x82c2578, signal_id=8, params=0xbfffa290) at gtksignal.c:1469 #17 0x4092f934 in gtk_signal_emit (object=0x82c2578, signal_id=8) at gtksignal.c:552 #18 0x40963894 in gtk_widget_draw (widget=0x82c2578, area=0xbfffa558) at gtkwidget.c:2310 #19 0x408fb593 in gtk_layout_draw (widget=0x82d18e8, area=0xbfffa8bc) at gtklayout.c:637 #20 0x4096d591 in gtk_marshal_NONE__POINTER (object=0x82d18e8, func=0x408fb488 <gtk_layout_draw>, func_data=0x0, args=0xbfffa5f4) at gtkmarshal.c:216

is the full stack trace the same as that in bug #<a href="http://bugzilla.mozilla.org/show_bug.cgi?id=4086">4086</a>?

Here's the full stack trace for demo #2 crash, yes it looks similar to the other crash you mention, maybe keep this bug since it's a layout test and will be easier to verify/test. #0 0x40b276a1 in __kill () #1 0x40b274cf in raise (sig=6) at ../sysdeps/posix/raise.c:27 #2 0x40b286df in abort () at ../sysdeps/generic/abort.c:83 #3 0x4083913a in PR_Abort () at prlog.c:461 #4 0x4002f426 in nsDebug::Abort (aFile=0x40eb7394 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:93 #5 0x4002f48a in nsDebug::Break (aFile=0x40eb7394 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:108 #6 0x4002f5cd in nsDebug::Assertion ( aStr=0x40eb7434 "recursive painting not permitted", aExpr=0x40eb741c "!(PR_TRUE == mPainting)", aFile=0x40eb7394 "nsViewManager.cpp", aLine=468) at nsDebug.cpp:140 #7 0x40eb3223 in nsViewManager::Refresh (this=0x82d29b8, aView=0x82bc7b0, aContext=0x8370bb8, rect=0xbfffa2f4, aUpdateFlags=1) at nsViewManager.cpp:468 #8 0x40eb3d5a in nsViewManager::DispatchEvent (this=0x82d29b8, aEvent=0xbfffa3b4, aStatus=@0xbfffa338) at nsViewManager.cpp:1626 #9 0x40eab688 in HandleEvent (aEvent=0xbfffa3b4) at nsView.cpp:63 #10 0x40098c42 in nsWidget::DispatchEvent (this=0x82bc820, event=0xbfffa3b4, aStatus=@0xbfffa374) at nsWidget.cpp:908 #11 0x40098b20 in nsWidget::DispatchWindowEvent (this=0x82bc820, event=0xbfffa3b4) at nsWidget.cpp:868 #12 0x40099be1 in nsWindow::OnPaint (this=0x82bc820, event=@0xbfffa3b4) at nsWindow.cpp:439 #13 0x400958e9 in handle_draw_event (w=0x82bca10, area=0xbfffa75c, p=0x82bc820) at nsGtkEventHandler.cpp:504 #14 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x82bca10, func=0x40095894 <handle_draw_event(_GtkWidget *, _GdkRectangle *, void *)>, func_data=0x82bc820, args=0xbfffa494) at gtkmarshal.c:216 #15 0x4093311a in gtk_handlers_run (handlers=0x833ee48, signal=0xbfffa450, object=0x82bca10, params=0xbfffa494, after=0) at gtksignal.c:1909 #16 0x40932624 in gtk_signal_real_emit (object=0x82bca10, signal_id=8, params=0xbfffa494) at gtksignal.c:1469 #17 0x40930934 in gtk_signal_emit (object=0x82bca10, signal_id=8) at gtksignal.c:552 #18 0x40964894 in gtk_widget_draw (widget=0x82bca10, area=0xbfffa75c) at gtkwidget.c:2310 #19 0x408fc593 in gtk_layout_draw (widget=0x82d2e80, area=0xbfffaac0) at gtklayout.c:637 #20 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x82d2e80, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffa7f8) at gtkmarshal.c:216 #21 0x409324e1 in gtk_signal_real_emit (object=0x82d2e80, signal_id=8, params=0xbfffa7f8) at gtksignal.c:1432 #22 0x40930934 in gtk_signal_emit (object=0x82d2e80, signal_id=8) at gtksignal.c:552 #23 0x40964894 in gtk_widget_draw (widget=0x82d2e80, area=0xbfffaac0) at gtkwidget.c:2310 #24 0x408fc593 in gtk_layout_draw (widget=0x828c0c0, area=0xbfffae24) at gtklayout.c:637 #25 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x828c0c0, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffab5c) at gtkmarshal.c:216 #26 0x409324e1 in gtk_signal_real_emit (object=0x828c0c0, signal_id=8, params=0xbfffab5c) at gtksignal.c:1432 #27 0x40930934 in gtk_signal_emit (object=0x828c0c0, signal_id=8) at gtksignal.c:552 #28 0x40964894 in gtk_widget_draw (widget=0x828c0c0, area=0xbfffae24) at gtkwidget.c:2310 #29 0x408fc593 in gtk_layout_draw (widget=0x828ba40, area=0xbfffb188) at gtklayout.c:637 #30 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x828ba40, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffaec0) at gtkmarshal.c:216 #31 0x409324e1 in gtk_signal_real_emit (object=0x828ba40, signal_id=8, params=0xbfffaec0) at gtksignal.c:1432 #32 0x40930934 in gtk_signal_emit (object=0x828ba40, signal_id=8) at gtksignal.c:552 #33 0x40964894 in gtk_widget_draw (widget=0x828ba40, area=0xbfffb188) at gtkwidget.c:2310 #34 0x408fc593 in gtk_layout_draw (widget=0x82437b8, area=0xbfffb4ec) at gtklayout.c:637 #35 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x82437b8, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffb224) at gtkmarshal.c:216 #36 0x409324e1 in gtk_signal_real_emit (object=0x82437b8, signal_id=8, params=0xbfffb224) at gtksignal.c:1432 #37 0x40930934 in gtk_signal_emit (object=0x82437b8, signal_id=8) at gtksignal.c:552 #38 0x40964894 in gtk_widget_draw (widget=0x82437b8, area=0xbfffb4ec) at gtkwidget.c:2310 #39 0x408fc593 in gtk_layout_draw (widget=0x81bb4d0, area=0xbfffb828) at gtklayout.c:637 #40 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x81bb4d0, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffb588) at gtkmarshal.c:216 #41 0x409324e1 in gtk_signal_real_emit (object=0x81bb4d0, signal_id=8, params=0xbfffb588) at gtksignal.c:1432 #42 0x40930934 in gtk_signal_emit (object=0x81bb4d0, signal_id=8) at gtksignal.c:552 #43 0x40964894 in gtk_widget_draw (widget=0x81bb4d0, area=0x0) at gtkwidget.c:2310 #44 0x408fbc03 in gtk_layout_thaw (layout=0x81bb4d0) at gtklayout.c:335 #45 0x40099cac in nsWindow::EndResizingChildren (this=0x81bb248) at nsWindow.cpp:461 #46 0x40eafa1d in nsScrollingView::SetPosition (this=0x82434a0, aX=0, aY=0) at nsScrollingView.cpp:549 #47 0x40eb476f in nsViewManager::MoveViewTo (this=0x81aedc0, aView=0x82434a0, aX=0, aY=0) at nsViewManager.cpp:1876 #48 0x40457f0b in nsFrame::DidReflow (this=0x8243438, aPresContext=@0x816f9f0, aStatus=1) at nsFrame.cpp:1034 #49 0x4047a9cb in nsScrollFrame::DidReflow (this=0x8243438, aPresContext=@0x816f9f0, aStatus=1) at nsScrollFrame.cpp:102 #50 0x40485eeb in ViewportFrame::Reflow (this=0x8241068, aPresContext=@0x816f9f0, aDesiredSize=@0xbfffbb9c, aReflowState=@0xbfffbab8, aStatus=@0xbfffbab4) at nsViewportFrame.cpp:439 #51 0x40460846 in nsHTMLReflowCommand::Dispatch (this=0x8370948, aPresContext=@0x816f9f0, aDesiredSize=@0xbfffbb9c, aMaxSize=@0xbfffbb8c, aRendContext=@0x8170530) at nsHTMLReflowCommand.cpp:165 #52 0x40476a18 in PresShell::ProcessReflowCommands (this=0x81bede0) at nsPresShell.cpp:1198 #53 0x4047521b in PresShell::ExitReflowLock (this=0x81bede0) at nsPresShell.cpp:643 #54 0x4047783b in PresShell::ContentChanged (this=0x81bede0, aDocument=0x818e258, aContent=0x8249f8c, aSubContent=0x0) at nsPresShell.cpp:1604 #55 0x40e6a770 in XULDocumentImpl::ContentChanged (this=0x818e258, aContent=0x8249f8c, aSubContent=0x0) at nsXULDocument.cpp:1431 #56 0x40413494 in nsGenericDOMDataNode::SetData (this=0x8249f98, aData=@0xbfffbcac) at nsGenericDOMDataNode.cpp:239 #57 0x40412f4e in nsGenericDOMDataNode::SetNodeValue (this=0x8249f98, aNodeValue=@0xbfffbcac) at nsGenericDOMDataNode.cpp:90 #58 0x404419de in nsTextNode::SetNodeValue (this=0x8249f80, aNodeValue=@0xbfffbcac) at nsTextNode.cpp:49 #59 0x406b6b5a in SetNodeProperty (cx=0x8191f30, obj=0x82a1ca8, id=-3, vp=0xbfffc040) at nsJSNode.cpp:248 #60 0x407613a9 in js_SetProperty (cx=0x8191f30, obj=0x82a1ca8, id=135942344, vp=0xbfffc040) at jsobj.c:1914 #61 0x4074f5b2 in js_Interpret (cx=0x8191f30, result=0xbfffc114) at jsinterp.c:2160 #62 0x40740a11 in js_Invoke (cx=0x8191f30, argc=0, constructing=0) at jsinterp.c:666 #63 0x4075058a in js_Interpret (cx=0x8191f30, result=0xbfffc4e8) at jsinterp.c:2183 #64 0x40740a11 in js_Invoke (cx=0x8191f30, argc=1, constructing=0) at jsinterp.c:666 #65 0x40740cc8 in js_CallFunctionValue (cx=0x8191f30, obj=0x81b8990, fval=136022432, argc=1, argv=0xbfffc634, rval=0xbfffc638) at jsinterp.c:735 #66 0x4071a4d9 in JS_CallFunctionValue (cx=0x8191f30, obj=0x81b8990, fval=136022432, argc=1, argv=0xbfffc634, rval=0xbfffc638) at jsapi.c:2369 #67 0x406ba469 in nsJSEventListener::HandleEvent (this=0x824aba0, aEvent=0x8370848) at nsJSEventListener.cpp:93 #68 0x40443a76 in nsEventListenerManager::HandleEvent (this=0x824a428, aPresContext=@0x816f9f0, aEvent=0xbfffc774, aDOMEvent=0xbfffc6fc, aFlags=3, aEventStatus=@0xbfffc788) at nsEventListenerManager.cpp:816 #69 0x40e4e08e in RDFElementImpl::HandleDOMEvent (this=0x8248308, aPresContext=@0x816f9f0, aEvent=0xbfffc774, aDOMEvent=0xbfffc6fc, aFlags=1, aEventStatus=@0xbfffc788) at nsRDFElement.cpp:2178 #70 0x40e4ee67 in RDFElementImpl::ExecuteJSCode (anElement=0x8248308) at nsRDFElement.cpp:2453 #71 0x40e4eb54 in RDFElementImpl::ExecuteOnChangeHandler (this=0x8245e88, anElement=0x8249dc0, attrName=@0xbfffc98c) at nsRDFElement.cpp:2409 #72 0x40e4d108 in RDFElementImpl::SetAttribute (this=0x8245e88, aNameSpaceID=0, aName=0x81bbf28, aValue=@0xbfffca34, aNotify=1) at nsRDFElement.cpp:1744 #73 0x40e667d2 in RDFXULBuilderImpl::AddAttribute (this=0x816fb20, aElement=0x8245e98, aProperty=0x8361bc0, aValue=0x83706e8) at nsRDFXULBuilder.cpp:1863 #74 0x40e61758 in RDFXULBuilderImpl::OnAssert (this=0x816fb20, aSubject=0x8230fd0, aPredicate=0x8361bc0, aObject=0x83706e8) at nsRDFXULBuilder.cpp:739 #75 0x40e33b93 in CompositeDataSourceImpl::OnAssert (this=0x816f9b0, subject=0x8230fd0, predicate=0x8361bc0, object=0x83706e8) at nsCompositeDataSource.cpp:1002 #76 0x40e3779f in InMemoryDataSource::Assert (this=0x81704d0, source=0x8230fd0, property=0x8361bc0, target=0x83706e8, tv=1) at nsInMemoryDataSource.cpp:1244 #77 0x40e3327b in CompositeDataSourceImpl::Assert (this=0x816f9b0, source=0x8230fd0, property=0x8361bc0, target=0x83706e8, tv=1) at nsCompositeDataSource.cpp:736 #78 0x40e637ad in RDFXULBuilderImpl::OnSetAttribute (this=0x816fb20, aElement=0x8245e88, aName=@0xbfffcd88, aValue=@0xbfffcde4) at nsRDFXULBuilder.cpp:1247 #79 0x40e6e14f in XULDocumentImpl::OnSetAttribute (this=0x818e258, aElement=0x8245e88, aName=@0xbfffcd88, aValue=@0xbfffcde4) at nsXULDocument.cpp:2870 #80 0x40e4a9ca in RDFElementImpl::SetAttribute (this=0x8245e88, aName=@0xbfffcd88, aValue=@0xbfffcde4) at nsRDFElement.cpp:859 #81 0x40c93fc7 in setAttribute (shell=0x8166050, id=0x40ca2b84 "Browser:Status", name=0x40ca2b7f "text", value=@0xbfffcde4) at nsBrowserAppCore.cpp:590 #82 0x40c94fd0 in nsBrowserAppCore::OnStatus (this=0x828a760, aURL=0x8318250, aMsg=0xbfffcec8) at nsBrowserAppCore.cpp:886 #83 0x40264ee5 in nsWebShell::OnStatus (this=0x828b700, aURL=0x8318250, aMsg=0xbfffcec8) at nsWebShell.cpp:2378 #84 0x4025cdf9 in nsDocumentBindInfo::OnStatus (this=0x83704f8, aURL=0x8318250, aMsg=0xbfffcec8) at nsDocLoader.cpp:1836 #85 0x4023e8d6 in stub_Progress (context=0x82ddc38, msg=0x401bd8fa "Reading file...") at nsStubContext.cpp:362 #86 0x4021b703 in NET_Progress (context=0x82ddc38, msg=0x401bd8fa "Reading file...") at mkutils.c:98 #87 0x4015918a in net_open_file (cur_entry=0x82ddd80) at mkfile.c:511 #88 0x4015a4f5 in net_ProcessFile (cur_entry=0x82ddd80) at mkfile.c:1311 #89 0x4015a387 in net_FileLoad (cur_entry=0x82ddd80) at mkfile.c:1269 #90 0x4020f416 in NET_GetURL (URL_s=0x8370058, output_format=102, window_id=0x82ddc38, exit_routine=0x40238994 <bam_exit_routine(URL_Struct_ *, int, MWContext_ *)>) at mkgeturl.c:2979 #91 0x402370a1 in nsNetlibService::OpenStream (this=0x804e5a8, aUrl=0x8318250, aConsumer=0x83704f8) at nsNetService.cpp:433 #92 0x4025cac9 in nsDocumentBindInfo::Bind (this=0x83704f8, aURL=0x8318250, aListener=0x836fc78) at nsDocLoader.cpp:1733 #93 0x4025b961 in nsDocLoaderImpl::OpenStream (this=0x828bbb8, aUrl=0x8318250, aConsumer=0x836fc78) at nsDocLoader.cpp:1198 #94 0x40238611 in NS_OpenURL (aURL=0x8318250, aConsumer=0x836fc78) at nsNetService.cpp:1156 #95 0x400b7c79 in ImageNetContextImpl::GetURL (this=0x836bd10, aURL=0x836bd30, aLoadMethod=NET_NORMAL_RELOAD, aReader=0x8317ff0) at nsImageNetContextAsync.cpp:490 #96 0x407c637c in IL_GetImage ( image_url=0x83703d0 "file:///u/mcafee/cmonkey/mozilla/dist/bin/res/samples/gear1.gif", img_cx=0x836cef8, obs_list=0x8370418, background_color=0x0, req_width=0, req_height=0, flags=0, opaque_cx=0x836cf38) at if.cpp:1918 #97 0x400b87b3 in ImageRequestImpl::Init (this=0x83702a0, aGroupContext=0x836cef8, aUrl=0x83703d0 "file:///u/mcafee/cmonkey/mozilla/dist/bin/res/samples/gear1.gif", aObserver=0x8370300, aBackgroundColor=0x0, aWidth=0, aHeight=0, aFlags=0, aNetContext=0x836cf38) at nsImageRequest.cpp:107 #98 0x400b630e in ImageGroupImpl::GetImage (this=0x836ced0, aUrl=0x83703d0 "file:///u/mcafee/cmonkey/mozilla/dist/bin/res/samples/gear1.gif", aObserver=0x8370300, aBackgroundColor=0x0, aWidth=0, aHeight=0, aFlags=0) at nsImageGroup.cpp:233 #99 0x4041ed0a in nsFrameImageLoader::Init (this=0x8370300, aPresContext=0x82b7d38, aGroup=0x836ced0, aURL=@0x82c3784, aBackgroundColor=0x0, aTargetFrame=0x82c3980, aDesiredSize=@0xbfffd734, aCallBack=0, aNeedSizeUpdate=0, aNeedErrorNotification=0) at nsFrameImageLoader.cpp:156 #100 0x40424cd5 in nsPresContext::StartLoadImage (this=0x82b7d38, aURL=@0x82c3784, aBackgroundColor=0x0, aTargetFrame=0x82c3980, aDesiredSize=@0xbfffd734, aCallBack=0, aNeedSizeUpdate=0, aNeedErrorNotification=0, aLoaderResult=0xbfffd740) at nsPresContext.cpp:734 #101 0x40566616 in nsCSSRendering::PaintBackground (aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aForFrame=0x82c3980, aDirtyRect=@0xbfffd808, aBorderArea=@0xbfffd7b4, aColor=@0x82c376c, aSpacing=@0x82c37ac, aDX=0, aDY=0) at nsCSSRendering.cpp:1689 #102 0x404506eb in nsBlockFrame::Paint (this=0x82c3980, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffd808, aWhichLayer=eFramePaintLayer_Underlay) at nsBlockFrame.cpp:4595 #103 0x40455132 in nsContainerFrame::PaintChild (this=0x82bdae8, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffd914, aFrame=0x82c3980, aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:293 #104 0x404509d8 in nsBlockFrame::PaintChildren (this=0x82bdae8, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffd914, aWhichLayer=eFramePaintLayer_Underlay) at nsBlockFrame.cpp:4680 #105 0x404507bd in nsBlockFrame::Paint (this=0x82bdae8, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffd914, aWhichLayer=eFramePaintLayer_Underlay) at nsBlockFrame.cpp:4615 #106 0x40455132 in nsContainerFrame::PaintChild (this=0x82bd780, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffdc14, aFrame=0x82bdae8, aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:293 #107 0x404509d8 in nsBlockFrame::PaintChildren (this=0x82bd780, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffdc14, aWhichLayer=eFramePaintLayer_Underlay) at nsBlockFrame.cpp:4680 #108 0x404507bd in nsBlockFrame::Paint (this=0x82bd780, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffdc14, aWhichLayer=eFramePaintLayer_Underlay) at nsBlockFrame.cpp:4615 #109 0x40447581 in nsAreaFrame::Paint (this=0x82bd780, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffdc14, aWhichLayer=eFramePaintLayer_Underlay) at nsAreaFrame.cpp:222 #110 0x40455132 in nsContainerFrame::PaintChild (this=0x82bd450, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffde6c, aFrame=0x82bd780, aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:293 #111 0x40454f9a in nsContainerFrame::PaintChildren (this=0x82bd450, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffde6c, aWhichLayer=eFramePaintLayer_Underlay) at nsContainerFrame.cpp:233 #112 0x4045ec37 in nsHTMLContainerFrame::Paint (this=0x82bd450, aPresContext=@0x82b7d38, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffde6c, aWhichLayer=eFramePaintLayer_Underlay) at nsHTMLContainerFrame.cpp:78 #113 0x404783bc in PresShell::Paint (this=0x82d3078, aView=0x82bd4a0, aRenderingContext=@0x82c79a0, aDirtyRect=@0xbfffde6c) at nsPresShell.cpp:1920 #114 0x40eace8d in nsView::Paint (this=0x82bd4a0, rc=@0x82c79a0, rect=@0xbfffde6c, aPaintFlags=0, aResult=@0xbfffdea4) at nsView.cpp:622 #115 0x40eac2dd in nsView::Paint (this=0x82bc7b0, rc=@0x82c79a0, rect=@0xbfffdf34, aPaintFlags=0, aResult=@0xbfffdf44) at nsView.cpp:384 #116 0x40eb34db in nsViewManager::RenderViews (this=0x82d29b8, aRootView=0x82bc7b0, aRC=@0x82c79a0, aRect=@0xbfffdf34, aResult=@0xbfffdf44) at nsViewManager.cpp:1246 #117 0x40eb3368 in nsViewManager::Refresh (this=0x82d29b8, aView=0x82bc7b0, aContext=0x82c79a0, rect=0xbfffdfc8, aUpdateFlags=0) at nsViewManager.cpp:519 #118 0x40eb3d5a in nsViewManager::DispatchEvent (this=0x82d29b8, aEvent=0xbfffe088, aStatus=@0xbfffe00c) at nsViewManager.cpp:1626 #119 0x40eab688 in HandleEvent (aEvent=0xbfffe088) at nsView.cpp:63 #120 0x40098c42 in nsWidget::DispatchEvent (this=0x82bc820, event=0xbfffe088, aStatus=@0xbfffe048) at nsWidget.cpp:908 #121 0x40098b20 in nsWidget::DispatchWindowEvent (this=0x82bc820, event=0xbfffe088) at nsWidget.cpp:868 #122 0x40099be1 in nsWindow::OnPaint (this=0x82bc820, event=@0xbfffe088) at nsWindow.cpp:439 #123 0x400958e9 in handle_draw_event (w=0x82bca10, area=0xbfffe430, p=0x82bc820) at nsGtkEventHandler.cpp:504 #124 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x82bca10, func=0x40095894 <handle_draw_event(_GtkWidget *, _GdkRectangle *, void *)>, func_data=0x82bc820, args=0xbfffe168) at gtkmarshal.c:216 #125 0x4093311a in gtk_handlers_run (handlers=0x833ee48, signal=0xbfffe124, object=0x82bca10, params=0xbfffe168, after=0) at gtksignal.c:1909 #126 0x40932624 in gtk_signal_real_emit (object=0x82bca10, signal_id=8, params=0xbfffe168) at gtksignal.c:1469 #127 0x40930934 in gtk_signal_emit (object=0x82bca10, signal_id=8) at gtksignal.c:552 #128 0x40964894 in gtk_widget_draw (widget=0x82bca10, area=0xbfffe430) at gtkwidget.c:2310 #129 0x408fc593 in gtk_layout_draw (widget=0x82d2e80, area=0xbfffe794) at gtklayout.c:637 #130 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x82d2e80, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffe4cc) at gtkmarshal.c:216 #131 0x409324e1 in gtk_signal_real_emit (object=0x82d2e80, signal_id=8, params=0xbfffe4cc) at gtksignal.c:1432 #132 0x40930934 in gtk_signal_emit (object=0x82d2e80, signal_id=8) at gtksignal.c:552 #133 0x40964894 in gtk_widget_draw (widget=0x82d2e80, area=0xbfffe794) at gtkwidget.c:2310 #134 0x408fc593 in gtk_layout_draw (widget=0x828c0c0, area=0xbfffeaf8) at gtklayout.c:637 #135 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x828c0c0, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffe830) at gtkmarshal.c:216 #136 0x409324e1 in gtk_signal_real_emit (object=0x828c0c0, signal_id=8, params=0xbfffe830) at gtksignal.c:1432 #137 0x40930934 in gtk_signal_emit (object=0x828c0c0, signal_id=8) at gtksignal.c:552 #138 0x40964894 in gtk_widget_draw (widget=0x828c0c0, area=0xbfffeaf8) at gtkwidget.c:2310 #139 0x408fc593 in gtk_layout_draw (widget=0x828ba40, area=0xbfffee5c) at gtklayout.c:637 #140 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x828ba40, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffeb94) at gtkmarshal.c:216 #141 0x409324e1 in gtk_signal_real_emit (object=0x828ba40, signal_id=8, params=0xbfffeb94) at gtksignal.c:1432 #142 0x40930934 in gtk_signal_emit (object=0x828ba40, signal_id=8) at gtksignal.c:552 #143 0x40964894 in gtk_widget_draw (widget=0x828ba40, area=0xbfffee5c) at gtkwidget.c:2310 #144 0x408fc593 in gtk_layout_draw (widget=0x82437b8, area=0xbffff1c0) at gtklayout.c:637 #145 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x82437b8, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbfffeef8) at gtkmarshal.c:216 #146 0x409324e1 in gtk_signal_real_emit (object=0x82437b8, signal_id=8, params=0xbfffeef8) at gtksignal.c:1432 #147 0x40930934 in gtk_signal_emit (object=0x82437b8, signal_id=8) at gtksignal.c:552 #148 0x40964894 in gtk_widget_draw (widget=0x82437b8, area=0xbffff1c0) at gtkwidget.c:2310 #149 0x408fc593 in gtk_layout_draw (widget=0x81bb4d0, area=0x8165300) at gtklayout.c:637 #150 0x4096e591 in gtk_marshal_NONE__POINTER (object=0x81bb4d0, func=0x408fc488 <gtk_layout_draw>, func_data=0x0, args=0xbffff25c) at gtkmarshal.c:216 #151 0x409324e1 in gtk_signal_real_emit (object=0x81bb4d0, signal_id=8, params=0xbffff25c) at gtksignal.c:1432 #152 0x40930934 in gtk_signal_emit (object=0x81bb4d0, signal_id=8) at gtksignal.c:552 #153 0x40964894 in gtk_widget_draw (widget=0x81bb4d0, area=0x8165300) at gtkwidget.c:2310 #154 0x40964572 in gtk_widget_idle_draw (cb_data=0x0) at gtkwidget.c:2233 #155 0x409d7bf0 in g_idle_dispatch (source_data=0x40964038, current_time=0xbffff5e0, user_data=0x0) at gmain.c:1225 #156 0x409d6d53 in g_main_dispatch (current_time=0xbffff5e0) at gmain.c:644 #157 0x409d72df in g_main_iterate (block=1, dispatch=1) at gmain.c:851 #158 0x409d7461 in g_main_run (loop=0x8081fe8) at gmain.c:909 #159 0x409045f7 in gtk_main () at gtkmain.c:501 #160 0x4008dbb4 in nsAppShell::Run (this=0x8135e30) at nsAppShell.cpp:207 #161 0x40018259 in nsAppShellService::Run (this=0x81358e0) at nsAppShellService.cpp:174 #162 0x804a44c in main (argc=1, argv=0xbffff704) at nsAppRunner.cpp:337

from bug #4086: --------------------------------- cool. thanks - that's exactly what i needed. the basic sequence of things is: 1) we get a paint message and begin drawing the content. 2) along the way an image needs to draw and an image fetch is made. 3) netlib synchronously calls back with status messages which are triggering attribute changes in layout/style. 4) the attribute changes trigger a reflow which repositions views/widgets. 5) when we are done positioning the widgets after the reflow, gtk asks for a synchronous refresh of any damaged area. 6) we end up back in the paint code and bad things ensue. soooo, possible things are: 1) why does gtk issue a synchronous refresh? it can do refreshes asynchronously and this would seem like the right thing to do (and make this one case go away). 2) the attribute changes are causing a reflow and the general rule that we have had in nglayout all along is to never do anything in a Paint() method that can cause a reflow or you get the above results. 3) maybe netlib should not be synchronously calling back with the messages which cause the attribute change stuff. ----------------------------------- #1 seems to me to be a gtk bug. it's a really bad idea for gtk to assume that the application is in a state where a synchronous refresh can occur. #2 is probably ok and unavoidable. #3 maybe ok, but i'm not at all sure that it has been clearly defined when netlib will begin calling back to you during stream startup. is it a good idea that calling nsNetlibService::OpenStream will result in an immediate callback? changing the functionality at any one of these three places will make the problem go away - until the initial conditions change again slightly. this is why this has resurfaced: temporarily reflows were not happening as a result of the status updates (see bug #3289, as that problem comes and goes, so will this one). regardless of how much they can optimize the situation in bug #3289, all it will ever take to cause this assert to happen again is to change the set of attributes being changed in #2 to make the reflow happen (i.e. slightly change the xul attribute change handling *without exposing any bugs anywhere else* and this assert will appeatr again. bottom line is that we need look into #1 and #3 and come to some real resolution for both situations. there is no acceptable fix that can be made at the view level to patch over these problems.

*** Bug 2150 has been marked as a duplicate of this bug. ***

*** Bug 4086 has been marked as a duplicate of this bug. ***

FYI, demo #2 & #3 are now in menus for apprunner under Debug | Viewer.

*** Bug 4401 has been marked as a duplicate of this bug. ***

*** Bug 4362 has been marked as a duplicate of this bug. ***

what is going to be done to fix this?

what is going to be done to fix this?

ramiro -- can you please take a look?

Fixed last night.

verified in 4/9 build.

Moving all Apprunner bugs past and present to Other component temporarily whilst don and I set correct component. Apprunner component will be deleted/retired shortly.