The drawable of that surface is the Window of the nsIWidget being destroyed
but that Window has already been destroyed, probably when a parent nsIWidget
was destroyed:
I suspect we might need to call Destroy() on all nsIWidgets associated with
child native windows. (Currently we only call Destroy() on the nsIWidgets in
the nsIWidget child list which is not all children of the native window.)
The cairo surface being destroyed is using the window for the drawable, and is
releasing the dst_picture
http:// hg.mozilla. org/mozilla- central/ annotate/ 4046f3843bdb/ gfx/cairo/ cairo/src/ cairo-xlib- surface. c#l296
(gdb) f 6 xlib_surface_ finish ( surface= 0x7f8f8ee56400) moz/dev/ gfx/cairo/ cairo/src/ cairo-xlib- surface. c:341 TYPE_XLIB, COLOR, ref_count = {ref_count = 0}, SUCCESS, finished = 0, user_data = {size = 1, transform = {xx = 1, yx = 0, xy = 0, yy = 1, x0 = 0, y0 = 0}, transform_ inverse = {xx = 1, yx = 0, xy = 0, yy = 1, x0 = -0, resolution = 300, y_fallback_ resolution = 300, xlib_surface_ detach_ display> }, NEAREST, repeat = 0,
#6 0x00007f8fc6d8a2c2 in _cairo_
abstract_
at /home/karl/
(gdb) p *surface
$376 = {base = {backend = 0x7f8fc70987e0, type = CAIRO_SURFACE_
content = CAIRO_CONTENT_
status = CAIRO_STATUS_
num_elements = 1, element_size = 24, elements = 0x7f8f8eee7438,
is_snapshot = 0}, mime_data = {size = 0, num_elements = 0,
element_size = 24, elements = 0x0, is_snapshot = 0},
device_
device_
y0 = -0}, x_resolution = 72, y_resolution = 72,
x_fallback_
clip = 0x7f8f8f0d9260, next_clip_serial = 1, current_clip_serial = 1,
is_snapshot = 0, has_font_options = 0, font_options = {
antialias = 2779096485, subpixel_order = 2779096485,
hint_style = 2779096485, hint_metrics = 2779096485}},
dpy = 0x7f8fcd151000, display = 0x7f8fac641c10,
screen_info = 0x7f8fac6163d0, close_display_hook = {prev = 0x7f8f9bfdb520,
next = 0x7f8f8ed5cd20,
func = 0x7f8fc6d8f5f2 <_cairo_
gc = 0x7f8f8ef0ea60, drawable = 44044608, screen = 0x7f8fcd139180,
owns_pixmap = 0, visual = 0x7f8fcd11f470, use_pixmap = 0, render_major = 0,
render_minor = 10, buggy_repeat = 0, width = 1069, height = 619,
depth = 24, dst_picture = 44045647, src_picture = 0, clip_dirty = 0,
have_clip_rects = 0, gc_has_clip_rects = 0, embedded_clip_rects = {{x = 0,
y = 0, width = 1069, height = 619}, {x = -23131, y = -23131,
width = 42405, height = 42405}, {x = -23131, y = -23131, width = 42405,
height = 42405}, {x = -23131, y = -23131, width = 42405,
height = 42405}, {x = -23131, y = -23131, width = 42405,
height = 42405}, {x = -23131, y = -23131, width = 42405,
height = 42405}, {x = -23131, y = -23131, width = 42405,
height = 42405}, {x = -23131, y = -23131, width = 42405,
height = 42405}}, clip_rects = 0x7f8f8ee5659c, num_clip_rects = 0,
xrender_format = 0x7f8fcd0fc940, filter = CAIRO_FILTER_
xtransform = {matrix = {{65536, 0, 0}, {0, 65536, 0}, {0, 0, 65536}}},
a_mask = 0, r_mask = 16711680, g_mask = 65280, b_mask = 255}
The drawable of that surface is the Window of the nsIWidget being destroyed
but that Window has already been destroyed, probably when a parent nsIWidget
was destroyed:
http:// hg.mozilla. org/mozilla- central/ annotate/ 4046f3843bdb/ widget/ src/gtk2/ nsWindow. cpp#l760
(gdb) f 13 d2ba0) moz/dev/ widget/ src/gtk2/ nsWindow. cpp:790 ct*)mGdkWindow STATE_WITHDRAWN , guffaw_gravity = 0, input_only = 0, and_descendants _freeze_ count = 0, redirect = 0x0} X11*)(( GdkWindowObject *)mGdkWindow) ->impl
g_type_ instance = {g_class = 0x7f8fcd1798c0}, ref_count = 1, window_ type = -1 'ÿ', override_redirect = 0, zed_configure = 0, damage = 0}
mNextSibling = {mRawPtr = 0x0}, mPrevSibling = 0x0}, mRefCnt = { default, mOnDestroyCalled = 0 '\0', Bounds = 0x0, mClipRects = {mRawPtr = 0x0}, Count = 0, mZIndex = 0, Reference> = {<nsISupportsWe akReference> = {<nsISupports> = {
_vptr. nsISupports = 0x7f8fc6599a68}, <No data fields>}, ostFocus = 0, mContainerBlock Focus = 0, mCanBeSeen = 0, erGrab = 0, mRetryKeyboardGrab = 0, mTransientParent = 0x0, :PluginType_ NONE, cyBitmapWidth = 0, mTransparencyBi tmapHeight = 0, Context = 0x0, mDragMotionX = 0, mDragMotionY = 0,
#13 0x00007f8fc6311441 in nsWindow::Destroy (this=0x7f8fa9c
at /home/karl/
(gdb) p *(GdkWindowObje
$386 = {parent_instance = {parent_instance = {g_type_instance = {
g_class = 0x7f8fcd179540}, ref_count = 2, qdata = 0x7f8f8ed4a180}},
impl = 0x7f8f8f018700, parent = 0x0, user_data = 0x0, x = 0, y = 0,
extension_events = 0, filters = 0x0, children = 0x0, bg_color = {pixel = 0,
red = 0, green = 0, blue = 0}, bg_pixmap = 0x2, paint_stack = 0x0,
update_area = 0x0, update_freeze_count = 0, window_type = 2 '\002',
depth = 24 '\030', resize_count = 0 '\0',
state = GDK_WINDOW_
modal_hint = 0, composited = 0, destroyed = 1, accept_focus = 1,
focus_on_map = 1, shaped = 0, event_mask = 176910,
update_
(gdb) p *(GdkWindowImpl
$388 = {parent_instance = {parent_instance = {parent_instance = {
qdata = 0x0}}, wrapper = 0x7f8f8f018340, colormap = 0x7f8fcd139400,
xid = 44044608, screen = 0x7f8fcd107000, picture = 0,
cairo_surface = 0x0}, width = 1069, height = 619, position_info = {x = 0,
y = 0, width = 1069, height = 619, x_offset = 0, y_offset = 0, big = 0,
mapped = 1, no_bg = 0, clip_rect = {x = 0, y = 0, width = 1069,
height = 619}}, toplevel = 0x0, cursor = 0x0,
toplevel_
use_synchroni
(gdb) p *this
$389 = (nsChildWindow) {<nsWindow> = {<nsBaseWidget> = {<nsIWidget> = {<nsISupports> = {_vptr.nsISupports = 0x7f8fc6599730}, mFirstChild = {
mRawPtr = 0x7f8f8ef61050}, mLastChild = 0x7f8f8ef61050,
mValue = 2}, _mOwningThread = {mThread = 0x7f8fcd110040},
mClientData = 0x0, mEventCallback = 0x7f8fc7b25dea <HandleEvent>,
mContext = 0x7f8f8ef0ef60, mToolkit = 0x7f8fb43ed400,
mBackground = 2779096485, mForeground = 2779096485,
mCursor = eCursor_standard, mWindowType = eWindowType_child,
mBorderStyle = eBorderStyle_
mBounds = {x = 0, y = 0, width = 1069, height = 619},
mOriginal
mClipRect
mSizeMode = nsSizeMode_Normal}, <nsSupportsWeak
mProxy = 0x0}, mOldFocusWindow = 0, mIMEData = 0x7f8fb33ab820,
mParent = {mRawPtr = 0x0}, mIsTopLevel = 0 '\0', mIsDestroyed = 1 '\001',
mNeedsResize = 0 '\0', mNeedsMove = 0 '\0', mListenForResizes = 1 '\001',
mIsShown = 0 '\0', mNeedsShow = 0 '\0', mEnabled = 1 '\001',
mCreated = 0 '\0', mPlaced = 1 '\001', mShell = 0x0, mContainer = 0x0,
mGdkWindow = 0x7f8f8f018340, mWindowGroup = 0x0, mContainerGotFocus = 0,
mContainerL
mRetryPoint
mSizeState = 0, mPluginType = nsWindow:
mTransparen
mThebesSurface = {mRawPtr = 0x0}, mRootAccessible = {mRawPtr = 0x0},
mIsTransparent = 0, mTransparencyBitmap = 0x0, mDragMotionWidget = 0x0,
mDragMotion
mDragMotionTime = 0, mDragMotionTimerID = 0, mDragLeaveTimer = {
mRawPtr = 0x0}, mLastMotionPressure = 0,
mLastSizeMode = nsSizeMode_Normal, mKeyDownFlags = {0, 0, 0, 0, 0, 0, 0,
0}}, <No data fields>}
I suspect we might need to call Destroy() on all nsIWidgets associated with
child native windows. (Currently we only call Destroy() on the nsIWidgets in
the nsIWidget child list which is not all children of the native window.)