This happens from a number of other calling locations .. something evil is going on. **** Purify instrumented ./mozilla-bin.pure (pid 3080) **** FMR: Free memory read (32 times): * This is occurring while in: nsTimerGtk::FireTimeout() [nsTimerGtk.cpp:54] nsTimerExpired [nsTimerGtk.cpp:165] g_timeout_dispatch [gmain.c:1147] g_main_dispatch [gmain.c:647] g_main_iterate [gmain.c:854] g_main_run [gmain.c:912] gtk_main [gtkmain.c:475] nsAppShell::Run() [nsAppShell.cpp:304] nsAppShellService::Run() [nsAppShellService.cpp:400] nsProfile::LoadDefaultProfileDir(nsCString&) [nsProfile.cpp:330] nsProfile::StartupWithArgs(nsICmdLineService*) [nsProfile.cpp:249] main1(int,char**,nsISplashScreen*) [nsAppRunner.cpp:589] main [nsAppRunner.cpp:770] _start [crt1.o] * Reading 4 bytes from 0x97b2f8 in the heap. * Address 0x97b2f8 is 16 bytes into a freed block at 0x97b2e8 of 24 bytes. * This block was allocated from: malloc [rtlib.o] __bUiLtIn_nEw [libxpcom.so] __builtin_new [rtlib.o] nsRenderingContextGTK::PushState() [nsRenderingContextGTK.cpp:286] nsTableRowFrame::PaintChildren(nsIPresContext*,nsIRenderingContext&,const nsRect&,nsFramePaintLayer) [nsTableRowFrame.cpp:431] nsTableRowFrame::Paint(nsIPresContext*,nsIRenderingContext&,const nsRect&,nsFramePaintLayer) [nsTableRowFrame.cpp:389] PresShell::Paint(nsIView*,nsIRenderingContext&,const nsRect&) [nsPresShell.cpp:2824] nsView::Paint(nsIRenderingContext&,const nsRect&,unsigned int,int&) [nsView.cpp:286] nsViewManager2::RenderDisplayListElement(DisplayListElement2*,nsIRenderingContex t&) [nsViewManager2.cpp:706] nsViewManager2::RenderViews(nsIView*,nsIRenderingContext&,const nsRect&,int&) [nsViewManager2.cpp:655] nsViewManager2::Refresh(nsIView*,nsIRenderingContext*,const nsRect*,unsigned int) [nsViewManager2.cpp:568] nsViewManager2::DispatchEvent(nsGUIEvent*,nsEventStatus*) [nsViewManager2.cpp:1126] HandleEvent(nsGUIEvent*) [nsView.cpp:68] nsWidget::DispatchEvent(nsGUIEvent*,nsEventStatus&) [nsWidget.cpp:1363] nsWidget::DispatchWindowEvent(nsGUIEvent*) [nsWidget.cpp:1254] nsWindow::DoPaint(int,int,int,int,nsIRegion*) [nsWindow.cpp:560] nsWindow::Update() [nsWindow.cpp:606] nsViewManager2::Composite() [nsViewManager2.cpp:928] vm_timer_callback(nsITimer*,void*) [nsViewManager2.cpp:84] nsTimerGtk::FireTimeout() [nsTimerGtk.cpp:48] nsTimerExpired [nsTimerGtk.cpp:165] g_timeout_dispatch [gmain.c:1147] g_main_dispatch [gmain.c:647] g_main_iterate [gmain.c:854] g_main_run [gmain.c:912] gtk_main [gtkmain.c:475] nsAppShell::Run() [nsAppShell.cpp:304] nsAppShellService::Run() [nsAppShellService.cpp:400] nsProfile::LoadDefaultProfileDir(nsCString&) [nsProfile.cpp:330] nsProfile::StartupWithArgs(nsICmdLineService*) [nsProfile.cpp:249] * There have been 24 frees since this block was freed from: free [rtlib.o] __bUiLtIn_dElEtE [libxpcom.so] __builtin_delete [rtlib.o] nsGraphicsState::~nsGraphicsState() [nsGraphicsStateGTK.cpp:38] nsRenderingContextGTK::PopState(int&) [nsRenderingContextGTK.cpp:351] nsTableRowFrame::PaintChildren(nsIPresContext*,nsIRenderingContext&,const nsRect&,nsFramePaintLayer) [nsTableRowFrame.cpp:442] nsTableRowFrame::Paint(nsIPresContext*,nsIRenderingContext&,const nsRect&,nsFramePaintLayer) [nsTableRowFrame.cpp:389] PresShell::Paint(nsIView*,nsIRenderingContext&,const nsRect&) [nsPresShell.cpp:2824] nsView::Paint(nsIRenderingContext&,const nsRect&,unsigned int,int&) [nsView.cpp:286] nsViewManager2::RenderDisplayListElement(DisplayListElement2*,nsIRenderingContex t&) [nsViewManager2.cpp:706] nsViewManager2::RenderViews(nsIView*,nsIRenderingContext&,const nsRect&,int&) [nsViewManager2.cpp:655] nsViewManager2::Refresh(nsIView*,nsIRenderingContext*,const nsRect*,unsigned int) [nsViewManager2.cpp:568] nsViewManager2::DispatchEvent(nsGUIEvent*,nsEventStatus*) [nsViewManager2.cpp:1126] HandleEvent(nsGUIEvent*) [nsView.cpp:68] nsWidget::DispatchEvent(nsGUIEvent*,nsEventStatus&) [nsWidget.cpp:1363] nsWidget::DispatchWindowEvent(nsGUIEvent*) [nsWidget.cpp:1254] nsWindow::DoPaint(int,int,int,int,nsIRegion*) [nsWindow.cpp:560] nsWindow::Update() [nsWindow.cpp:606] nsViewManager2::Composite() [nsViewManager2.cpp:928] vm_timer_callback(nsITimer*,void*) [nsViewManager2.cpp:84] nsTimerGtk::FireTimeout() [nsTimerGtk.cpp:48] nsTimerExpired [nsTimerGtk.cpp:165] g_timeout_dispatch [gmain.c:1147] g_main_dispatch [gmain.c:647] g_main_iterate [gmain.c:854] g_main_run [gmain.c:912] gtk_main [gtkmain.c:475] nsAppShell::Run() [nsAppShell.cpp:304] nsAppShellService::Run() [nsAppShellService.cpp:400] nsProfile::LoadDefaultProfileDir(nsCString&) [nsProfile.cpp:330]

reassigning to pavlov for triage.

Fix already done, checked in, etc.

yeah, gave bruce a fix and he checked it in. Eat that PDT.

verified