152536 - crashes if I leave the print preview via "close" [@ PresShell::WillCauseReflow]

Status: VERIFIED FIXED

(Core :: Print Preview, defect, P1)

Description

[Marc Hermann]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.0) Gecko/20020530
BuildID:    2002053012

Every time I leave the print preview on this page via "close", it crashes

Reproducible: Always
Steps to Reproduce:
1.go to www.southside.de
2.click on "bands"
3.do the print preview
4.leave it via "close"

Actual Results:  crash

Expected Results:  not crash

Comment 1

[pbclarke]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.1a) Gecko/20020611

I can confirm this.  The first time I tried it worked as it should, the second
time however it failed and crashed the browser.

Sent report via Quality Feedback Agent: Incident ID TB7454971Y

Comment 2

[Brian Weir]

Platform: PC
OS: Win2000 Build 2195
BuildID: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1a) Gecko/20020617

I was unable to duplicate this problem on the website www.southside.de as
described. Print Preview also worked fine on www.cnn.com, www.gamespot.com, and
www.slashdot.org. 

I was able to duplicate the problem on http://www.ssa.gov/ . 

The talkback ID I was given for this crash is TB7457481Q

I have attached the output of the talkback details as a file and see if I cannot
come up with a test case for this issue

Comment 3

[Brian Weir]

Sorry it won't let me attach the file...it is too large. 

Comment 4

[Andrew Hagen]

WFM 1.1 alpha 2002061712 Windows 98. I opened the URL and did a print preview. 
I maximized the window. I clicked close. Then I restored the window size. Then 
I maximized the window. Then I went to print preview again. Then I clicked 
close. Then I restored the window. No crashes.

Can this problem be reproduced on the latest-trunk build with a new profile?

Comment 5

[Aleksey Nogin]

I see this on RedHat Linux running BuildID 2002061018. It seems that the crash
occurs while Mozilla is redrawing the original page.

(gdb) bt
#0  0x417a356c in PresShell::WillCauseReflow () from
/usr/lib/mozilla/components/libgklayout.so
#1  0x417a1b70 in PresShell::ContentStatesChanged () from
/usr/lib/mozilla/components/libgklayout.so
#2  0x41226184 in nsDocument::ContentStatesChanged () from
/usr/lib/mozilla/components/libgkcontent.so
#3  0x410b5ddc in nsEventStateManager::SetContentState () from
/usr/lib/mozilla/components/libgkcontent.so
#4  0x410b189d in nsEventStateManager::PostHandleEvent () from
/usr/lib/mozilla/components/libgkcontent.so
#5  0x417a320a in PresShell::HandleEventInternal () from
/usr/lib/mozilla/components/libgklayout.so
#6  0x417a2f9d in PresShell::HandleEvent () from
/usr/lib/mozilla/components/libgklayout.so
#7  0x41931c1c in nsViewManager::HandleEvent () from
/usr/lib/mozilla/components/libgkview.so
#8  0x41926e67 in nsView::HandleEvent () from
/usr/lib/mozilla/components/libgkview.so
#9  0x4193127f in nsViewManager::DispatchEvent () from
/usr/lib/mozilla/components/libgkview.so
#10 0x41926952 in HandleEvent () from /usr/lib/mozilla/components/libgkview.so
#11 0x4084d9e1 in nsWidget::DispatchEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#12 0x4084d8d7 in nsWidget::DispatchWindowEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#13 0x4084da6f in nsWidget::DispatchMouseEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#14 0x4084dfb1 in nsWidget::OnEnterNotifySignal () from
/usr/lib/mozilla/components/libwidget_gtk.so
#15 0x40851a2c in nsWindow::OnEnterNotifySignal () from
/usr/lib/mozilla/components/libwidget_gtk.so
#16 0x40851e5d in nsWindow::HandleGDKEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#17 0x4084823a in dispatch_superwin_event () from
/usr/lib/mozilla/components/libwidget_gtk.so
#18 0x40848027 in handle_gdk_event () from
/usr/lib/mozilla/components/libwidget_gtk.so
#19 0x40378d7f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#20 0x403ac773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#21 0x403acd39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#22 0x403aceec in g_main_run () from /usr/lib/libglib-1.2.so.0
#23 0x402c7333 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#24 0x408409b9 in nsAppShell::Run () from
/usr/lib/mozilla/components/libwidget_gtk.so
#25 0x4081f772 in nsAppShellService::Run () from
/usr/lib/mozilla/components/libnsappshell.so
#26 0x08053055 in getCountry ()
#27 0x0805399b in main ()
#28 0x4050a647 in __libc_start_main (main=0x8053850 <main>, argc=1,
ubp_av=0xbffff674, init=0x804cc4c <_init>, fini=0x8055220 <_fini>,
    rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffff66c) at
../sysdeps/generic/libc-start.c:129

Comment 6

[rods (gone)]

Attachment: patch

We are destroying the PresShell without calling EndObservingDocument, when a
BeginObservingDocument was already called. This means the PresShell is still
registered as an observer of the document and then later can cause a crash when
the document loops thru the observer list.

Low risk fix, tested many sites in Print Preview and out again. The testcase no
longer crashes.

Comment 7

[dcone (gone)]

Comment on attachment 88296 [details] [diff] [review]
patch

r=dcone

Comment 8

[Kevin McCluskey (gone)]

nsbeta1+

Comment 9

[Johnny Stenback (:jst)]

Comment on attachment 88296 [details] [diff] [review]
patch

sr=jst

Comment 10

[rods (gone)]

fixed

Comment 11

[Paul Wyskoczka]

olga, can you verify this fix on the trunk.  thx.

Comment 12

[Olga]

Verified on trunk 06/20/02, Win2K.
Before I reproduced it on previous trunk build.
I would like to point that Alt+F4 does not work on Print Preview window.
Please comment if there is another bug for this. Otherwise I should log it.

Comment 13

[Andrew Hagen]

The Alt+F4 / accelerator key combination / close print preview window / close
print preview issue isn't part of this bug. It's explained in bug 133787. 

Comment 14

[Olga]

I am glad that Alt+F4 issue is logged.

Comment 15

[Paul Wyskoczka]

Adding adt1.0.1+ on behalf of the adt for checkin to the 1.0 branch.  Please get
drivers approval before checking in. When you check this into the branch, please
change the mozilla1.0.1+ keyword to fixed1.0.1

Comment 16

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 17

[rods (gone)]

fixed on branch

Comment 18

[Pete Zha]

This bug still hapan on trunk(08/13) WIN2K.
crash at "observer->BeginUpdate(this);" in nsDocument::BeginUpdate()
observer is pointing to garbage.

Comment 19

[Pete Zha]

Attachment: call stack

call stack for the testcase

Comment 20

[Pete Zha]

Attachment: patch

patch to fix the crash

Comment 21

[Pete Zha]

reopen

Comment 22

[Pete Zha]

rods, could you review this one?

Comment 23

[Kevin McCluskey (gone)]

-> jkeiser. John can you review Pete's fix in comment #20?

Comment 24

[John Keiser (jkeiser)]

Comment on attachment 95218 [details] [diff] [review]
patch

This patch is obsolete, and I believe the bug is fixed.  Pete, do you see this
anymore?

Comment 25

[Olivier Cahagne]

I don't crash using build 2003020204 on Win2k, trying to print preview the
bands' page and closing print preview.

Comment 26

[Pete Zha]

WFM on 2002-02-08 trunk (Linux). No crash. I think we can close this one.

Comment 27

[Adam Hauner]

Marking FIXED (still) per last comment.

Comment 28

[sairuh (rarely reading bugmail)]

i don't see this problem anymore with recent builds, so marking verified.