Closed Bug 195721 Opened 21 years ago Closed 21 years ago

Reloading page via the contextmenu in print preview crashes Mozilla - Trunk M130 [@ nsSplittableFrame::Destroy]

Categories

(Core :: Print Preview, defect)

Product:
Core
Component:
Print Preview
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 156982

People

(Reporter: bugzilla, Unassigned)

References

(
URL
)

Details

(Keywords: crash, testcase, topcrash+)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030302
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030302

Mozilla crashes every time when reloading page (viewer demo) via contextmenu.


Reproducible: Always

Steps to Reproduce:
1. Go to /Viewer Demos/#9 Frames (resource:///res/samples/test9.html)
1. Go to Print Preview. 
3. Right click and select Reload in the contextmenu (shouldnt be there in first
place) --> crash.
Depends on: 126719
Keywords: stackwanted
José, could you post the Talkback ID of the crash to this bug?

(assuming that you use a Talkback-enabled build and that Talkback has popped up
after the crash for you)

In your Mozilla installation directory, you'll find
Mozilla\components\talkback.exe. When you run the exe, it will display a list of
past crashes. You can find the IDs (TB...) of the crashes there.
Alas, no copy'n'paste is available there.
Keywords: crash
Talkback ID: TB17682184G
Whiteboard: TB17682184G
Confirming it with build 2003021008 under Windows XP.

Tlakback ID: TB17683531H
Here are the incidents for the 2 crashes mentioned:

Incident ID 17683531
Stack Signature 	0x023817f5 ef88dd1b
Email Address 	
Product ID 	MozillaTrunk
Build ID 	2003021008
Trigger Time 	2003-03-03 06:59:58
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	
URL visited 	resource:///res/samples/test9.html
User Comments 	I opened that URL, then selected to Print Preview and finally
with right-click selected Reload, then Mozilla crashes.
Trigger Reason 	Illegal instruction
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x023817f5
nsSplittableFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp, line 73]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 146]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
nsPositionedInlineFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 1147]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 513]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1814]
PresShell::~PresShell
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1593]
PresShell::`scalar deleting destructor'
PresShell::Release
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1542]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 65]
nsPrintData::~nsPrintData
[c:/builds/seamonkey/mozilla/content/base/src/nsPrintData.cpp, line 146]
0x01d80c28
nsVoidArray::Clear [c:/builds/seamonkey/mozilla/xpcom/ds/nsVoidArray.cpp, line 605] 

-----------------------------------------------------------------------------

Incident ID 17682184
Stack Signature 	0x05624f30 548cca64
Email Address 	
Product ID 	MozillaTrunk
Build ID 	2003030208
Trigger Time 	2003-03-03 06:17:06
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	
URL visited 	
User Comments 	
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x05624f30
nsSplittableFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp, line 72]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 144]
ViewportFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 517]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1831]
PresShell::~PresShell
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1605]
PresShell::`scalar deleting destructor'
PresShell::Release
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1554]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 66]
nsPrintObject::~nsPrintObject
[c:/builds/seamonkey/mozilla/content/base/src/nsPrintObject.cpp, line 84]
nsPrintEngine::Destroy
[c:/builds/seamonkey/mozilla/content/base/src/nsPrintEngine.cpp, line 306]
DocumentViewerImpl::Destroy
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 1112]
gklayout.dll + 0x206814 (0x616d6814)
XULContentSinkImpl::AddRef
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULContentSink.cpp, line
442]
0x85107d8b 


Also adding topcrash+ and testcase keywords since it seems like an easily
reproducible crash and has the potential to be a topcrasher.
Keywords: stackwanted → testcase, topcrash+
Summary: Reloading page via the contextmenu in print preview crashes Mozilla → Reloading page via the contextmenu in print preview crashes Mozilla - Trunk [@ nsSplittableFrame::Destroy]
Jay Patel: I'm crashing with similar but not same repro. Belong this TB to this bug?
20030307/M130 -> TB17837610Z
2003030608/trunk -> TB17837754Q
Adam:  Yes, your crash is the same.  Could you please post your steps to
reproduce?  Thanks.  Here is your incident with the MozillaBranch build:
Incident ID 17837610
Stack Signature 	0x03b7cc7f a3056796
Email Address 	aha@pinknet.cz
Product ID 	MozillaBranch
Build ID 	2003030705
Trigger Time 	2003-03-07 10:09:35
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	
URL visited 	
User Comments 	reload in print preview
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x03b7cc7f
nsSplittableFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp, line 73]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 146]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsGfxScrollFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp, line 467]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
ViewportFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 513]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1815]
PresShell::~PresShell
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1594]
nsCOMPtr_base::assign_from_helper
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 78]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 65]
nsTypeAheadFind::GetTargetIfTypeAheadOkay
[c:/builds/seamonkey/mozilla/extensions/typeaheadfind/src/nsTypeAheadFind.cpp,
line 2411]
PrepareAndDispatch
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 119]
nsThread::AddRef [c:/builds/seamonkey/mozilla/xpcom/threads/nsThread.cpp, line 168]
xptiInterfaceInfo::GetSizeIsArgNumberForParam
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptinfo/src/xptiprivate.h, line 711]
0x75ff8510 

I'm adding M130 to summary since this is also crashing on the Mozilla 1.3 branch.
Summary: Reloading page via the contextmenu in print preview crashes Mozilla - Trunk [@ nsSplittableFrame::Destroy] → Reloading page via the contextmenu in print preview crashes Mozilla - Trunk M130 [@ nsSplittableFrame::Destroy]
I discovered this on Alenka.cz and Root.cz, here is repro:
1. open http://www.alenka.cz/ or test9.html
2. open Print Preview
3. reload page in Print Preview via Ctrl+R
4. close Print Preview
5. open Print Preview
6. reload page in Print Preview via Ctrl+R
-> crash

BTW both sites contains iframe - I was unable to crash browse on simple pages
without (i)frames - for example about:mozilla didn't crash for me.
Whiteboard: TB17682184G
nominating for Buffy
Updating QA contact
Keywords: nsbeta1
QA Contact: sujay → sairuh
The menu shouldnt appear in the print preview at all, right? That is also a 
regression?
is it a dupe of 192706 ?
*** Bug 192706 has been marked as a duplicate of this bug. ***
Please note that bug 192706 depended on bug 188836 while this one depends on bug
126719. Also bug 192706 was present on all versions of OS while this one is
Win2000. If these two are really dupes per content of stack, we should update
dependecies and OS platforms. 
Finally, I thought that newer bugs are marked as dupes, not the old ones since
someone might be already working on them.
*** Bug 202016 has been marked as a duplicate of this bug. ***
*** Bug 203929 has been marked as a duplicate of this bug. ***
Flags: blocking1.4+
Flags: blocking1.4?
Flags: blocking1.4+
it's be nice to just disable that menuitem or the context menu completely but
this isn't a 1.4 blocker.
Flags: blocking1.4? → blocking1.4-
Now this crashes right away when visiting the url with print preview.
adt: nsbeta1-
Keywords: nsbeta1 → nsbeta1-
*** Bug 205888 has been marked as a duplicate of this bug. ***
*** Bug 210809 has been marked as a duplicate of this bug. ***
*** Bug 214253 has been marked as a duplicate of this bug. ***
This crash happens when I try to print the about:config 
using mozilla 1.4 from a Tru64 UNIX.

At line # 381 of nsNativeThemeGTK.cpp 
nsNativeThemeGTK::DrawWidgetBackground calls a routine GetDrawingSurface
which sets the value of a pointer expilictly to "nsnull" and in the next
line tries to retrieve the pointer value, which is causing the crash.

>1  0x3ffbf781d8c in
((nsNativeThemeGTK*)0x14033ffa0)->nsNativeThemeGTK::DrawWidgetBackground(aContext=0x140ec7900,
aFrame=0x14107bc48, aWidgetType='W', aRect=& struct nsRect { ... }, aClipRect=&
struct nsRect { ... }) "nsNativeThemeGTK.cpp":381
    381   aContext->GetDrawingSurface((nsDrawingSurface*)&surface);
(ladebug) down
>0  0x30005015b94 in
((nsRenderingContextPS*)0x140ec7900)->nsRenderingContextPS::GetDrawingSurface(aSurface=0x11ffface8)
"nsRenderingContextPS.cpp":238
    238   *aSurface = nsnull;
(ladebug) file
nsRenderingContextPS.cpp

This looks very wrong, atleast in Tru64 UNIX.
Blocks: 223888

*** This bug has been marked as a duplicate of 156982 ***
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
verified.
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsSplittableFrame::Destroy]
You need to log in before you can comment on or make changes to this bug.