783824 - crash in InsertViewsInReverseOrder while printing

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

With combined signatures, it's #2 top crasher in today's build.
It appeared in 17.0a1/20120815, then in 17.0a1/20120818. The last regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a79132ac2f05&tochange=812ea773f166
It's likely a regression from bug 775965.

Signature 	nsViewManager::InsertChild(nsIView*, nsIView*, nsIView*, bool) More Reports Search
UUID	9d525f47-77bb-4750-80c7-d3d012120818
Date Processed	2012-08-18 21:47:57
Uptime	17
Last Crash	21 seconds before submission
Install Age	3.8 hours since version was first installed.
Install Time	2012-08-18 17:56:47
Product	Firefox
Version	17.0a1
Build ID	20120818030604
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x18
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0116, AdapterSubsysID: 04d81028, AdapterDriverVersion: 8.15.10.2253
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0116
Total Virtual Memory	4294836224
Available Virtual Memory	3798654976
System Memory Use Percentage	33
Available Page File	10261954560
Available Physical Memory	4202401792

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsViewManager::InsertChild 	view/src/nsViewManager.cpp:856
1 	xul.dll 	InsertViewsInReverseOrder 	layout/generic/nsSubDocumentFrame.cpp:966
2 	xul.dll 	nsSubDocumentFrame::Init 	layout/generic/nsSubDocumentFrame.cpp:167
3 	xul.dll 	nsCSSFrameConstructor::InitAndRestoreFrame 	layout/base/nsCSSFrameConstructor.cpp:4545
4 	xul.dll 	nsCSSFrameConstructor::ConstructFrameFromItemInternal 	layout/base/nsCSSFrameConstructor.cpp:3648
5 	xul.dll 	nsCSSFrameConstructor::ConstructFramesFromItem 	layout/base/nsCSSFrameConstructor.cpp:5552
6 	xul.dll 	nsCSSFrameConstructor::ConstructFramesFromItemList 	layout/base/nsCSSFrameConstructor.cpp:9817
7 	xul.dll 	nsCSSFrameConstructor::ProcessChildren 	layout/base/nsCSSFrameConstructor.cpp:9962
8 	xul.dll 	nsCSSFrameConstructor::ConstructBlock 	layout/base/nsCSSFrameConstructor.cpp:11009
9 	xul.dll 	nsCSSFrameConstructor::ConstructFrameFromItemInternal 	layout/base/nsCSSFrameConstructor.cpp:3612
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsViewManager%3A%3AInsertChild%28nsIView*%2C+nsIView*%2C+nsIView*%2C+bool%29
https://crash-stats.mozilla.com/report/list?signature=nsView%3A%3AInsertChild%28nsView*%2C+nsView*%29
https://crash-stats.mozilla.com/report/list?signature=InsertViewsInReverseOrder

Comment 1

[Scoobidiver (away)]

More reports also at:
https://crash-stats.mozilla.com/report/list?signature=nsView%3A%3AInsertChild

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch v1

Discard the stashed presentation if the presshell is being destroyed when we make the decision whether to hide the frameloader.

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

Looks like it's going green:
https://tbpl.mozilla.org/?tree=Try&rev=21fbdb7cb702

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b9f41d4aecb1

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/b9f41d4aecb1