1563163 - Tab crashes when inspecting page in Print Preview mode

Status: VERIFIED FIXED

(DevTools :: Inspector, defect)

Description

[dale]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

1. Open any page;
2. Go into print preview;
3. Right Click - Inspect Element;

Actual results:

Tab crash

Expected results:

Inspector opened with css styles for @print media

Comment 1

[Andre Klapper]

Please follow the steps on http://support.mozilla.com/kb/Firefox%20crashes and report back here. Thanks!

Comment 2

[dale]

Hello Andre!

Just reproduced the bug in safe mode.

Firefox is clean and up to date (latest from the repos).

Comment 3

[Marcia Knous [:marcia]]

Hello Dale - Do you have a crash report in about:crashes? If so, please paste it here. Thanks.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

I can reproduce this trivially: https://crash-stats.mozilla.org/report/index/1e57a5c2-458a-4a1a-ac93-4d11f0190822

It's crasing with a null dereference here on the flexbox lenght code: https://crash-stats.mozilla.org/report/index/63d85631-d0b7-481b-92eb-3bce60190822

Brad, seems you are familiar with that code? We could at least mitigate the crash I'm sure.

Comment 5

[Brad Werth [:bradwerth] | Out until Feb 2025]

Okay, the core issue is that nsPageSequenceFrame::Reflow early exits during incremental reflow at https://searchfox.org/mozilla-central/source/layout/generic/nsPageSequenceFrame.cpp#152. So the flex container is supposed to reflow and generate the FlexContainerInfo structure, but never gets the chance. The Flex::Flex constructor assumes that the structure exists, and dereferences the NULL pointer.

I don't know how to fix the nsPageSequenceFrame::Reflow issue, so I'll needinfo Mats on that -- is there an existing bug? I'll fix the Flex::Flex code to gracefully handle the case of the missing FlexContainerInfo structure. That will fix the crash, but we'll also have an empty Flex Layout panel when inspecting flex containers under these conditions.

Comment 6

[Mats Palmgren (inactive)]

That's a can of worms, see bug 1157012 and the bugs linked from there.

Comment 7

[Brad Werth [:bradwerth] | Out until Feb 2025]

Attachment: Bug 1563163 Part 1: Make Flex::Flex gracefully handle frames without FlexContainerInfo structures.

Comment 8

[Brad Werth [:bradwerth] | Out until Feb 2025]

Attachment: Bug 1563163 Part 2: Downgrade an assert to a warning in nsFlexContainerFrame::GetFlexFrameWithComputedInfo.

Depends on D44283

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5119f09d6b99
Part 1: Make Flex::Flex gracefully handle frames without FlexContainerInfo structures. r=mats
https://hg.mozilla.org/integration/autoland/rev/776f100fead6
Part 2: Downgrade an assert to a warning in nsFlexContainerFrame::GetFlexFrameWithComputedInfo. r=mats

Comment 10

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/5119f09d6b99
https://hg.mozilla.org/mozilla-central/rev/776f100fead6

Comment 11

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5119f09d6b99
https://hg.mozilla.org/releases/mozilla-beta/rev/776f100fead6

Comment 14

[Negritas Sergiu, Desktop QA]

Following the STR from the first comment, I managed to reproduce the issue on nightly 69.0a1 (2019-07-02) but only for the Twitter, YouTube and Reddit websites .
I can confirm that the issue is fixed in 70.0b6.