1660189 - Crash in [@ nsPrintObject::InitAsRootObject]

Status: VERIFIED FIXED

(Core :: Print Preview, defect)

Description

[Cornel Ionce [:noni] [Hubs QA]]

This bug is for crash report bp-85e47faa-62b3-42e6-a84e-58fcb0200820.

Top 10 frames of crashing thread:

0 libxul.so nsPrintObject::InitAsRootObject layout/printing/nsPrintObject.cpp:107
1 libxul.so nsPrintJob::DoCommonPrint layout/printing/nsPrintJob.cpp:663
2 libxul.so nsPrintJob::CommonPrint layout/printing/nsPrintJob.cpp:586
3 libxul.so nsPrintJob::PrintPreview layout/printing/nsPrintJob.cpp:960
4 libxul.so nsDocumentViewer::PrintPreview layout/base/nsDocumentViewer.cpp:3221
5 libxul.so NS_InvokeByIndex 
6 libxul.so XPCWrappedNative::CallMethod js/xpconnect/src/XPCWrappedNative.cpp:1141
7 libxul.so XPC_WN_CallMethod js/xpconnect/src/XPCWrappedNativeJSOps.cpp:946
8 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:599
9 libxul.so Interpret js/src/vm/Interpreter.cpp:3336

Affected versions

• 81.0a1 (BuildId:20200819212829)

Affected platforms

• Windows 10 64bit
• Ubuntu 20.04 64bit.
• macOS 10.15

Preconditions

• Ensure that the print.tab_modal.enabled pref is set to true

Steps to reproduce

1. Launch Firefox.
2. Access the following page and quickly open print preview (before the page is completely loaded)
3. Close print preview.

Expected result

• Print preview is closed and the PDF is properly displayed.

Actual result

• Tab Crash

Regression Window

• Will get back with a regression range asap.

[Suggested Severity] S2

More crashreports:

• bp-50a63fda-3863-4309-9acf-275c00200820
• bp-fc549dc3-2469-45a2-9e57-fc7260200820
• bp-8fafa87d-d61a-4a1e-a27a-44c330200820
• bp-2f22e6da-5f58-462b-8a52-e6ffb0200820

Comment 1

[Hiroyuki Ikezoe (:hiro)]

Maybe caused by bug 1654935?

Comment 2

[Jonathan Watt [:jwatt]]

(In reply to Hiroyuki Ikezoe (:hiro) from comment #1)

Maybe caused by bug 1654935?

So we're failing the:

    MOZ_ALWAYS_SUCCEEDS(
        targetBC->SetOpenerPolicy(sourceBC->Top()->GetOpenerPolicy()));

introduced by that bug. But I don't think we can say it was caused by it since that code landed on the 5th August, but the first crash is from build 20200817093723 (17th August), 12 days later.

Comment 3

[Jonathan Watt [:jwatt]]

Tom, can you spot anything in the code for the new print UI that might be causing this?

Comment 4

[Tom Tung [:tt, :ttung]]

I will have a closer look tomorrow, but it seems the targetBC is discarded which is unexpected.

Comment 5

[Hiroyuki Ikezoe (:hiro)]

Okay, this is (indirectly) regressed by bug 1557983.
this DispatchEventToWindowTree call might run script, thus it might destroy the docshell, we need to bail out in the case.

Comment 6

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1660189 - Bail out from nsPrintJob::DoCommonPrint if the docshell was destroyed in beforeprint event handlers. r?#layout-reviewers

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/592c99d30543
Bail out from nsPrintJob::DoCommonPrint if the docshell was destroyed in beforeprint event handlers. r=dholbert

Comment 8

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/592c99d30543

Comment 9

[Cornel Ionce [:noni] [Hubs QA]]

Confirming the crash no longer reproduces on latest 81.0a1 Nightly (buildID 20200823211533).

Comment 10

[Maria Berlinger [:mberlinger], Services QA]

https://testrail.stage.mozaws.net/index.php?/cases/view/1084763