195721 - Reloading page via the contextmenu in print preview crashes Mozilla - Trunk M130 [@ nsSplittableFrame::Destroy]

Status: VERIFIED DUPLICATE of bug 156982

(Core :: Print Preview, defect)

Description

[José Jeria]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030302
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030302

Mozilla crashes every time when reloading page (viewer demo) via contextmenu.


Reproducible: Always

Steps to Reproduce:
1. Go to /Viewer Demos/#9 Frames (resource:///res/samples/test9.html)
1. Go to Print Preview. 
3. Right click and select Reload in the contextmenu (shouldnt be there in first
place) --> crash.

Comment 1

[Oliver Klee]

José, could you post the Talkback ID of the crash to this bug?

(assuming that you use a Talkback-enabled build and that Talkback has popped up
after the crash for you)

In your Mozilla installation directory, you'll find
Mozilla\components\talkback.exe. When you run the exe, it will display a list of
past crashes. You can find the IDs (TB...) of the crashes there.
Alas, no copy'n'paste is available there.

Comment 2

[José Jeria]

Talkback ID: TB17682184G

Comment 3

[joakim_46]

Confirming it with build 2003021008 under Windows XP.

Tlakback ID: TB17683531H

Comment 4

[Jay Patel [:jay]]

Here are the incidents for the 2 crashes mentioned:

Incident ID 17683531
Stack Signature 	0x023817f5 ef88dd1b
Email Address 	
Product ID 	MozillaTrunk
Build ID 	2003021008
Trigger Time 	2003-03-03 06:59:58
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	
URL visited 	resource:///res/samples/test9.html
User Comments 	I opened that URL, then selected to Print Preview and finally
with right-click selected Reload, then Mozilla crashes.
Trigger Reason 	Illegal instruction
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x023817f5
nsSplittableFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp, line 73]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 146]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
nsPositionedInlineFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp, line 1147]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 513]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1814]
PresShell::~PresShell
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1593]
PresShell::`scalar deleting destructor'
PresShell::Release
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1542]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 65]
nsPrintData::~nsPrintData
[c:/builds/seamonkey/mozilla/content/base/src/nsPrintData.cpp, line 146]
0x01d80c28
nsVoidArray::Clear [c:/builds/seamonkey/mozilla/xpcom/ds/nsVoidArray.cpp, line 605] 

-----------------------------------------------------------------------------

Incident ID 17682184
Stack Signature 	0x05624f30 548cca64
Email Address 	
Product ID 	MozillaTrunk
Build ID 	2003030208
Trigger Time 	2003-03-03 06:17:06
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	
URL visited 	
User Comments 	
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x05624f30
nsSplittableFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp, line 72]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 144]
ViewportFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 517]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1831]
PresShell::~PresShell
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1605]
PresShell::`scalar deleting destructor'
PresShell::Release
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1554]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 66]
nsPrintObject::~nsPrintObject
[c:/builds/seamonkey/mozilla/content/base/src/nsPrintObject.cpp, line 84]
nsPrintEngine::Destroy
[c:/builds/seamonkey/mozilla/content/base/src/nsPrintEngine.cpp, line 306]
DocumentViewerImpl::Destroy
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 1112]
gklayout.dll + 0x206814 (0x616d6814)
XULContentSinkImpl::AddRef
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULContentSink.cpp, line
442]
0x85107d8b 


Also adding topcrash+ and testcase keywords since it seems like an easily
reproducible crash and has the potential to be a topcrasher. 

Comment 5

[Adam Hauner]

Jay Patel: I'm crashing with similar but not same repro. Belong this TB to this bug?
20030307/M130 -> TB17837610Z
2003030608/trunk -> TB17837754Q

Comment 6

[Jay Patel [:jay]]

Adam:  Yes, your crash is the same.  Could you please post your steps to
reproduce?  Thanks.  Here is your incident with the MozillaBranch build:
Incident ID 17837610
Stack Signature 	0x03b7cc7f a3056796
Email Address 	[e-mail]
Product ID 	MozillaBranch
Build ID 	2003030705
Trigger Time 	2003-03-07 10:09:35
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	
URL visited 	
User Comments 	reload in print preview
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x03b7cc7f
nsSplittableFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp, line 73]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 146]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsGfxScrollFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp, line 467]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 145]
ViewportFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 513]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1815]
PresShell::~PresShell
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1594]
nsCOMPtr_base::assign_from_helper
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 78]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 65]
nsTypeAheadFind::GetTargetIfTypeAheadOkay
[c:/builds/seamonkey/mozilla/extensions/typeaheadfind/src/nsTypeAheadFind.cpp,
line 2411]
PrepareAndDispatch
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 119]
nsThread::AddRef [c:/builds/seamonkey/mozilla/xpcom/threads/nsThread.cpp, line 168]
xptiInterfaceInfo::GetSizeIsArgNumberForParam
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptinfo/src/xptiprivate.h, line 711]
0x75ff8510 

I'm adding M130 to summary since this is also crashing on the Mozilla 1.3 branch.

Comment 7

[Adam Hauner]

I discovered this on Alenka.cz and Root.cz, here is repro:
1. open http://www.alenka.cz/ or test9.html
2. open Print Preview
3. reload page in Print Preview via Ctrl+R
4. close Print Preview
5. open Print Preview
6. reload page in Print Preview via Ctrl+R
-> crash

BTW both sites contains iframe - I was unable to crash browse on simple pages
without (i)frames - for example about:mozilla didn't crash for me.

Comment 8

[Paul Wyskoczka]

nominating for Buffy
Updating QA contact

Comment 9

[José Jeria]

The menu shouldnt appear in the print preview at all, right? That is also a 
regression?

Comment 10

[Yves Lambert]

is it a dupe of 192706 ?

Comment 11

[sairuh (rarely reading bugmail)]

*** Bug 192706 has been marked as a duplicate of this bug. ***

Comment 12

[Mirek]

Please note that bug 192706 depended on bug 188836 while this one depends on bug
126719. Also bug 192706 was present on all versions of OS while this one is
Win2000. If these two are really dupes per content of stack, we should update
dependecies and OS platforms. 
Finally, I thought that newer bugs are marked as dupes, not the old ones since
someone might be already working on them.

Comment 13

[Matthias Versen [:Matti]]

*** Bug 202016 has been marked as a duplicate of this bug. ***

Comment 14

[Matthias Versen [:Matti]]

*** Bug 203929 has been marked as a duplicate of this bug. ***

Comment 15

[Asa Dotzler [:asa]]

it's be nice to just disable that menuitem or the context menu completely but
this isn't a 1.4 blocker.

Comment 16

[José Jeria]

Now this crashes right away when visiting the url with print preview.

Comment 17

[Samir Gehani]

adt: nsbeta1-

Comment 18

[Olivier Cahagne]

*** Bug 205888 has been marked as a duplicate of this bug. ***

Comment 19

[Olivier Cahagne]

*** Bug 210809 has been marked as a duplicate of this bug. ***

Comment 20

[José Jeria]

*** Bug 214253 has been marked as a duplicate of this bug. ***

Comment 21

[Shanmu]

This crash happens when I try to print the about:config 
using mozilla 1.4 from a Tru64 UNIX.

At line # 381 of nsNativeThemeGTK.cpp 
nsNativeThemeGTK::DrawWidgetBackground calls a routine GetDrawingSurface
which sets the value of a pointer expilictly to "nsnull" and in the next
line tries to retrieve the pointer value, which is causing the crash.

>1  0x3ffbf781d8c in
((nsNativeThemeGTK*)0x14033ffa0)->nsNativeThemeGTK::DrawWidgetBackground(aContext=0x140ec7900,
aFrame=0x14107bc48, aWidgetType='W', aRect=& struct nsRect { ... }, aClipRect=&
struct nsRect { ... }) "nsNativeThemeGTK.cpp":381
    381   aContext->GetDrawingSurface((nsDrawingSurface*)&surface);
(ladebug) down
>0  0x30005015b94 in
((nsRenderingContextPS*)0x140ec7900)->nsRenderingContextPS::GetDrawingSurface(aSurface=0x11ffface8)
"nsRenderingContextPS.cpp":238
    238   *aSurface = nsnull;
(ladebug) file
nsRenderingContextPS.cpp

This looks very wrong, atleast in Tru64 UNIX.

Comment 22

[timeless]

*** This bug has been marked as a duplicate of 156982 ***

Comment 23

[Henrik Skupin [:whimboo][⌚️UTC+2] (away 02/17 - 02/21)]

verified.