251943 - Browser crashes while printing or print previewing this page [@ 0x00000000 - nsIView::Destroy ]

Status: RESOLVED DUPLICATE of bug 248825

(Core :: Printing: Output, defect)

Description

[Manu Garg]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

When I try to do print preview of the following page, browser crashes immediately:

http://mamchenkov.net/blog/item/vim_for_perl_developers

This bug is reproducable and has been tested on Mozilla 1.7 and Firefox 0.8

Reproducible: Always
Steps to Reproduce:
1. open the url: http://mamchenkov.net/blog/item/vim_for_perl_developers
2. Try print preview or print

Actual Results:  
Browser crashes.

Comment 1

[Boris Zbarsky [:bzbarsky]]

We're dying when destroying a view:

#0  0x00000000 in ?? ()
#1  0x416ab104 in nsIView::Destroy() (this=0x8a2dc9c)
    at /home/bzbarsky/mozilla/debug/mozilla/view/src/nsView.cpp:252
#2  0x4125595d in nsFrame::Destroy(nsIPresContext*) (this=0x8a2dc9c, 
    aPresContext=0x8b555b0)
    at /home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsFrame.cpp:639
#3  0x412d0adb in nsSplittableFrame::Destroy(nsIPresContext*) (this=0x8a2dc9c, 
    aPresContext=0x8b555b0)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsSplittableFrame.cpp:71
#4  0x4127bdb7 in nsImageFrame::Destroy(nsIPresContext*) (this=0x8a2dc9c, 
    aPresContext=0x8b555b0)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsImageFrame.cpp:268
#5  0x4128d175 in nsLineBox::DeleteLineList(nsIPresContext*, nsLineList&) (
    aPresContext=0x8b555b0, aLines=@0x8a2dc84)
    at /home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsLineBox.cpp:300
#6  0x41234c5d in nsBlockFrame::Destroy(nsIPresContext*) (this=0x8a2dc48, 
    aPresContext=0x8b555b0)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsBlockFrame.cpp:301
#7  0x41232a16 in nsAreaFrame::Destroy(nsIPresContext*) (this=0x8a2dc48, 
    aPresContext=0x8b555b0)
    at /home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsAreaFrame.cpp:155
#8  0x413e2b09 in nsFrameList::DestroyFrames(nsIPresContext*) (this=0x8d07084, 
    aPresContext=0x8b555b0)
    at /home/bzbarsky/mozilla/debug/mozilla/layout/base/src/nsFrameList.cpp:129
#9  0x41234c48 in nsBlockFrame::Destroy(nsIPresContext*) (this=0x8d07040, 
    aPresContext=0x8b555b0)

etc, triggered initially from nsPrintObject::DestroyPresentation.

Note that we're dealing with a (HTML) frame, since there are at least two
instances of nsViewportFrame::Destroy on the stack.

As for why we crash, my bets are on:

(gdb) frame 1
#1  0x416ab104 in nsIView::Destroy() (this=0x8a2dc9c)
    at /home/bzbarsky/mozilla/debug/mozilla/view/src/nsView.cpp:252
252       delete this;
(gdb) p * this
$5 = {<nsIView_base> = {<nsISupports> = {
      _vptr.nsISupports = 0x41905348}, <No data fields>}, mViewManager =
0xffffffac, 
  mParent = 0xffffffac, mWindow = 0xb7c, mNextSibling = 0x71c, mFirstChild =
0x8a57458, 
  mClientData = 0x8a2b224, mZIndex = 144890952, mVis = 144891160, mPosX = 3153956, 
  mPosY = 1099977904, mDimBounds = {x = 0, y = 0, width = 1099977944, height = 0}, 
  mOpacity = 0, mVFlags = 2800}
(gdb) p *mWindow
Cannot access memory at address 0xb7c

Almost looks like we're calling Destroy() on an already-destroyed view....

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This is almost certainly another case of "print/print preview builds a view
hierarchy that doesn't match the frame hierarchy properly"

Comment 3

[Adam Hauner]

bug 248825 has one similar stack

Comment 4

[James Napolitano]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20040930
A print preview of this page now WFM

Comment 5

[Jay Patel [:jay]]

If this is working on the Trunk now, it's probably related to or a dup of bug
248825.  Perhaps that fix covered this crash as well, if not...please reopen.

*** This bug has been marked as a duplicate of 248825 ***