254590 - Print Preview or a real print causes a Segfault (gdb trace included) [@ 0x00000000 - nsIView::Destroy() ]

Status: RESOLVED WORKSFORME

(Core :: Print Preview, defect)

Description

[Gavin Hamill]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.2; Linux) (KHTML, like Gecko)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040712 Firefox/0.9.1

We've just moved our 30 agent call centre to Firefox after having had loads of 
probs with KDE / Konqueror, but we are completely unable to print any of our 
bookings-screens as a result of this. 
 
The machines are Debian/sid with FF 0.9.1, but I have reproduced identical 
behaviour on FF0.8 on Win98, FF0.9.3 on Win98 and FF0.9.3 on Debian sid. 
 

Reproducible: Always
Steps to Reproduce:
1. Visit http://bum.net/res.php3.html 
2. File -> Print Preview 
 
 
Actual Results:  
Segfault 

Expected Results:  
Print Preview :) 

The problem seems to be related to the three <IFRAME>s in the source, since if 
I remove these, the problem disappears. 
 
#0  0x4099cca6 in nanosleep () from /lib/libc.so.6 
#1  0x00000074 in ?? () 
#2  0x4099caef in sleep () from /lib/libc.so.6 
#3  0x0806fd02 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:135 
#4  0x08070a6c in nsProfileLock::FatalSignalHandler (signo=11) at 
nsProfileLock.cpp:209 
#5  0x40286825 in __pthread_sighandler () from /lib/libpthread.so.0 
#6  <signal handler called> 
#7  0x00000000 in ?? () 
#8  0x41bc9424 in nsIView::Destroy (this=0x8a1ed90) at nsView.cpp:252 
#9  0x41779559 in nsFrame::Destroy (this=0x8a206a4, aPresContext=0x8997708) at 
nsFrame.cpp:641 
#10 0x4180c07d in nsSubDocumentFrame::Destroy (this=0x8a206a4, 
aPresContext=0x8997708) at nsFrameFrame.cpp:567 
#11 0x419146ed in nsFrameList::DestroyFrames (this=0x8a64dc8, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#12 0x41757e9a in nsBlockFrame::Destroy (this=0x8a64d84, 
aPresContext=0x8997708) at nsBlockFrame.cpp:298 
#13 0x417b0c3f in nsLineBox::DeleteLineList (aPresContext=0x8997708, 
aLines=@0x8a64e44) at nsLineBox.cpp:302 
#14 0x41757eaf in nsBlockFrame::Destroy (this=0x8a64e08, 
aPresContext=0x8997708) at nsBlockFrame.cpp:300 
#15 0x417b0c3f in nsLineBox::DeleteLineList (aPresContext=0x8997708, 
aLines=@0x8a64f88) at nsLineBox.cpp:302 
#16 0x41757eaf in nsBlockFrame::Destroy (this=0x8a64f4c, 
aPresContext=0x8997708) at nsBlockFrame.cpp:300 
#17 0x4175591a in nsAreaFrame::Destroy (this=0x8a64f4c, 
aPresContext=0x8997708) at nsAreaFrame.cpp:155 
#18 0x419146ed in nsFrameList::DestroyFrames (this=0x8a64f2c, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#19 0x417741ba in nsContainerFrame::Destroy (this=0x8a64ef8, 
aPresContext=0x8997708) at nsContainerFrame.cpp:163 
#20 0x41809c22 in ViewportFrame::Destroy (this=0x8a64ef8, 
aPresContext=0x8997708) at nsViewportFrame.cpp:67 
#21 0x419146ed in nsFrameList::DestroyFrames (this=0x8a64ec0, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#22 0x417741ba in nsContainerFrame::Destroy (this=0x8a64e8c, 
aPresContext=0x8997708) at nsContainerFrame.cpp:163 
#23 0x419146ed in nsFrameList::DestroyFrames (this=0x89a7fb4, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#24 0x417741ba in nsContainerFrame::Destroy (this=0x89a7f80, 
aPresContext=0x8997708) at nsContainerFrame.cpp:163 
#25 0x419146ed in nsFrameList::DestroyFrames (this=0x89a8290, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#26 0x417741ba in nsContainerFrame::Destroy (this=0x89a825c, 
aPresContext=0x8997708) at nsContainerFrame.cpp:163 
#27 0x418bf05c in nsBoxFrame::Destroy (this=0x89a825c, aPresContext=0x8997708) 
at nsBoxFrame.cpp:1065 
#28 0x419146ed in nsFrameList::DestroyFrames (this=0x89a8180, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#29 0x417741ba in nsContainerFrame::Destroy (this=0x89a814c, 
aPresContext=0x8997708) at nsContainerFrame.cpp:163 
#30 0x418bf05c in nsBoxFrame::Destroy (this=0x89a814c, aPresContext=0x8997708) 
at nsBoxFrame.cpp:1065 
#31 0x41790e44 in nsGfxScrollFrame::Destroy (this=0x89a814c, 
aPresContext=0x8997708) at nsGfxScrollFrame.cpp:427 
#32 0x419146ed in nsFrameList::DestroyFrames (this=0x89a7eb8, 
aPresContext=0x8997708) at nsFrameList.cpp:129 
#33 0x417741ba in nsContainerFrame::Destroy (this=0x89a7e84, 
aPresContext=0x8997708) at nsContainerFrame.cpp:163 
#34 0x41809c22 in ViewportFrame::Destroy (this=0x89a7e84, 
aPresContext=0x8997708) at nsViewportFrame.cpp:67 
#35 0x4178950b in nsFrameManager::Destroy (this=0x89a1b68) at 
nsFrameManager.cpp:330 
#36 0x417d614f in PresShell::Destroy (this=0x89a1b50) at nsPresShell.cpp:1889 
#37 0x4194c17e in nsPrintObject::DestroyPresentation (this=0x88675d0) at 
nsPrintObject.cpp:109 
#38 0x419402e7 in nsPrintEngine::SetupToPrintContent (this=0x89a18f8, 
aDContext=0x85307c0, aCurrentFocusedDOMWin=0x0) at nsPrintEngine.cpp:2393 
#39 0x4193ea49 in nsPrintEngine::DocumentReadyForPrinting (this=0x89a18f8) at 
nsPrintEngine.cpp:2177 
#40 0x41946620 in nsPrintEngine::FinishPrintPreview (this=0x89a18f8) at 
nsPrintEngine.cpp:4474 
#41 0x4193bc25 in nsPrintEngine::PrintPreview (this=0x89a18f8, 
aPrintSettings=0x884dc50, aChildDOMWin=0x0, aWebProgressListener=0x884bd7c) at 
nsPrintEngine.cpp:1258 
#42 0x41981d69 in DocumentViewerImpl::PrintPreview (this=0x86eecb0, 
aPrintSettings=0x884dc50, aChildDOMWin=0x0, aWebProgressListener=0x884bd7c) 
    at nsDocumentViewer.cpp:3198 
#43 0x401e5439 in XPTC_InvokeByIndex () at xptcinvoke_gcc_x86_unix.cpp:69 
#44 0x40c10f45 in XPCWrappedNative::CallMethod (ccx=@0xbfffe460, 
mode=CALL_METHOD) at xpcwrappednative.cpp:2026 
#45 0x40c1b579 in XPC_WN_CallMethod (cx=0x817d868, obj=0x8843468, argc=3, 
argv=0x885b36c, vp=0xbfffe610) at xpcwrappednativejsops.cpp:1287 
#46 0x40064a34 in js_Invoke (cx=0x817d868, argc=3, flags=0) at jsinterp.c:941 
#47 0x40072acd in js_Interpret (cx=0x817d868, result=0xbfffeb80) at 
jsinterp.c:2972 
#48 0x40065498 in js_Execute (cx=0x817d868, chain=0x81de2b8, script=0x8866798, 
down=0x0, special=0, result=0xbfffec5c) at jsinterp.c:1159 
#49 0x4003239f in JS_EvaluateUCScriptForPrincipals (cx=0x817d868, 
obj=0x81de2b8, principals=0x80ffe84, chars=0x83e3680, length=31, 
    filename=0x89a4450 "chrome://global/content/printUtils.js", lineno=129, 
rval=0xbfffec5c) at jsapi.c:3558 
#50 0x41bdf6ce in nsJSContext::EvaluateString (this=0x817d820, 
aScript=@0xbfffed50, aScopeObject=0x81de2b8, aPrincipal=0x80ffe80, 
    aURL=0x89a4450 "chrome://global/content/printUtils.js", aLineNo=129, 
aVersion=0x400bf5ef "default", aRetValue=@0xbfffed70, aIsUndefined=0xbfffed6c) 
#51 0x41bf7e9d in GlobalWindowImpl::RunTimeout (this=0x817d660, 
aTimeout=0x89a2c38) at nsGlobalWindow.cpp:5135 
#52 0x41bf8a83 in GlobalWindowImpl::TimerCallback (aTimer=0x885d7d0, 
aClosure=0x89a2c38) at nsGlobalWindow.cpp:5512 
#53 0x401bf1a0 in nsTimerImpl::Fire (this=0x885d7d0) at nsTimerImpl.cpp:382 
#54 0x401bf3a2 in handleTimerEvent (event=0x43007098) at nsTimerImpl.cpp:447 
#55 0x401b72f7 in PL_HandleEvent (self=0x43007098) at plevent.c:673 
#56 0x401b71ac in PL_ProcessPendingEvents (self=0x8181728) at plevent.c:608 
#57 0x401ba3ac in nsEventQueueImpl::ProcessPendingEvents (this=0x81816e0) at 
nsEventQueue.cpp:391 
#58 0x414336b8 in event_processor_callback (source=0x8336188, 
condition=G_IO_IN, data=0x81816e0) at nsAppShell.cpp:67 
#59 0x40714eff in g_vasprintf () from /usr/lib/libglib-2.0.so.0 
#60 0x406ef942 in g_main_depth () from /usr/lib/libglib-2.0.so.0 
#61 0x406f0a38 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 
#62 0x406f0d70 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 
#63 0x406f13b3 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 
#64 0x403e7713 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 
#65 0x41433d5e in nsAppShell::Run (this=0x8228a58) at nsAppShell.cpp:142 
#66 0x421c356e in nsAppShellService::Run (this=0x82289f8) at 
nsAppShellService.cpp:494 
#67 0x0805f085 in xre_main (argc=7, argv=0xbffff804, aAppData=0x807600c) at 
nsAppRunner.cpp:1977 
#68 0x08058d4c in main (argc=7, argv=0xbffff804) at nsBrowserApp.cpp:58

Comment 1

[Adam Hauner]

Gavin: Could you also provide TalkBack incident ID?

BTW isn't one IFRAME over two printed pages?

Comment 2

[Gavin Hamill]

This same problem affects mainstream Mozilla, not just Firefox. I have just 
tried with Debian's own 1.7.2 and also the 
mozilla-i686-pc-linux-gnu-1.7.2.tar.gz from mozilla.org 
 
Talkback Incident is TB572117E 
 
re: IFRAMEs - I have no idea - the visible part is very small - should it be a 
SEGV-able offense if the logical IFRAME is much larger than the printable 
section? :) 
 
Cheers, 
Gavin. 
 

Comment 3

[Adam Hauner]

TB572117E:
0x024005d1
nsFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 647]
nsSubDocumentFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/document/src/nsFrameFrame.cpp,
line 568]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsBlockFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 300]
nsLineBox::DeleteLineList() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 300]
nsBlockFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 303]
nsLineBox::DeleteLineList() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 300]
nsBlockFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 303]
nsAreaFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsAreaFrame.cpp,
line 156]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsContainerFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 52]
ViewportFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 68]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsContainerFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 52]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsContainerFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 52]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsContainerFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 52]
nsBoxFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsContainerFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 52]
nsBoxFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsGfxScrollFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 428]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsContainerFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 52]
ViewportFrame::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 68]
nsFrameManager::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsFrameManager.cpp,
line 331]
PresShell::Destroy() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 1892]
nsPrintObject::DestroyPresentation() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/content/base/src/nsPrintObject.cpp,
line 607]
nsPrintEngine::SetupToPrintContent() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 2393]
nsPrintEngine::DocumentReadyForPrinting() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 2178]
nsPrintEngine::FinishPrintPreview() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 300]
nsPrintEngine::PrintPreview() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 1258]
DocumentViewerImpl::PrintPreview() 
[/builds/tinderbox/Mozilla1.7.2/Linux_2.4.18-3_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 3178]
XPTC_InvokeByIndex()
...

Confirming with FF093 -> TB572230G, very similar stack.
Bug 248825, bug 251943 are related.

Comment 4

[James Napolitano]

I did a print preview of the page using a recent Mozilla 1.8alpha4 nightly build
and it did not crash.
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a4) Gecko/20040907

Comment 5

[Gavin Hamill]

I can confirm this. Can we *PLEASE* have whatever fixed this backported to 
Firefox before 1.0 ? :)))) 
 
Interestingly, using the Firefox nightly build from last night now adds the 
following line to the output... 
 
gdh:/home/gdh/ff/firefox# ./firefox 
*** loading the extensions datasource 
*** loading the extensions datasource 
<http://bum.net/res.php3.html and File -> Print Preview> 
 NO FONT WAS FOUND Name["Sans"] 
./run-mozilla.sh: line 451: 11660 Segmentation fault      "$prog" ${1+"$@"} 
 
I'm not sure if the font line is causing it, of course. 
 

Comment 6

[Henri Leisma]

I've had similar problems with print preview and <p> tags with page-break-before
css.


Reproducible: Always
Steps to Reproduce:
1. Visit http://www.pronics.com/~henkka/lastuamisnesteet4.html 
2. File -> Print Preview 
 
 
Actual Results:  
Segfault 
 
Expected Results:  
Print Preview

The page worked fine when I removed the page-break-before rule from css, or
commented out the <p> tag from line 132 (lastuamisnesteet4.html). A properly
working page can be found in:
http://pronics.com/~henkka/lastuamisnesteet5.html

Both pages validated as valid xhtml and valid css.

Comment 7

[Jay Patel [:jay]]

Related to bug 248825?

Comment 8

[Gavin Hamill]

(In reply to comment #7) 
 
> Related to bug 248825 ? 
 
I don't think so... I took the latest nightly builds of both Mozilla Suite and 
Firefox... 
 
URL: http://bum.net/res.php3.html 
Mozilla: Print Preview works fine, real print works fine. 
Firefox: Print Preview segfaults, real print segfaults 
 
URL: http://www.ign.com/?fromint=1 
Mozilla: Print Preview segfaults, real print segfaults 
Firefox: Print Preview segfaults, real print segfaults. 
 
So obviously I'm keen to have whatever changed near 2004-09-09 (ref: comment 4 
on this bug) so that my booking pages print correctly in Firefox, but the bug  
causing the ign.com crash is still present. 
 
At best I'd say the two bugs are 'related' but not duplicates. 
 
Cheers, 
Gavin. 
 
 
 

Comment 9

[James Napolitano]

(In reply to comment #8)
> 
> So obviously I'm keen to have whatever changed near 2004-09-09 (ref: comment 4 
> on this bug) so that my booking pages print correctly in Firefox, but the bug  
> causing the ign.com crash is still present. 

Well, there are actually 3 separate bugs on the print preview of ign.com
crashing: first bug 185357, then bug 248825, and now bug 262403.  But the
stacktraces don't match this bug, so I agree that this is not a dupe of bug 248825.

Comment 10

[Wayne Mery (:wsmwk)]

WFM for all testcases:
 http://www.ign.com/?fromint=1
 http://www.pronics.com/~henkka/lastuamisnesteet4.html 
 (http://bum.net/res.php3.html no longer accessible)

if this is still a problem, please change OS->linux because it's not happening
on windows. Otherwise, someone please close WFM. 

Comment 11

[Wayne Mery (:wsmwk)]

WFM per comment 10