275262 - Crash printing frameset [@ nsPrintEngine::DoPrint]

Status: VERIFIED FIXED

(Core :: Printing: Output, defect)

Description

[Simon Montagu :smontagu]

There are a lot of talkback reports similar to this crash, and a lot of printing
crashes already reported, but I haven't been able to find a dupe.

Steps to reproduce:
Go to
http://publib.boulder.ibm.com/infocenter/weahelp/index.jsp?topic=/com.ibm.websphere.wea.doc/plan_prereqs.html
Click on Print or Print Preview

Actual results: Browser crashes
Expected results: Web page prints without crashing.

Comment 1

[Simon Montagu :smontagu]

Sample TB ID: TB2578660Z

Stack trace:
nsPrintEngine::DoPrint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 3116]
nsPrintEngine::ShowDocListInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4412]
nsPrintEngine::ShowDocListInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4419]
nsPrintEngine::ShowDocListInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4419]
nsPrintEngine::ShowDocListInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4419]
nsPrintEngine::ShowDocListInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4419]
nsPrintEngine::ShowDocListInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4419]
nsPrintEngine::ShowDocList 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4432]
nsPrintEngine::FinishPrintPreview 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4498]
nsPrintEngine::PrintPreview 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 1258]
DocumentViewerImpl::PrintPreview 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 3250]
XPTC_InvokeByIndex 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2978]
js_Invoke 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_InternalInvoke 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1035]
JS_CallFunctionValue 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3698]
nsJSContext::CallEventHandler 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1297]
GlobalWindowImpl::RunTimeout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5350]
GlobalWindowImpl::TimerCallback 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5712]
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x2141a (0x77e8141a)

Comment 2

[Simon Montagu :smontagu]

Here's what's happening:

At
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/printing/nsPrintEngine.cpp&rev=1.86&mark=2494#2486
we "check to see if the subdocument's element has been hidden by the parent
document". If so, we set the nsPrintObject's mDontPrint flag and return from
nsPrintEngine::ReflowDocList without recursing through its kids.

Then at
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/printing/nsPrintEngine.cpp&rev=1.86&mark=3018#3010
we test the mDontPrint flag (aPO->IsPrintable()). If it is set we don't print
the current nsPrintObject, but we do recurse through its kids. Since these have
never been reflowed, poPresShell and poPresContext are null, and we crash on the
first one we dereference.

Comment 3

[Simon Montagu :smontagu]

I can also reproduce the crash at these URIs:

http://www.f5.com/solutions/applications/
http://www.interland.com/shared/plan_compare.asp?platform=linux (this one is
painful to test, because it asserts a lot)

Comment 4

[Simon Montagu :smontagu]

Attachment: Patch

I needed to add an extra flag, because the existing flag can get set for other
reasons, so not recursing whenever it is set means we lose frames that should
be printed.

Comment 5

[Simon Montagu :smontagu]

Fix checked in.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED for me using build 2005-01-13-08 on Windows XP.  (All 3 testcases.)