299107 - Random crash when changing scale with print preview on http://sportsillustrated.cnn.com/

Status: RESOLVED FIXED

(Core :: Printing: Output, defect)

Description

[Jean-Michel Reghem]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050628 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050628 Firefox/1.0+

This site seems to have a strange behaviour (random crash) when rescaling in
print preview

Reproducible: Sometimes

Steps to Reproduce:
1.Go to the site
2.Print --> Print preview
3.Try to change the scale to 60%, then, 125%, then to 50 etc...

Actual Results:  
Randomly, it crash ... randomly it don't crash ...

Expected Results:  
It shouldn't :-)

Comment 1

[Jean-Michel Reghem]

I've send a talkback for this bug:
TB7074625E

--> Going to site http://testrunner.mozilla.org/test.cgi?run_id=1319
--> going to Group 9
--> opening the site http://sportsillustrated.cnn.com/ in a new tab by clicking
on the link in the cell http://testrunner.mozilla.org/test.cgi?run_id=1319#858
--> print preview
--> doing a lot of change scale: no crash
--> going to thunderbird to read mail
--> 5 seconds later --> talkback appaired et crash occured ...

Comment 2

[Jean-Michel Reghem]

maybe related to scale problem of bug #267422

Comment 3

[timeless]

no symbols, please crash again using a build that has working symbols.
irc.mozilla.org may be able to help you figure out what that build would be.

Comment 4

[Jean-Michel Reghem]

Sorry, but it was done with the last nightlies build i get from irc.mozilla/org
#bft at the end of bft event ...
I believe that was a debug version ...
I will try to get a debug version tomorrow

Comment 5

[Jean-Michel Reghem]

I have generate a new talkback with a other nightly builds
(The previous builds was installed from irc.mozilla.org #bft during BFT QA day ...)

Here is my new User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b2) Gecko/20050629 Firefox/1.0+

The Talkback is: TB7103395Q

--> so, going to http://sportsillustrated.cnn.com/ (in a new tab)
--> print preview
--> doing 7-8 change of scale (without real effect like describe in bug #267422)
--> losing focus by reading mail in thunderbird 
--> after 10 seconds: talkback and crash

Comment 6

[timeless]

no symbols, please crash again using a build that has working symbols.
irc.mozilla.org may be able to help you figure out what that build would be.

Comment 7

[Jean-Michel Reghem]

Hé ???
Sorry, but i've go to irc #firefox and i asked to a build that has working symbols.

They said me to use a nightly builds ... so, i download the last nightly builds ...
Could you give me the path to a correct version with symbols??????

Comment 8

[timeless]

sorry, i don't use firefox. i'm just telling you that the builds you've tried
don't have symbols. you're welcome to return to #firefox and point them to your
tb incident id and inform them that the build they suggested does *not* have
symbols.

Comment 9

[Martijn Wargers (dead)]

I crashed with the nightly trunk build, while scrolling down on that page in
print preview, talkback ID: TB7103395Q

0x00000000
DoDeletingFrameSubtree 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9417]
DoDeletingFrameSubtree 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9452]
DeletingFrameSubtree 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9498]
nsCSSFrameConstructor::ContentRemoved 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9722]
nsCSSFrameConstructor::ReinsertContent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9356]
nsCSSFrameConstructor::ContentAppended 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 8617]
PresShell::ContentAppended 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5464]
nsHTMLDocument::ContentAppended 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1083]
nsGenericElement::InsertBefore 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2979]
nsHTMLOptGroupElement::AppendChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLOptGroupElement.cpp,
line 64]
nsGenericHTMLElementTearoff::SetInnerHTML 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 213]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2119]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1372]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1178]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1275]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2894]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3306]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1198]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3469]
js_Execute 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1409]
JS_EvaluateUCScriptForPrincipals 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3855]
nsJSContext::EvaluateString 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1075]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5243]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5621]
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
kernel32.dll + 0x1eb69 (0x77e5eb69)

Comment 10

[Martijn Wargers (dead)]

Attachment: what I removed

When I remove that rotating news thing with the dom inspector, then I don't
crash anymore on print preview.

Comment 11

[Martijn Wargers (dead)]

By the way, I crash on print preview just by waiting for 10 or seconds or so.

Comment 12

[Jean-Michel Reghem]

Timer is a key-punct i think ...
Sometimes, i can rescale a lot of, without crash, but all i need is to wait a
little time without rescaling, to have the crash ...

Related to this:
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5243]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,

???

Comment 13

[Martijn Wargers (dead)]

Attachment: iframe for testcase

Comment 14

[Martijn Wargers (dead)]

Attachment: testcase

This is a minimal testcase that still crashes while print previewing.
There are two issues, I think.
First, subframes are still able to execute javascript in the print preview
document. Just like the top document, the javascript should be disabled.
Second, this crash should simply just not happen on print preview, even when
I'm adding and removing stuff in the dom of the print preview document.

Comment 15

[Martijn Wargers (dead)]

Attachment: testcase

Sorry, previous file was wrong.

Comment 16

[Martijn Wargers (dead)]

Attachment: patch

This fixes the issue, but Mozilla crashes evertime when closingprint preview.
Probably because mPrt is unknown.

Comment 17

[Martijn Wargers (dead)]

Boris, maybe you can help?

Comment 18

[Boris Zbarsky [:bzbarsky]]

Yeah, print preview nulls out mPrt when it finishes setting up, but assigns the
pointer to mPrtPreview first.  Could you perhaps do something like this?

  nsPrintData* prt = mPrt;
#ifdef NS_PRINT_PREVIEW
  if (!prt) {
    prt = mPrtPreview;
  }
#endif
  if (!prt) {
    return;
  }

And then the loop you did, with |prt| in place of mPrt?

Comment 19

[Martijn Wargers (dead)]

Attachment: patch2

Thanks Boris! That works.

Comment 20

[Boris Zbarsky [:bzbarsky]]

Do you still need this line:

  1099       TurnScriptingOn(PR_TRUE);

?

Comment 21

[Martijn Wargers (dead)]

Attachment: patch3

No, that line isn't necessary anymore. I didn't see it, thanks.

Comment 22

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 188649 [details] [diff] [review]
patch3

r+sr=bzbarsky.	You probably want to request 1.8b4 approval for this; ping me
once this has approval and I'll land it, ok?

Comment 23

[Martijn Wargers (dead)]

Comment on attachment 188649 [details] [diff] [review]
patch3

Ok.
This patch fixes a crash.

Comment 24

[Martijn Wargers (dead)]

Ok, the patch has approval, so it is ready to be checked in.

Comment 25

[Martijn Wargers (dead)]

Ok, Boris checked the patch in at 2005-07-13 12:10.
So this bug should be fixed now. Please test again in tomorrow trunk builds.

Comment 26

[Martijn Wargers (dead)]

I filed bug 300674 for a similar way to trigger this crash.

Comment 27

[[e-mail]]

Does this mean we can get rid of the print preview event listener hacks?

Comment 28

[Boris Zbarsky [:bzbarsky]]

Neil, which ones?

Comment 29

[[e-mail]]

Basically, the whole of nsPrintPreviewListener.cpp

Comment 30

[Boris Zbarsky [:bzbarsky]]

Don't we still need that to prevent users from, eg, modifying form controls in
print preview?  Or navigating via links.  Or doing all sorts of other stuff...

Comment 31

[[e-mail]]

I commented out nsDocumentViewer's call to InstallPrintPreviewListener and I
can't reproduce bug 245024. The only apparent change was to allow me to drag
links from the preview to other windows.

Comment 32

[Boris Zbarsky [:bzbarsky]]

So form controls don't toggle?  Accesskeys on links don't work?  etc?

Comment 33

[[e-mail]]

I was able to tab into the document from both directions. Without the listener I
could tab right through the document. But I guess I could tab into the document
before because those tab keypress would have been in chrome.
There was one form field that I was able to trigger: the drop-down select.