363770 - Crash [@ nsCOMPtr::nsCOMPtr] on print preview on page with frame element

Status: VERIFIED FIXED

(Core :: Printing: Output, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla on print preview.
First you get an error dialog, if you then click the error dialog away, Mozilla crashes.
This regressed between 2006-12-09 and 2006-12-10:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-12-09+03&maxdate=2006-12-10+06&cvsroot=%2Fcvsroot
I guess this is a regression from bug 361844.

Talkback ID: TB27293883Y
nsCOMPtr<nsISOAPCall>::nsCOMPtr<nsISOAPCall>  [mozilla\dist\include\xpcom\nscomptr.h, line 627]
nsPrintEngine::CleanupOnFailure  [mozilla\layout\printing\nsprintengine.cpp, line 1726]
DocumentViewerImpl::PrintPreview  [mozilla\layout\base\nsdocumentviewer.cpp, line 3555]
NS_InvokeByIndex  [mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2162]

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase

Oops, that was the unminimised testcase, this is the minimised testcase.

Comment 3

[Eli Friedman]

Taking; it's a refcounting problem with nsPrintEngine.  I need to look a bit more, though.

Comment 4

[Eli Friedman]

Attachment: Patch

I really need to clean up the print error handling code; it's really a mess.

This patch is correct, and stops the crash; I'm still not sure how to deal with the underlying problem.  It appears the <frame> has a subdocument and a frame, but not a view.

Comment 5

[Martijn Wargers (dead)]

These testcase are crashing again in current trunk build on print preview, I filed bug 398265 for it.