376155 - Crash in print preview [@ 0x00000001 ] [@ nsViewManager::BuildDisplayList() ]

Status: VERIFIED FIXED

(Core :: Print Preview, defect)

Description

[Tony Mechelynck [:tonymec]]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4pre) Gecko/20070331 BonEcho/2.0.0.4pre
Build Identifier: "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4pre) Gecko/20070331 BonEcho/2.0.0.4pre" - Build ID: 2007033104

TB30782840E


Reproducible: Didn't try

Actual Results:  
crash

Expected Results:  
no crash

Incident ID: 30782840
Stack Signature	0x00000001 57a554cf
Product ID	Firefox2
Build ID	2007033104
Trigger Time	2007-04-01 04:46:38.0
Platform	LinuxIntel
Operating System	Linux 2.6.18.8-0.1-default
Module	
URL visited	
User Comments	latest action was "Print Preview" (Alt-F V)
Since Last Crash	4 sec
Total Uptime	4 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
0x00000001
nsViewManager::BuildDisplayList()  [mozilla/view/src/nsViewManager.cpp, line 2427]
nsViewManager::BuildRenderingDisplayList()  [mozilla/view/src/nsViewManager.cpp, line 99]
nsViewManager::Refresh()  [mozilla/view/src/nsViewManager.cpp, line 874]
nsViewManager::DispatchEvent()  [mozilla/view/src/nsViewManager.cpp, line 842]
HandleEvent()  [mozilla/view/src/nsView.cpp, line 251]
nsCommonWidget::DispatchEvent()  [mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219]
nsWindow::OnExposeEvent()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 842]
expose_event_cb()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 3799]
libgtk-x11-2.0.so.0 + 0x1321b0 (0xb7be51b0)
libgobject-2.0.so.0 + 0x9c0b (0xb797ec0b)
libgobject-2.0.so.0 + 0x1ad3d (0xb798fd3d)
libgobject-2.0.so.0 + 0x1c00f (0xb799100f)
libgobject-2.0.so.0 + 0x1c415 (0xb7991415)
libgtk-x11-2.0.so.0 + 0x245b18 (0xb7cf8b18)
libgtk-x11-2.0.so.0 + 0x12c935 (0xb7bdf935)
libgdk-x11-2.0.so.0 + 0x2c53f (0xb7a5d53f)
libgdk-x11-2.0.so.0 + 0x2c787 (0xb7a5d787)
libgdk-x11-2.0.so.0 + 0x2c805 (0xb7a5d805)
libglib-2.0.so.0 + 0x2c061 (0xb7908061)
libglib-2.0.so.0 + 0x2dde2 (0xb7909de2)
libglib-2.0.so.0 + 0x30e1f (0xb790ce1f)
libglib-2.0.so.0 + 0x311c9 (0xb790d1c9)
libgtk-x11-2.0.so.0 + 0x12ccd4 (0xb7bdfcd4)
nsAppShell::Run()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2697]
main()  [mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x15f9c (0xb739ef9c)

Comment 1

[Andrew Schultz]

I hit this with seamonkey branch builds invoking print preview (even for about:blank).  I get different frames at the top (ComputePlaceholderContainment once and nsViewManager::ComputeViewOffset another time) but nsViewManager::BuildDisplayList below it.  valgrind complained about accessing already-freed memory.

I'm only seeing this with RHEL4 (not FC6), but I don't know what's different.

Comment 2

[Tony Mechelynck [:tonymec]]

(In reply to comment #1)
[...]
> I'm only seeing this with RHEL4 (not FC6), but I don't know what's different.
> 

For the record, I'm on openSUSE 10.2.

Comment 3

[Andrew Schultz]

This is a regression from bug 368501

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Couldn't reproduce on 1.8/trunk FF/Seamonkey using FC5.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #1)
> valgrind complained about accessing
> already-freed memory.
>

Did valgrind tell anything more exact?

Comment 6

[Andrew Schultz]

Attachment: valgrind log

Comment 7

[Daniel Veditz [:dveditz]]

(In reply to comment #3)
> This is a regression from bug 368501

Based on regression range? That was checked into the branch five weeks ago. Or did you actually back out that patch to prove that was the culprit?

fwiw I don't crash on windows.

Comment 8

[Andrew Schultz]

based on regression range and backing out the patch

Comment 9

[Daniel Veditz [:dveditz]]

thanks for clarifying.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Tested Fedora 3, no crash. Tested also some other Linux (University of Helsinki), no crash. I wonder how am I going to debug this.

Comment 11

[Martijn Wargers (dead)]

The backtrace seems to have some similarity with bug 378273. That one is fixed now. Anrew, Tony, Do you still crash with current trunk builds? Or does it only happen in branch builds?

Comment 12

[Tony Mechelynck [:tonymec]]

(In reply to comment #11)
> The backtrace seems to have some similarity with bug 378273. That one is fixed
> now. Anrew, Tony, Do you still crash with current trunk builds? Or does it only
> happen in branch builds?
> 

I don't know. This is not the kind of bug that can be triggered at will. I often use Print Preview, and sometimes (far from every time) I get this crash. I only have seen it in Fx2 so far, but one reason of this may be because I use BonEcho much more frequently and extensively than Minefield.

Andrew also mentioned 'SeaMonkey /branch/ builds' (emphasis mine) but I'll let him elaborate if he wants to.

Comment 13

[Mats Palmgren (inactive)]

(In reply to comment #11)
> The backtrace seems to have some similarity with bug 378273.

I can't reproduce the crash here, but looking at the valgrind log in
comment 6 strongly suggests it's the same underlying problem as bug 378273.

Comment 14

[Daniel Veditz [:dveditz]]

The fix for bug 378273 is probably too big to be dropping on the branch at this point. Try for next release.

Comment 15

[Andrew Schultz]

I do not crash with a trunk build from 4/26, which was before bug 378273 was fixed.  But the branch patch from bug 378273 does fix the crash for me in a branch build.

Comment 16

[Mats Palmgren (inactive)]

-> FIXED (patch on bug 378273)

Comment 17

[Andrew Schultz]

Verified FIXED on branch.  I no longer crash invoking print preview in a branch build

Comment 18

[Martijn Wargers (dead)]

verified1.8.1.4, based on comment 17.