415327 - Crash [@ gtk_print_job_set_source_file] when printing <frame> without <frameset>

Status: RESOLVED FIXED

(Core :: Printing: Output, defect)

Description

[Mats Palmgren (inactive)]

Crash [@ gtk_print_job_set_source_file] when printing <frame> without <frameset>.

STEPS TO REPRODUCE
1. load the attached testcase
2. File->Print
3. dismiss the error dialog  -->  crash

Repeat 2+3 a few times if the crash doesn't occur the first time.

ACTUAL RESULT
A dialog appears saying "An unknown error occurred while printing".
The crash occurs after dismissing the dialog.

PLATFORMS AND BUILDS TESTED
Bug occurs in a current Firefox trunk debug build on Linux
Bug does not occur in a Firefox 1.8 branch debug build on Linux

Comment 1

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 2

[Mats Palmgren (inactive)]

Attachment: stack

Comment 3

[Martin Stránský [:stransky] (ni? me)]

Can reproduce the crash with the latest trunk, but at different location:

#4  0x00309268 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:216
#5  <signal handler called>
#6  0x0331177f in nsWSRunObject::GetNextWSNode (this=0xbfac6668, aStartNode=0xadd83c94, aOffset=0, aBlockParent=0xadd83c94, 
    aNextNode=0xbfac6568) at nsWSRunObject.cpp:1363
#7  0x0331196b in nsWSRunObject::GetNextWSNode (this=0xbfac6668, aPoint={node = {mRawPtr = 0xadd83c94}, offset = 0}, 
    aBlockParent=0xadd83c94, aNextNode=0xbfac6568) at nsWSRunObject.cpp:1342
#8  0x03313bd6 in nsWSRunObject::GetWSNodes (this=0xbfac6668) at nsWSRunObject.cpp:902
#9  0x03314255 in nsWSRunObject (this=0xbfac6668, aEd=0xb4867800, aNode=0xadd83c94, aOffset=0) at nsWSRunObject.cpp:79
#10 0x032b66a9 in nsHTMLEditor::NormalizeEOLInsertPosition (this=0xb4867800, firstNodeToInsert=0xb7dd9150, 
    insertParentNode=0xbfac6774, insertOffset=0xbfac6770) at nsHTMLEditor.cpp:1900
#11 0x032b6c52 in nsHTMLEditor::InsertElementAtSelection (this=0xb4867800, aElement=0xb7dd9150, aDeleteSelection=1)
    at nsHTMLEditor.cpp:2003
#12 0x00ea10a7 in nsInsertTagCommand::DoCommand (this=0xb7ddd330, aCmdName=0xbfac6a14 "cmd_insertHR", refCon=0xb4867800)
    at nsComposerCommands.cpp:1535
#13 0x0917f4ee in nsControllerCommandTable::DoCommand (this=0xb7dcf3d0, aCommandName=0xbfac6a14 "cmd_insertHR", 
    aCommandRefCon=0xb4867800) at nsControllerCommandTable.cpp:191
#14 0x09177c55 in nsBaseCommandController::DoCommand (this=0xb7dd4430, aCommand=0xbfac6a14 "cmd_insertHR")
    at nsBaseCommandController.cpp:169
#15 0x0917b5fc in nsCommandManager::DoCommand (this=0xb7dd2e40, aCommandName=0xbfac6a14 "cmd_insertHR", aCommandParams=0x0, 
    aTargetWindow=0xb7c90b40) at nsCommandManager.cpp:272
#16 0x02e76b6e in nsHTMLDocument::ExecCommand (this=0xadd83c00, commandID=@0xbfac6eb4, doShowUI=0, value=@0xb7df2700, 
    _retval=0xbfac6c40) at nsHTMLDocument.cpp:3831
#17 0x00b021ab in NS_InvokeByIndex_P () at xptiInterfaceInfo.cpp:73
#18 0x01ec85ee in XPCWrappedNative::CallMethod (ccx=@0xbfac6e44, mode=XPCWrappedNative::CALL_METHOD)
    at xpcwrappednative.cpp:2480
#19 0x01ed3f79 in XPC_WN_CallMethod (cx=0xb39bec00, obj=0xb7dc9260, argc=3, argv=0xb16ce0c0, vp=0xbfac6f5c)
    at xpcwrappednativejsops.cpp:1585

nsWSRunObject::GetNextWSNode() at nsWSRunObject.cpp:1363:

1362	  nsCOMPtr<nsIContent> startContent( do_QueryInterface(aStartNode) );
1363	  nsIContent *nextContent = startContent->GetChildAt(aOffset);


(gdb) p	startContent 
$1 = {mRawPtr = 0x0}

Comment 4

[Martin Stránský [:stransky] (ni? me)]

Filled Bug 485540 for the editor crash.

Comment 5

[Martin Stránský [:stransky] (ni? me)]

The original crash (in gtk_print_job_set_source_file) seems to be caused because printing is canceled before nsDeviceContextSpecGTK::BeginDocument() call, the mPrintJob is unset. 

But when the print is canceled, gtk_print_job_set_source_file(mPrintJob,...) is referenced from:

nsDeviceContextSpecGTK::EndDocument()
nsThebesDeviceContext::EndDocument()
nsPrintData::~nsPrintData()
nsPrintEngine::Destroy()
DocumentViewerImpl::OnDonePrinting()

Comment 6

[Mats Palmgren (inactive)]

I can still reproduce the crash on trunk and 1.9.0 [debug builds on Linux],
with the same stack as I attached before.

Comment 7

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

We have an InlineFrame without a view, but the code seems to assume
a non-null frame is always a SubDocumentFrame [with a view], so it
returns an error.  nsDeviceContextSpecGTK::EndDocument() is called
without BeginDocument() being called, so mPrintJob contains junk
since it's not initialized in the ctor.

Patch overview:
1. only do the special child view thing for SubDocumentFrames
   (ie. don't return an error for the testcase)
2. initialize mPrintJob and bail in EndDocument() if it's null so
   we don't crash here for other errors

Comment 8

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/48cf9ff42c74
http://hg.mozilla.org/mozilla-central/rev/234be238c242

-> FIXED