539060 - Crash [@ _purecall | do_QueryFrame::operator<nsIPageSequenceFrame> nsIPageSequenceFrame*() ] in print preview

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Ilja Sekler]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20100111 Firefox/3.7a1pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20100111 Firefox/3.7a1pre

Print preview for the <http://www.kultiversum.de/Musik-Tourneen/Helene-Grimaud-Tugan-Sokhiev-Philharmonie.html?print=1> or any other article on <http://www.kultiversum.de/> crashes Firefox immediately. Crash report from an older official build with a clean, new profile: <http://crash-stats.mozilla.com/report/index/34d7bc6e-12c2-47b9-80e2-5b3ff2100110>.

Happens in Safe Mode as well:

firefox -safe-mode

(firefox-bin:7003): GLib-WARNING **: g_set_prgname() called multiple times
pure virtual method called
terminate called without an active exception
Aborted


Reproducible: Always

Steps to Reproduce:
1. Load the URL
2. Click on File / Print Preview

Actual Results:  
Crash

Comment 1

[Ilja Sekler]

Forgot to mention that 1.9.2 branch doesn't crash.

Comment 2

[Yannick Lavoquer]

I confirm this crash under Linux (Ubuntu Karmic) and Windows (XP) with new profile.

Workaround/Hint : Minefield doesn't crash if Javascript is disabled
Scripts involved seem to be related with ckeditor 2.643. Disabling some of these four scripts (via Adblock plus) is enough to prevent crash.

Last Good Build  : 
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091215 Minefield/3.7a1pre
Built from http://hg.mozilla.org/mozilla-central/rev/96e8d529b2d3

First Crashing Build  :
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091216 Minefield/3.7a1pre
Built from http://hg.mozilla.org/mozilla-central/rev/f8d2c6f4631d

I filed another crash-report (Platform : Win XP ; Build ID : 20100111043805)
http://crash-stats.mozilla.com/report/index/6571a4f3-9e6a-49f0-bf5c-af36a2100112

Comment 3

[Ilja Sekler]

Thanks a lot for finding the regression window.

Reverting the checkin <http://hg.mozilla.org/mozilla-central/rev/1c71987688fe> in Bug 534407 fixes this crash on Linux.

Comment 4

[Ilja Sekler]

I hope this is not inappropriate - CC'ing Olli Pettay as assignee of Bug 534407, which regressed this bug.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Attachment: if some frame isn't visible, its subframes aren't either.

SetPrintPO sets mDontPrint recursively.

(I wish I had more time to clean up this code a bit.)

Comment 6

[Ilja Sekler]

Confirming that the patch <https://bugzilla.mozilla.org/attachment.cgi?id=421433> fixes the crash (the piano doesn't crash either ;-)). Tested with

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20100113 Firefox/3.7a1pre

SourceStamp=2f969cc4f104

and the aforementioned patch applied. Thanks!

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 421433 [details] [diff] [review]
if some frame isn't visible, its subframes aren't either.

Why I didn't ask review for this earlier?

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Roc, review ping.

(I prefer getting crash regressions fixed asap.)


I'll work on getting a chrome test for this and bug 534407.

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Attachment: with a crash test

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/36f740e8b791