610690 - Crash when printing many documents successively [@ nsCOMPtr_base::assign_from_qi | nsDocShell::SetTreeOwner ]

Status: RESOLVED FIXED

(Core :: Printing: Output, defect)

Description

[(no longer active)]

I was printing my pay slips from hrpassport.com successively (clicking on a link, Cmd+P, Enter, Cmd+W, clicking on the next link, and so on) and Firefox crashes twice in a row, with these signatures:

bp-f1adac90-c9f5-49d1-a82e-321d52101109
bp-433b75bb-b31e-4918-8c37-11de92101109

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Exact steps to reproduce would be great.

Comment 2

[Marcia Knous [:marcia]]

http://tinyurl.com/24u2xxf link to the crashes. Some people hit this back in Beta 6 as well.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Ok, I think I might know what the problem is.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: a patch

Ehsan, any chance you could try this?
It might or might not help.

I still don't know how to reproduce.

Comment 5

[Marcia Knous [:marcia]]

I can try to reproduce as well - Ehsan - were you printing to a local printer or network printer?

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

I would be surprised if that matters. I'd start with print-to-file.

Comment 7

[(no longer active)]

Here is what I did:

1. log into hrpassport.
2. Go to earnings statements.
3. Starting from the oldest one, click on the bluish icon to the right of each row.  A new window is opened.
4. Cmd+P.  I printed to a network printer, FWIW.
5. Cmd+W to close the newly opened window.
6. Go back to step 3 and repeat for the next row.

Olli, I'll try to reproduce the problem under a debug build, and then will try your patch to see if it fixes the problem.

Comment 8

[Mats Palmgren (inactive)]

Attachment: crash stack

STEPS TO REPRODUCE
1. Open two windows (just to avoid closing the last window in step 6)
2. load a reasonably large document in one window. Choose a document
   that takes a few seconds to print, eg http://slashdot.org/
3. CTRL+P
4. Select Print-to-file / PDF and click Print
5. focus the main window with the printed document
6. CTRL+W

ACTUAL RESULTS
(gdb) bt
#0  nsQueryInterface::operator() at nsCOMPtr.cpp:47
#1  nsCOMPtr<nsIWebProgressListener>::assign_from_qi at nsCOMPtr.h:1212
#2  nsCOMPtr at nsCOMPtr.h:595
#3  nsDocShell::SetTreeOwner at docshell/base/nsDocShell.cpp:2975
#4  nsDocShell::Destroy at docshell/base/nsDocShell.cpp:4534
#5  ~nsDocShell at docshell/base/nsDocShell.cpp:756
#6  nsDocLoader::Release at uriloader/base/nsDocLoader.cpp:241
#7  nsDocShell::Release at docshell/base/nsDocShell.cpp:835
#8  ~nsPrintData at layout/printing/nsPrintData.cpp:126
#9  nsPrintEngine::Destroy at layout/printing/nsPrintEngine.cpp:285
#10 DocumentViewerImpl::Destroy at layout/base/nsDocumentViewer.cpp:1604
#11 ~nsPagePrintTimer at layout/printing/nsPagePrintTimer.cpp:61
#12 nsPagePrintTimer::Release at layout/printing/nsPagePrintTimer.cpp:43
#13 nsCOMPtr<nsITimerCallback>::assign_with_AddRef at nsCOMPtr.h:1204
#14 nsCOMPtr<nsITimerCallback>::operator= at nsCOMPtr.h:663
#15 nsTimerImpl::Fire at xpcom/threads/nsTimerImpl.cpp:453
#16 nsTimerEvent::Run at xpcom/threads/nsTimerImpl.cpp:517
...
(gdb) fr 3
(gdb) p *mTreeOwner
$2 = {
  <nsISupports> = {
    _vptr.nsISupports = 0x5a5a5a5a5a5a5a5a
  }, <No data fields>}
(gdb)

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Actually based on some code inspection the patch might not fix the problem.
Although the crash seems to be exactly what I expected.
Docshell's addred/release can't be called inside dtor.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Hmm, but why don't we always crash, with all the docshells...

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

Ah, it is the treeowner which is dead object..

Comment 12

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

This fixes the crash for me.

Comment 13

[Mats Palmgren (inactive)]

Comment on attachment 489463 [details] [diff] [review]
patch

Looks good.  r=mats

while you're here, remove the bogus comment above nsPrintObject::Init

Comment 14

[(no longer active)]

The patch seems to fix the crash for me using my own lame STR as well.  :-)

Comment 15

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/8ae502fb1c5b

Comment 16

[(no longer active)]

I just got this crash again when trying to print again:

http://crash-stats.mozilla.com/report/index/bp-7de48daf-a5bb-4379-9572-7bd8c2101217

Comment 17

[Olli Pettay [:smaug][[e-mail]]]

Different stack. Could you please open a new bug.

Comment 18

[(no longer active)]

Filed bug 620158.