Closed Bug 610690 Opened 9 years ago Closed 9 years ago

Crash when printing many documents successively [@ nsCOMPtr_base::assign_from_qi | nsDocShell::SetTreeOwner ]

Categories

(Core :: Printing: Output, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla2.0b9

People

(Reporter: ehsan, Assigned: smaug)

Details

(Keywords: crash, reproducible)

Crash Data

Attachments

(2 files, 1 obsolete file)

I was printing my pay slips from hrpassport.com successively (clicking on a link, Cmd+P, Enter, Cmd+W, clicking on the next link, and so on) and Firefox crashes twice in a row, with these signatures:

bp-f1adac90-c9f5-49d1-a82e-321d52101109
bp-433b75bb-b31e-4918-8c37-11de92101109
Exact steps to reproduce would be great.
http://tinyurl.com/24u2xxf link to the crashes. Some people hit this back in Beta 6 as well.
Ok, I think I might know what the problem is.
Assignee: nobody → Olli.Pettay
Attached patch a patch (obsolete) — Splinter Review
Ehsan, any chance you could try this?
It might or might not help.

I still don't know how to reproduce.
I can try to reproduce as well - Ehsan - were you printing to a local printer or network printer?
I would be surprised if that matters. I'd start with print-to-file.
Here is what I did:

1. log into hrpassport.
2. Go to earnings statements.
3. Starting from the oldest one, click on the bluish icon to the right of each row.  A new window is opened.
4. Cmd+P.  I printed to a network printer, FWIW.
5. Cmd+W to close the newly opened window.
6. Go back to step 3 and repeat for the next row.

Olli, I'll try to reproduce the problem under a debug build, and then will try your patch to see if it fixes the problem.
Attached file crash stack
STEPS TO REPRODUCE
1. Open two windows (just to avoid closing the last window in step 6)
2. load a reasonably large document in one window. Choose a document
   that takes a few seconds to print, eg http://slashdot.org/
3. CTRL+P
4. Select Print-to-file / PDF and click Print
5. focus the main window with the printed document
6. CTRL+W

ACTUAL RESULTS
(gdb) bt
#0  nsQueryInterface::operator() at nsCOMPtr.cpp:47
#1  nsCOMPtr<nsIWebProgressListener>::assign_from_qi at nsCOMPtr.h:1212
#2  nsCOMPtr at nsCOMPtr.h:595
#3  nsDocShell::SetTreeOwner at docshell/base/nsDocShell.cpp:2975
#4  nsDocShell::Destroy at docshell/base/nsDocShell.cpp:4534
#5  ~nsDocShell at docshell/base/nsDocShell.cpp:756
#6  nsDocLoader::Release at uriloader/base/nsDocLoader.cpp:241
#7  nsDocShell::Release at docshell/base/nsDocShell.cpp:835
#8  ~nsPrintData at layout/printing/nsPrintData.cpp:126
#9  nsPrintEngine::Destroy at layout/printing/nsPrintEngine.cpp:285
#10 DocumentViewerImpl::Destroy at layout/base/nsDocumentViewer.cpp:1604
#11 ~nsPagePrintTimer at layout/printing/nsPagePrintTimer.cpp:61
#12 nsPagePrintTimer::Release at layout/printing/nsPagePrintTimer.cpp:43
#13 nsCOMPtr<nsITimerCallback>::assign_with_AddRef at nsCOMPtr.h:1204
#14 nsCOMPtr<nsITimerCallback>::operator= at nsCOMPtr.h:663
#15 nsTimerImpl::Fire at xpcom/threads/nsTimerImpl.cpp:453
#16 nsTimerEvent::Run at xpcom/threads/nsTimerImpl.cpp:517
...
(gdb) fr 3
(gdb) p *mTreeOwner
$2 = {
  <nsISupports> = {
    _vptr.nsISupports = 0x5a5a5a5a5a5a5a5a
  }, <No data fields>}
(gdb)
Keywords: reproducible
OS: Mac OS X → All
Hardware: x86 → All
Actually based on some code inspection the patch might not fix the problem.
Although the crash seems to be exactly what I expected.
Docshell's addred/release can't be called inside dtor.
Hmm, but why don't we always crash, with all the docshells...
Attachment #489234 - Attachment is obsolete: true
Ah, it is the treeowner which is dead object..
Attached patch patchSplinter Review
This fixes the crash for me.
Attachment #489463 - Flags: review?(matspal)
Comment on attachment 489463 [details] [diff] [review]
patch

Looks good.  r=mats

while you're here, remove the bogus comment above nsPrintObject::Init
Attachment #489463 - Flags: review?(matspal) → review+
Attachment #489463 - Flags: approval2.0?
Attachment #489463 - Flags: approval2.0? → approval2.0+
The patch seems to fix the crash for me using my own lame STR as well.  :-)
http://hg.mozilla.org/mozilla-central/rev/8ae502fb1c5b
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
I just got this crash again when trying to print again:

http://crash-stats.mozilla.com/report/index/bp-7de48daf-a5bb-4379-9572-7bd8c2101217
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Different stack. Could you please open a new bug.
Status: REOPENED → RESOLVED
Closed: 9 years ago9 years ago
Resolution: --- → FIXED
Filed bug 620158.
Target Milestone: --- → mozilla2.0b9
Crash Signature: [@ nsCOMPtr_base::assign_from_qi | nsDocShell::SetTreeOwner ]
You need to log in before you can comment on or make changes to this bug.