620158 - Crash while printing [@ nsCOMPtr_base::assign_from_qi | nsDocShell::SetTreeOwner ]

Status: RESOLVED FIXED

(Core :: Printing: Output, defect)

Description

[(no longer active)]

+++ This bug was initially created as a clone of Bug #610690 +++

This happened to me while I was trying to print two pages.  I wasn't paying close attention, so I'm afraid I don't have much information behind this...

http://crash-stats.mozilla.com/report/index/bp-7de48daf-a5bb-4379-9572-7bd8c2101217

Comment 1

[Scoobidiver (away)]

It is #10 top crasher on Linux in 4.0b8 for the last week.

Comment 2

[Scoobidiver (away)]

> on Linux
No, on Mac OS X.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Yes, indeed.
I wish there was a testcase, but since the crash seems to depend on
GC...

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: guess fix

Normally frameloader owns docshell and calls Destroy. But if we're
printing, the top level docshell is owned by the print object.

Comment 5

[Tony Chung [:tchung]]

i hit this today also.   repro is testing the 1/10/2010 minefield on mac x64, and trying to print to network printer.

http://crash-stats.mozilla.com/report/index/bp-5443f41c-ec5b-43e3-ba76-5b1082110111

Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	nsCOMPtr_base::assign_from_qi 	nsCOMPtr.cpp:47
1 	XUL 	nsDocShell::SetTreeOwner 	
2 	XUL 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4553
3 	XUL 	nsDocShell::~nsDocShell 	docshell/base/nsDocShell.cpp:756
4 	XUL 	nsDocLoader::Release 	uriloader/base/nsDocLoader.cpp:241
5 	XUL 	XPCJSRuntime::GCCallback 	js/src/xpconnect/src/xpcjsruntime.cpp:550
6 	XUL 	DOMGCCallback 	dom/base/nsJSEnvironment.cpp:3833
7 	XUL 	js_GC 	js/src/jsgc.cpp:2809
8 	XUL 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:407
9 	XUL 	nsXPConnect::GarbageCollect 	js/src/xpconnect/src/nsXPConnect.cpp:415
10 	XUL 	nsJSContext::CC 	dom/base/nsJSEnvironment.cpp:3630
11 	XUL 	nsJSContext::MaybeCC 	dom/base/nsJSEnvironment.cpp:3735
12 	XUL 	GCTimerFired 	dom/base/nsJSEnvironment.cpp:3714
13 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:425
14 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:517
15 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
16 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
17 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:132
18 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:399
19 	CoreFoundation 	CoreFoundation@0x4de90 	
20 	CoreFoundation 	CoreFoundation@0x4c088 	
21 	AppKit 	AppKit@0x64f4b 	
22 	CoreGraphics 	CoreGraphics@0x2d9f 	
23 		@0x1ffffffff 	
24 	libSystem.B.dylib 	libSystem.B.dylib@0x815d 	
25 	libSystem.B.dylib 	libSystem.B.dylib@0x46ce 	
26 	libSystem.B.dylib 	libSystem.B.dylib@0x6b19 	
27 	libnspr4.dylib 	PR_Unlock 	nsprpub/pr/src/pthreads/ptsynch.c:237
28 	libSystem.B.dylib 	libSystem.B.dylib@0x6b19 	
29 	XUL 	nsDOMEventRTTearoff::Release 	nsCOMPtr.h:492
30 	XUL 	nsXULTooltipListener::MouseMove 	nsCOMPtr.h:492
31 		@0x16689600f 	
32 	libSystem.B.dylib 	libSystem.B.dylib@0x815d 	
33 	libSystem.B.dylib 	libSystem.B.dylib@0x6922 	
34 	libSystem.B.dylib 	libSystem.B.dylib@0xa1fa 	
35 	CarbonCore 	CarbonCore@0x54f6 	
36 	libSystem.B.dylib 	libSystem.B.dylib@0x5226 	
37 	libSystem.B.dylib 	libSystem.B.dylib@0x9923 	
38 	libSystem.B.dylib 	libSystem.B.dylib@0x3b632 	
39 	libSystem.B.dylib 	libSystem.B.dylib@0x815d 	
40 	CarbonCore 	CarbonCore@0x227e5 	
41 	CarbonCore 	CarbonCore@0x226f4 	
42 	HIToolbox 	HIToolbox@0x54fe5 	
43 	HIToolbox 	HIToolbox@0x30031 	
44 	HIToolbox 	HIToolbox@0x2ff7c 	
45 	libSystem.B.dylib 	libSystem.B.dylib@0x46ce 	
46 	HIToolbox 	HIToolbox@0x2fbaf 	
47 	CoreFoundation 	CoreFoundation@0x50032 	
48 	XUL 	nsInputStreamChannel::QueryInterface 	netwerk/base/src/nsInputStreamChannel.cpp:74
49 	CoreFoundation 	CoreFoundation@0xb64f 	
50 	CoreFoundation 	CoreFoundation@0x6056f 	
51 	CoreFoundation 	CoreFoundation@0x7044f 	
52 	libSystem.B.dylib 	libSystem.B.dylib@0x65d3 	
53 	CoreFoundation 	CoreFoundation@0x701a2 	
54 	CoreFoundation 	CoreFoundation@0x6ff07 	
55 	CoreFoundation 	CoreFoundation@0x4b84e 	
56 	libSystem.B.dylib 	libSystem.B.dylib@0x19811 	
57 	HIToolbox 	HIToolbox@0x2e919 	
58 	HIToolbox 	HIToolbox@0x2e71e 	
59 	HIToolbox 	HIToolbox@0x2e5d7 	
60 	AppKit 	AppKit@0x4429d 	
61 	CoreFoundation 	CoreFoundation@0x24572 	
62 	CoreGraphics 	CoreGraphics@0x6284b6 	
63 	CoreFoundation 	CoreFoundation@0x37120 	
64 	CoreFoundation 	CoreFoundation@0xc240 	
65 	CoreFoundation 	CoreFoundation@0x21eca 	
66 	CoreFoundation 	CoreFoundation@0x100cb 	
67 	CoreFoundation 	CoreFoundation@0x21eca 	
68 	CoreFoundation 	CoreFoundation@0x100cb 	
69 	libSystem.B.dylib 	libSystem.B.dylib@0x65d3 	
70 	CoreFoundation 	CoreFoundation@0x6191 	
71 	CoreFoundation 	CoreFoundation@0xf876 	
72 	CoreFoundation 	CoreFoundation@0xf6ce 	
73 	CoreFoundation 	CoreFoundation@0x2b4bb 	
74 	CoreFoundation 	CoreFoundation@0x631db 	
75 	AppKit 	AppKit@0x455c6 	
76 	AppKit 	AppKit@0x43b35 	
77 	AppKit 	AppKit@0x13aba1 	
78 	AppKit 	AppKit@0x74151f 	
79 	AppKit 	AppKit@0x73334 	
80 	AppKit 	AppKit@0x43bec 	
81 	libSystem.B.dylib 	libSystem.B.dylib@0xa1fa 	
82 	libSystem.B.dylib 	libSystem.B.dylib@0x815d 	
83 	CoreFoundation 	CoreFoundation@0x24845 	
84 	libobjc.A.dylib 	libobjc.A.dylib@0x771a 	
85 	CoreFoundation 	CoreFoundation@0x543b9 	
86 	HIToolbox 	HIToolbox@0x5508 	
87 	AppKit 	AppKit@0x709fc 	
88 	libSystem.B.dylib 	libSystem.B.dylib@0x65e7 	
89 	CoreFoundation 	CoreFoundation@0x34d5b 	
90 	AppKit 	AppKit@0x77e13f 	
91 	libSystem.B.dylib 	libSystem.B.dylib@0x65e7 	
92 	Foundation 	Foundation@0x2d01 	
93 	CoreFoundation 	CoreFoundation@0x2a423 	
94 	libSystem.B.dylib 	libSystem.B.dylib@0x65e7 	
95 	AppKit 	AppKit@0x77e13f 	
96 	AppKit 	AppKit@0x98d2 	
97 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:746
98 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:191
99 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3695
100 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
101 	firefox-bin 	firefox-bin@0x1953

Comment 6

[Mats Palmgren (inactive)]

Comment on attachment 502438 [details] [diff] [review]
guess fix

Yes, this seems reasonable.

Nit: s/base_win/baseWin or baseWindow/, to adhere to the established naming
convention in this file.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/5882d714c8d4

Marking this fixed, but I'll need to look at crash-stats to confirm.

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Based on http://crash-stats.mozilla.com/report/list?product=Firefox&branch=2.0&platform=mac&query_search=signature&query_type=contains&query=nsDocShell%3A%3ASetTreeOwner&date=01%2F18%2F2011%2003%3A57%3A53&range_value=2&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsCOMPtr_base%3A%3Aassign_from_qi%20|%20nsDocShell%3A%3ASetTreeOwner
this is really fixed.