Crash [@ nsPrintEngine::ReflowDocList] with frameset onbeforeprint window.print() in foreignObject

RESOLVED FIXED

Status

()

Core
Printing: Output
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Martijn Wargers (dead), Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Windows 7
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 546233 [details]
testcase

See testcase, sometimes it crashes directly when trying to print. Otherwise, you have to try it a few times.

I think I've seen this crash happening before bug 307258 was fixed, but the fix for that bug seems to make it easier to trigger.

https://crash-stats.mozilla.com/report/index/bp-619e8817-5bfd-457e-bd74-fb4462110715
0 	xul.dll 	nsPrintEngine::ReflowDocList 	layout/printing/nsPrintEngine.cpp:1832
1 	xul.dll 	nsPrintEngine::ReflowDocList 	layout/printing/nsPrintEngine.cpp:1865
2 	xul.dll 	nsPrintEngine::SetupToPrintContent 	layout/printing/nsPrintEngine.cpp:1669
3 	xul.dll 	nsPrintEngine::DocumentReadyForPrinting 	layout/printing/nsPrintEngine.cpp:1501
4 	xul.dll 	nsPrintEngine::DoCommonPrint 	layout/printing/nsPrintEngine.cpp:736
5 	xul.dll 	nsPrintEngine::CommonPrint 	layout/printing/nsPrintEngine.cpp:444
6 	xul.dll 	nsPrintEngine::Print 	layout/printing/nsPrintEngine.cpp:759
7 	xul.dll 	DocumentViewerImpl::Print 	layout/base/nsDocumentViewer.cpp:3680
8 	xul.dll 	nsGlobalWindow::Print 	dom/base/nsGlobalWindow.cpp:5184
9 	xul.dll 	nsGlobalWindow::Print 	dom/base/nsGlobalWindow.cpp:5149
10 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
11 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1592
12 	mozjs.dll 	CallCompiler::generateNativeStub 	js/src/methodjit/MonoIC.cpp:813
13 	mozjs.dll 	js::mjit::ic::NativeCall 	js/src/methodjit/MonoIC.cpp:1031
14 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:686
15 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:733
16 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:610
17 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:686
18 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:805
19 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5055
20 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1905

Comment 1

6 years ago
So far no luck with reproducing.

Comment 2

6 years ago
Created attachment 546301 [details] [diff] [review]
patch

Martijn, does this help?
(Reporter)

Comment 3

6 years ago
Yes, that seems to fix the crash. Thanks.

Comment 4

6 years ago
Comment on attachment 546301 [details] [diff] [review]
patch

This effectively brings back the null check we had before primary frame was
moved to nsIContent.
Attachment #546301 - Flags: review?(roc)
Comment on attachment 546301 [details] [diff] [review]
patch

Review of attachment 546301 [details] [diff] [review]:
-----------------------------------------------------------------
Attachment #546301 - Flags: review?(roc) → review+

Comment 6

6 years ago
http://hg.mozilla.org/mozilla-central/rev/819a2ffc4f0e
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.