92325 - crash while printing - Trunk [@ PresShell::ResizeReflow]

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Alexandru Savulov]

on the site pointed by URL, mozilla is crashing while printing. There is another 
bug on this site (bug 82401) that crashes also while printing, but with another 
stack. (attachment to reproduce this to follow)

Comment 1

[Alexandru Savulov]

Attachment: this one produces the stack that follows

Comment 2

[Alexandru Savulov]

STACK excerpt for attachment 43578 [details]:

PresShell::ResizeReflow(PresShell * const 0x042095f0, int 11729, int 15338) line 
2759 + 14 bytes
DocumentViewerImpl::ReflowPrintObject(PrintObject * 0x03836280) line 2929
DocumentViewerImpl::ReflowDocList(PrintObject * 0x03836280) line 2705 + 12 bytes
DocumentViewerImpl::SetupToPrintContent(nsIWebShell * 0x0344de84, 
nsIDeviceContext * 0x0388b4e0, nsIDOMWindowInternal * 0x00000000) line 3224 + 24 
bytes
DocumentViewerImpl::DocumentReadyForPrinting() line 3999 + 42 bytes
DocumentViewerImpl::Print(DocumentViewerImpl * const 0x037cad78, int 0, _iobuf * 
0x00000000, nsIPrintListener * 0x00000000) line 4595 + 11 bytes
GlobalWindowImpl::Print(GlobalWindowImpl * const 0x03492c24) line 1862 + 29 
bytes
XPTC_InvokeByIndex(nsISupports * 0x03492c24, unsigned int 69, unsigned int 0, 
nsXPTCVariant * 0x0012d990) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 1882 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x00dec930, JSObject * 0x033106d8, unsigned int 0, 
long * 0x038850a0, long * 0x0012db98) line 1252 + 14 bytes
js_Invoke(JSContext * 0x00dec930, unsigned int 0, unsigned int 0) line 807 + 23 
bytes
js_Interpret(JSContext * 0x00dec930, long * 0x0012e444) line 2697 + 15 bytes
js_Invoke(JSContext * 0x00dec930, unsigned int 1, unsigned int 2) line 824 + 13 
bytes
js_InternalInvoke(JSContext * 0x00dec930, JSObject * 0x03311158, long 68418096, 
unsigned int 0, unsigned int 1, long * 0x0012e624, long * 0x0012e574) line 896 + 
20 bytes
JS_CallFunctionValue(JSContext * 0x00dec930, JSObject * 0x03311158, long 
68418096, unsigned int 1, long * 0x0012e624, long * 0x0012e574) line 3320 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x02598c68, void * 0x03311158, 
void * 0x0413fa30, unsigned int 1, void * 0x0012e624, int * 0x0012e620, int 0) 
line 946 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x035a9b40, nsIDOMEvent 
* 0x037d7514) line 139 + 58 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x035b3388, 
nsIDOMEvent * 0x037d7514, nsIDOMEventTarget * 0x035a9250, unsigned int 8, 
unsigned int 7) line 1161 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x035a9ac8, 
nsIPresContext * 0x0263ea80, nsEvent * 0x0012f138, nsIDOMEvent * * 0x0012effc, 
nsIDOMEventTarget * 0x035a9250, unsigned int 7, nsEventStatus * 0x0012f184) line 
2131 + 36 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x035a9248, nsIPresContext * 
0x0263ea80, nsEvent * 0x0012f138, nsIDOMEvent * * 0x0012effc, unsigned int 1, 
nsEventStatus * 0x0012f184) line 3622
.
.
.
.

Comment 3

[Alexandru Savulov]

crashes while printing all the time on the TRUNK, no matter which URL

Comment 4

[Marc Attinasi]

I crash printing any and every page using trunk build 07-25-06

Serious regression on trunk! Eek - and I sr'd the change that caused it too I think.

I'm guessing that this is related to dcone's recent landing for printing of edit
controls (ResizeReflow issue). mViewManger is null in the presShell, and it is
getting dereferenced in ResizeReflow, causing crash.

Comment 5

[dcone (gone)]

But .. that same fix.. works in the branch.. so something else is contributing 
to this..

Comment 6

[dcone (gone)]

And.. I ran all my test cases before I checked this in.. so the regression 
happened sometime after my fix..

Comment 7

[hirata masakazu]

FYI, 2001072308 trunk build is crashing with similar stack (bug 92297).

Comment 8

[hirata masakazu]

Sorry for the spam. Bug 92297 seems to be a separate problem, since a web page
that crashes 0725 build with the stack trace in this bug does not crash 0723
trunk build.

Comment 9

[Ben Guthrie]

SEE BUG 92297

URL http://www.anandtech.com/mb/showdoc.html?i=1489

on win 98
Prints  build 2001072403
crashes build 2001072503

===> a checkin between the two

2 tb id's for NT, one for 98

Comment 10

[dcone (gone)]

My change Using the ResizeReflow is not the culprit,, seems that if I put the 
StyleReflow back.. it crashes..also. I think someone is destroying the 
mViewManger in the nsPresShell. David Baron and Hyatt have checkins on the day 
we regressed.. I am guessing that might have something to do with this.  Do 
either of you know why the mViewManager is null now when we reflow at this part 
of print.

Comment 11

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

It could be my changes if you're trying to print a document that's no longer
being displayed.  However, I would expect that the only time you would end up
with a null view manager with my changes is where you would have had a dangling
pointer to a deleted view manager before my changes.

It could also be that you're calling EndObservingDocument before you're done
using the PresShell.  If that's the case, then moving the EndObservingDocument
call later might help.  It's hard for me to tell where it's being called since
LXR is down now.

Comment 12

[dcone (gone)]

Yes I am calling EndObservingDocument.. this was at the request of the Editor 
team when I used history to update the printed document with the current 
content.  Anyway.. I will give this bug to you.. printing is completly down.. so 
this is a huge priority.

Comment 13

[dcone (gone)]

*** Bug 92424 has been marked as a duplicate of this bug. ***

Comment 14

[dcone (gone)]

*** Bug 92297 has been marked as a duplicate of this bug. ***

Comment 15

[Marc Attinasi]

Promoting to blocker - crashing on all printing with no workarounds (except not
to print, which is unacceptable).

Comment 16

[Marc Attinasi]

dbaron, what bug are your changes for? It seems like the semantics of
EndObservingDocument have changed significantly now, and I'd like to understand
it better. 

Comment 17

[Roland Mainz]

Can anyone please direct me to that patch which needs to be backed-out to get
printing working again ? Thx!

Comment 18

[Marc Attinasi]

nsPresShell.cpp 3.419 is the file, but it may require others to be backed out
too (see bug 80203).

Comment 19

[David Hyatt]

A better fix for 80203 (what dbaron was trying to solve) may be to revert
EndObservingDoc to the way it was and to make a new Destroy method on PresShell
that covers the actual teardown.  Then we leave the semantics of EndObservingDoc
unaltered.

Comment 20

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Yeah, that's what I did in my tree.  However, I still crash, elsewhere.  Were we
ever calling the destructor of PrintObject in the past?

Comment 21

[sujay]

cc: twalker

Comment 22

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: attempted fix (simple)

Comment 23

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: attempted fix (with cleanup)

Comment 24

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I'm going to back out my changes for bug 80203.

Comment 25

[Tracy Walker [:tracy]]

adding smoketest keyword as it now part of that too

Comment 26

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

This was fixed when I backed out my changes.

Comment 27

[Roland Mainz]

dbaron:
Wanna attach your "workaround" as patch here, please ?

Comment 28

[Basil Fritts]

*** Bug 92583 has been marked as a duplicate of this bug. ***

Comment 29

[Matthias Versen [:Matti]]

*** Bug 92701 has been marked as a duplicate of this bug. ***

Comment 30

[Chris Petersen]

Fixed on trunk builds. Mac (2001-07-30-08), Windows ME (2001-07-30-10), and
Linux Redhat 6.1 (2001-07-30-08).

Comment 31

[Jay Patel [:jay]]

Adding topcrash keyword and Trunk [@ PresShell::ResizeReflow] for future reference.