262403 - print preview of www.ign.com results in a crash [@ nsBlockFrame::PrepareResizeReflow nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy]

Status: VERIFIED FIXED

(Core :: Layout: Block and Inline, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: 2004-09-30-05, Windows XP Seamonkey trunk.

Summary: Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000] in Print Preview
of www.ign.com

Steps to Reproduce:

1.  Load http://www.ign.com
2.  File | Print Preview
3.  Click Landscape or Portrait (Not available on Linux)
4.  Crash, here:

0x3f800000
nsBlockFrame::DrainOverflowLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 4279]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 735]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5089]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 868]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1015]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3597]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3425]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2467]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5089]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 868]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1015]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3597]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3425]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2467]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3079]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2349]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5089]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 868]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1015]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3597]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3425]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2467]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3079]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2349]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3079]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2349]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 993]
nsPageContentFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPageContentFrame.cpp,
line 105]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 993]
nsPageFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPageFrame.cpp,
line 210]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 993]
nsSimplePageSequenceFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsSimplePageSequence.cpp,
line 411]
nsFrame::BoxReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 5267]
nsFrame::DoLayout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 5007]
nsIFrame::Layout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 799]
nsScrollBoxFrame::DoLayout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp,
line 339]
nsIFrame::Layout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 799]
nsBoxFrame::LayoutChildAt 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 2693]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1669]

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

See bug 185357 and bug 248825.

3rd time's a charm.

Comment 2

[Ferdinand]

Attachment: Testcase

Crashes in print preview with orientation: landscape.

Comment 3

[Ferdinand]

The testcase crashes in Linux, with a backtrace almost identical to the one
Stephen gave. (The orientation is set in Page Setup before opening Print Preview.)

Comment 4

[Ferdinand]

Attachment: Testcase (better)

I've improved the testcase a bit (got rid of the imgs mainly), this one still
has the same trace. However, if you remove the border:solid; or the last br the
browser does draw the print preview screen, but then crashes in
nsContainerFrame::PaintChild.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Updatest stack trace

Since the landing of bug bug 251162, the line numbers have changed, but the
stack trace (based on the methods and functions) still looks about the same.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Hmm, I can't get either of the testcases here to crash on my GTK1 trunk build.

Comment 7

[Ferdinand]

I tested the latest linux nightly, and it crashes. I could send the talkback
data, but I doubt that would help you. Maybe there's something in your print or
page setup preferences which prevents the crash. The rather obvious things I can
come up with right now are: Check that page orientation is set to landscape, and
check that page size is A4 or letter.

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Roc: if I remember correctly, do you not have page orientation in your Linux
build for Print Preview?

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I changed to Landscape in the Page Setup dialog

Comment 10

[chris hofmann]

know if this is happening on the aviary branch?

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Yes, this crashes Firefox branch build Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.7.3) Gecko/20041020 Firefox/1.0

TB1429473E

Comment 12

[chris hofmann]

yeah, I was able to reproduce too..  be good if there is an simple fix for this
and we could get it on the branches.  roc, what do you think?

Comment 13

[Asa Dotzler [:asa]]

Why is a not-topcrash print preview crash on our blocker list? 

Comment 14

[Jay Patel [:jay]]

This crash is probably related to bug 240490 and bug 248825 in some way, and so
although this bug itself is not yet a topcrasher, it might still be worth
getting a fix in if it will help bring down the topcrash count of the various
print preview bugs out there (many of which involve ign.com).

Comment 15

[Jay Patel [:jay]]

Here's a quick link to these crashes:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsBlockFrame%3A%3ADrainOverflowLines&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 16

[Asa Dotzler [:asa]]

roc says this isn't goint to make 1.0.

Comment 17

[Stephen Donner [:stephend] Not actively reading bugmail]

Ferdinand's testcase for this
https://bugzilla.mozilla.org/attachment.cgi?id=161199 doesn't crash for me any
longer, but Print Preview/Print of http://www.ign.com still does, which means
any help creating a new testcase is appreciated...

Comment 18

[Ferdinand]

Attachment: Testcase (new crash, branch)

I only saw a crash on branch, I've created this testcase for that one. It is, I
guess, technically a new bug.
Stephen, can you tell if it's the same crash you're talking about?
If you're seeing one on the trunk I'll have to take another look at it.

Comment 19

[Stephen Donner [:stephend] Not actively reading bugmail]

Ferdinand: thanks for creating that testcase
(https://bugzilla.mozilla.org/attachment.cgi?id=169143), but unfortunately it
doesn't crash my 2004-12-22-04 trunk Windows XP build...

Comment 20

[Ferdinand]

Attachment: Testcase (new crash, trunk)

Take 2: On the trunk this time.
Can you confirm this is the right one, Stephen?

Comment 21

[Stephen Donner [:stephend] Not actively reading bugmail]

Ferdinand: thanks!

nsFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 679]
nsSplittableFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSplittableFrame.cpp,
line 71]
nsBlockFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 314]
nsPropertyTable::PropertyList::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsPropertyTable.cpp,
line 249]

Comment 22

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The patch in bug 263825 fixes this testcase but it *still* crashes on ign.com!!
Sigh :-) Hopefully it at least moves us closer. BTW thanks for the testcase
Ferdinand, but we'll need your services again :-)

Comment 23

[Ferdinand]

The site crashes both in landscape and in portrait mode, do you want me to add
testcases for each, or should the portrait crash be put in a new bug?

Comment 24

[Ferdinand]

Attachment: Testcase (new crash... again)

Here's a testcase that crashes regardless of page orientation, so you can
ignore my previous comment.

Comment 25

[Robert O'Callahan (:roc) (email my personal email if necessary)]

One crash at a time :-). Portrait's easier for me to test. I'll get to work on
this testcase. Thanks so much.

Comment 26

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This patch fixes the testcase. The problem is that when we reflow a float that
breaks across pages, the reflow of the placeholder returns status NOT_COMPLETE,
and normally for inlines that means we need to break the line after the frame.
Of course for placeholders we can and should continue along the line.
nsBlockFrame::ReflowInlineFrame detects this special case, but it doesn't
handle the case when the placeholder is inside some span. To get that one, we
need to check in nsInlineFrame::ReflowInlineFrame.

This patch also squashes some annoying assertions where we don't know how to
order the views of page frames because they don't have content. The order of
such views doesn't really matter...

With this patch I can actually successfully print preview ign.com! And it
doesn't look too bad.

Comment 27

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Special thanks to Ferdinand without whose persistence this would not have been
possible.

Comment 28

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 178413 [details] [diff] [review]
fix

As long as changing what happens when f is null (when is that?) isn't a bad
thing to do, r+sr=dbaron.

Comment 29

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I don't think that can ever happen. It would have to be a view in the view tree
with no frame, and no ancestor with a frame. But the root of the view tree has
the viewport frame on it. I'll add an assertion that f is not null.

Comment 30

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Oops, there already is one! And it's not firing :-)

Comment 31

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Checked in. Thanks all.

Comment 32

[Stephen Donner [:stephend] Not actively reading bugmail]

Finally!

Verified FIXED with build Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b2) Gecko/20050324

Comment 33

[timeless]

*** Bug 314644 has been marked as a duplicate of this bug. ***

Comment 34

[Nicholas Shewmaker]

I originally submitted Bug 314644, which was marked as a dupe of this one, which is now marked "Fixed".  However, Problem A seems to be fixed at the expense of Problem B, as I noted in 314644.  I can Preview and Print the test case for that bug in 1.5rc1, but the preview and output are very different from the desired and on-screen look.  Does this need to be submitted as a new bug?

Comment 35

[Boris Zbarsky [:bzbarsky]]

Yes, please file one bug per problem.