131299 - [PFM]M099 Trunk crash trying to print preview [@ BasicTableLayoutStrategy::AssignPctColumnWidths]

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P1)

Description

[Jay Patel [:jay]]

I'm logging a new bug for a crash mentioned in Bug 117088 because that bug dealt
with multiple stack signatures.  There seems to be new crashes being reported
under BasicTableLayoutStrategy::AssignPctColumnWidths from users doing print
preview.  

I was able to reproduce this crash from one users comments (go to www.trouw.nl
and try to print preview from the printer icon):

 Incident ID 4088249   
Stack Signature  BasicTableLayoutStrategy::AssignPctColumnWidths 5ccc6cfa
Trigger Time 2002-03-15 14:39:00
Email Address [e-mail]
URL visited www.trouw.nl
Build ID 2002031309
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments just tried to print preview from toolbar print icon.
Stack Trace
BasicTableLayoutStrategy::AssignPctColumnWidths
[d:\builds\seamonkey\mozilla\layout\html\table\src\BasicTableLayoutStrategy.cpp,
line 1503]
BasicTableLayoutStrategy::BalanceColumnWidths
[d:\builds\seamonkey\mozilla\layout\html\table\src\BasicTableLayoutStrategy.cpp,
line 251]
nsTableFrame::BalanceColumnWidths
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3398]
nsTableFrame::ReflowTable
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2107]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1989]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1009]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1592]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 955]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1031]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1423]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowGroupFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 446]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1150]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3265]
nsTableFrame::ReflowTable
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2120]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1989]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1009]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1592]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 955]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1031]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1423]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowGroupFrame::SplitRowGroup
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1027]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1180]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3265]
nsTableFrame::ReflowTable
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2120]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1989]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1009]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1592]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsPageContentFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPageContentFrame.cpp, line 98] 

There are already a few crashes reported for Mozilla 0.9.9 and from my incident
above it's clearly crashing the current MozillaTrunk.

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash+ and testcase keywords.  Nominating for nsbeta1.

Also, I crashed again trying to print preview from file->print preview...so the
path to print preview doesn't matter (file menu vs printer icon...they both crash).

Comment 2

[Takuo KITAME]

Crashed also on Linux. Mozilla/0.9.9

Comment 3

[Christine Hoffman]

Changing QA contact

Comment 4

[Kevin McCluskey (gone)]

Reassigning to Chris. nsbeta1+

Comment 5

[karnaze (gone)]

Attachment: reduced test case (which needs to be reduced further)

Comment 6

[karnaze (gone)]

On the test case, I'm getting the following assertion, followed by the crash. 
The frame being referenced has already been deleted. It isn't obvious to me what 
is going on. It would be nice to know if this is a regression and if so, when it 
happened.

nsDebug::Assertion(const char * 0x0288bd28, const char * 0x0288bcec, const char 
* 0x0288bcb8, int 1009) line 291 + 13 bytes
FrameManager::NotifyDestroyingFrame(FrameManager * const 0x03644520, nsIFrame * 
0x0361c850) line 1009 + 45 bytes
PresShell::NotifyDestroyingFrame(PresShell * const 0x033b5e68, nsIFrame * 
0x0361c850) line 2983
nsFrame::Destroy(nsFrame * const 0x0361c850, nsIPresContext * 0x033b4f00) line 
446
nsContainerFrame::Destroy(nsContainerFrame * const 0x0361c850, nsIPresContext * 
0x033b4f00) line 142
nsBlockFrame::Destroy(nsBlockFrame * const 0x0361c850, nsIPresContext * 
0x033b4f00) line 331
nsFrameList::DestroyFrames(nsIPresContext * 0x033b4f00) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x0361c610, nsIPresContext * 
0x033b4f00) line 141
nsTableFrame::Destroy(nsTableFrame * const 0x0361c610, nsIPresContext * 
0x033b4f00) line 306

CRASH

CallQueryInterface(nsIFrame * 0x0394b408, nsIFormControlFrame * * 0x0012f90c) 
line 270 + 19 bytes
nsGenericHTMLElement::GetFormControlFrameFor(nsIContent * 0x038de380, 
nsIDocument * 0x038697b8, int 0) line 2877 + 13 bytes
nsGenericHTMLElement::GetFormControlFrame(int 0) line 217 + 20 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x038de380, 
nsIPresContext * 0x03842770, nsEvent * 0x0012fca4, nsIDOMEvent * * 0x00000000, 
unsigned int 65, nsEventStatus * 0x0012fccc) line 1220 + 10 bytes
HandleImagePLEvent(nsIContent * 0x038de380, unsigned int 1102, unsigned int 65) 
line 488

Comment 7

[Syd Logan]

adt2 per adt triage

Comment 8

[Bernd]

if one looks at the "Got checks for null pointers/simple crash fixes?" the
crashes at AssignPctColumns started at 2001-12-07 and where not present at
2001-12-06. Since then regardless of the numerous crash bugs against
printpreview which have been closed the signature persists. While I dont crash
with the testcase with 2002-01-03 build under WinNT rpevious fixes maybe have
only wallpapered over the core issue.

regarding the assertion: just a short snippet from a rtest.log

+++ file:///s:/mozilla/layout/html/tests/block/bugs/7806.html: done loading (50
msec)
regression test s:\mozilla\layout\html\tests\block\bugs\verify\7806.rgd passed
+++ file:///s:/mozilla/layout/html/tests/block/bugs/7993.html: done loading (170
msec)
###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
C:\moz_sour\mozilla\mozilla\layout\html\base\src\nsFrameManager.cpp, line 1003
regression test s:\mozilla\layout\html\tests\block\bugs\verify\7993.rgd passed
+++ file:///s:/mozilla/layout/html/tests/block/bugs/8438.html: done loading (160
msec)
 

and another one:

+++ file:///s:/mozilla/layout/html/tests/block/bugs/55250.html: done loading
(930 msec)
###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
C:\moz_sour\mozilla\mozilla\layout\html\base\src\nsFrameManager.cpp, line 1003
frame state mismatch: 0xc01014 vs. 0xc00004
 

Comment 9

[Bernd]

Attachment: slightly more reduced

Comment 10

[Chris Petersen]

As per Karnaze's request to see when this regressed, it looks like it has been
in build since Print preview appeared (Dec 7th). In this build (2001-12-07-03),
the application crashs only when exiting the page like using the back/forward
arrows. It doesn't immediately crash when switching into preview mode like it
does on newer builds.

Comment 11

[Bernd]

Chris: I think rods tried to fix that already in bug 114139. Then there was
wfm??? close of bug 117088. And rods wfm'ed also bug 119372. 

Comment 12

[Bernd]

btw dbaron checked in today some stuff that may help bug 121055.

Comment 13

[Bernd]

The original URL asserts like hell:

the first ASSERT  

NS_ASSERTION(bodyContent, "no body node"); // bug 118829 

already looks pretty serious. David added the assertion just to catch these 
cases.

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Marking bugs dealing with re-addition to the primary frame map with [PFM].

Comment 15

[karnaze (gone)]

I'm not having any problems with the url or test cases any more. wfm.

Comment 16

[Moied]

verified URL and testcase WFM with build ID 20020412