324915 - Crash [@ nsSubDocumentFrame::QueryInterface] when printing page that contains an iframe

Status: RESOLVED FIXED

(Core :: Printing: Output, defect)

Description

[u52928]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060126 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060126 Firefox/1.6a1

When trying to print page with "marquess" FF crashes.



Reproducible: Always

Steps to Reproduce:
1. Go to http://news.bbc.co.uk/2/hi/default.stm
2. Try to print page

Actual Results:  
"Print" dialogue appears, and so does the "Printing" window, but then FF crashes.

Expected Results:  
Page should print.

Today's branch build prints it without a problem. Also, there's no problem when trying to print any other page from the BBC news. It seems to be related to the marquee.

The talkback ID is TB14459212Y 
FIREFOX caused an invalid page fault in module FIREFOX.EXE at 0177:0066e215. 

I have all the same extensions and use the same theme in both the branh and trunk profiles.

Comment 1

[Peter van der Woude [:Peter6]]

Incident ID: 14459212
Stack Signature	nsSubDocumentFrame::QueryInterface e0526491
Product ID	FirefoxTrunk
Build ID	2006012609
Trigger Time	2006-01-27 01:22:34.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	FIREFOX.EXE + (0026e215)
URL visited	
User Comments	
Since Last Crash	649 sec
Total Uptime	4374 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameFrame.cpp, line 203
Stack Trace 	
nsSubDocumentFrame::QueryInterface  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameFrame.cpp, line 203]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsTableCellFrame::PaintCellBackground  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableCellFrame.cpp, line 352]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1233]
nsTableRowFrame::UpdateHeight  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowFrame.cpp, line 489]
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1233]
nsTableRowGroupFrame::GetNextFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowGroupFrame.h, line 356]
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1233]
nsTableFrame::CollectRows  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1257]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsTableOuterFrame::`scalar deleting destructor'
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBoxFrame::GetLayoutManager  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2285]
nsBoxFrame::CheckBoxOrder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2270]
nsPageContentFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsPageContentFrame.cpp, line 134]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBoxFrame::GetLayoutManager  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2285]
nsBoxFrame::CheckBoxOrder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2270]
nsPageFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsPageFrame.cpp, line 546]
nsFrame::DisplayBorderBackgroundOutline  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 908]
nsLayoutUtils::GetEventCoordinatesRelativeTo  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsLayoutUtils.cpp, line 500]
PresShell::ComputeRepaintRegionForCopy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5406]
nsSimplePageSequenceFrame::PrintNextPage  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp, line 828]
nsPrintEngine::PrintPage  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 3473]
nsXMLStylesheetPI::`scalar deleting destructor'
nsTimerImpl::Fire  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 413]
nsAppStartup::Quit  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 287]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
KERNEL32.DLL + 0x1b560 (0xbff8b560)
KERNEL32.DLL + 0x1b412 (0xbff8b412)
KERNEL32.DLL + 0x19dd5 (0xbff89dd5)

Comment 2

[Peter van der Woude [:Peter6]]

regression started on 26th (acc a forumpost)

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase

Basically, the crash happens when trying to print a page that contains an iframe.
This is a regression from bug 317375.

Comment 4

[Eli Friedman]

Attachment: Patch

Missing null check; I think this is right, although it is kind of weird.  I guess it has something to do with printing displaying the various documents one by one.

BTW, I don't know what Talkback's on; that trace is completely off.

Comment 5

[Andrew Schultz]

*** Bug 325238 has been marked as a duplicate of this bug. ***

Comment 6

[Eli Friedman]

Checking in nsFrameFrame.cpp;
/cvsroot/mozilla/layout/generic/nsFrameFrame.cpp,v  <--  nsFrameFrame.cpp
new revision: 3.293; previous revision: 3.292
done

My first checkin, so tell me if I messed up anything.