[PFM]M099 Trunk crash trying to print preview [@ BasicTableLayoutStrategy::AssignPctColumnWidths]

VERIFIED WORKSFORME

Status

()

Core
Layout
P1
critical
VERIFIED WORKSFORME
16 years ago
16 years ago

People

(Reporter: jay, Assigned: karnaze (gone))

Tracking

({crash, testcase, topcrash+})

Trunk
mozilla1.0
x86
Windows 2000
crash, testcase, topcrash+
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [adt2], crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

16 years ago
I'm logging a new bug for a crash mentioned in Bug 117088 because that bug dealt
with multiple stack signatures.  There seems to be new crashes being reported
under BasicTableLayoutStrategy::AssignPctColumnWidths from users doing print
preview.  

I was able to reproduce this crash from one users comments (go to www.trouw.nl
and try to print preview from the printer icon):

 Incident ID 4088249   
Stack Signature  BasicTableLayoutStrategy::AssignPctColumnWidths 5ccc6cfa
Trigger Time 2002-03-15 14:39:00
Email Address jpatel@netscape.com
URL visited www.trouw.nl
Build ID 2002031309
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments just tried to print preview from toolbar print icon.
Stack Trace
BasicTableLayoutStrategy::AssignPctColumnWidths
[d:\builds\seamonkey\mozilla\layout\html\table\src\BasicTableLayoutStrategy.cpp,
line 1503]
BasicTableLayoutStrategy::BalanceColumnWidths
[d:\builds\seamonkey\mozilla\layout\html\table\src\BasicTableLayoutStrategy.cpp,
line 251]
nsTableFrame::BalanceColumnWidths
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3398]
nsTableFrame::ReflowTable
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2107]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1989]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1009]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1592]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 955]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1031]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1423]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowGroupFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 446]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1150]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3265]
nsTableFrame::ReflowTable
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2120]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1989]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1009]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1592]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 955]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1031]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1423]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableRowGroupFrame::SplitRowGroup
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1027]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1180]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3265]
nsTableFrame::ReflowTable
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2120]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1989]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1009]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1592]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3202]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2478]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2251]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 805]
nsPageContentFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPageContentFrame.cpp, line 98] 

There are already a few crashes reported for Mozilla 0.9.9 and from my incident
above it's clearly crashing the current MozillaTrunk.
(Reporter)

Comment 1

16 years ago
Adding crash, topcrash+ and testcase keywords.  Nominating for nsbeta1.

Also, I crashed again trying to print preview from file->print preview...so the
path to print preview doesn't matter (file menu vs printer icon...they both crash).
Keywords: crash, nsbeta1, testcase, topcrash+
Summary: M099 Trunk crash trying to print preview [@ BasicTableLayoutStrategy::AssignPctColumnWidths] → M099 Trunk crash trying to print preview [@ BasicTableLayoutStrategy::AssignPctColumnWidths]

Comment 2

16 years ago
Crashed also on Linux. Mozilla/0.9.9

Comment 3

16 years ago
Changing QA contact
QA Contact: petersen → moied
Reassigning to Chris. nsbeta1+
Assignee: attinasi → karnaze
Keywords: nsbeta1 → nsbeta1+
Priority: -- → P1
Target Milestone: --- → mozilla1.0
(Assignee)

Comment 5

16 years ago
Created attachment 75271 [details]
reduced test case (which needs to be reduced further)
(Assignee)

Comment 6

16 years ago
On the test case, I'm getting the following assertion, followed by the crash. 
The frame being referenced has already been deleted. It isn't obvious to me what 
is going on. It would be nice to know if this is a regression and if so, when it 
happened.

nsDebug::Assertion(const char * 0x0288bd28, const char * 0x0288bcec, const char 
* 0x0288bcb8, int 1009) line 291 + 13 bytes
FrameManager::NotifyDestroyingFrame(FrameManager * const 0x03644520, nsIFrame * 
0x0361c850) line 1009 + 45 bytes
PresShell::NotifyDestroyingFrame(PresShell * const 0x033b5e68, nsIFrame * 
0x0361c850) line 2983
nsFrame::Destroy(nsFrame * const 0x0361c850, nsIPresContext * 0x033b4f00) line 
446
nsContainerFrame::Destroy(nsContainerFrame * const 0x0361c850, nsIPresContext * 
0x033b4f00) line 142
nsBlockFrame::Destroy(nsBlockFrame * const 0x0361c850, nsIPresContext * 
0x033b4f00) line 331
nsFrameList::DestroyFrames(nsIPresContext * 0x033b4f00) line 131
nsContainerFrame::Destroy(nsContainerFrame * const 0x0361c610, nsIPresContext * 
0x033b4f00) line 141
nsTableFrame::Destroy(nsTableFrame * const 0x0361c610, nsIPresContext * 
0x033b4f00) line 306

CRASH

CallQueryInterface(nsIFrame * 0x0394b408, nsIFormControlFrame * * 0x0012f90c) 
line 270 + 19 bytes
nsGenericHTMLElement::GetFormControlFrameFor(nsIContent * 0x038de380, 
nsIDocument * 0x038697b8, int 0) line 2877 + 13 bytes
nsGenericHTMLElement::GetFormControlFrame(int 0) line 217 + 20 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x038de380, 
nsIPresContext * 0x03842770, nsEvent * 0x0012fca4, nsIDOMEvent * * 0x00000000, 
unsigned int 65, nsEventStatus * 0x0012fccc) line 1220 + 10 bytes
HandleImagePLEvent(nsIContent * 0x038de380, unsigned int 1102, unsigned int 65) 
line 488

Comment 7

16 years ago
adt2 per adt triage
Whiteboard: [adt2]

Updated

16 years ago

Comment 8

16 years ago
if one looks at the "Got checks for null pointers/simple crash fixes?" the
crashes at AssignPctColumns started at 2001-12-07 and where not present at
2001-12-06. Since then regardless of the numerous crash bugs against
printpreview which have been closed the signature persists. While I dont crash
with the testcase with 2002-01-03 build under WinNT rpevious fixes maybe have
only wallpapered over the core issue.

regarding the assertion: just a short snippet from a rtest.log

+++ file:///s:/mozilla/layout/html/tests/block/bugs/7806.html: done loading (50
msec)
regression test s:\mozilla\layout\html\tests\block\bugs\verify\7806.rgd passed
+++ file:///s:/mozilla/layout/html/tests/block/bugs/7993.html: done loading (170
msec)
###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
C:\moz_sour\mozilla\mozilla\layout\html\base\src\nsFrameManager.cpp, line 1003
regression test s:\mozilla\layout\html\tests\block\bugs\verify\7993.rgd passed
+++ file:///s:/mozilla/layout/html/tests/block/bugs/8438.html: done loading (160
msec)
 

and another one:

+++ file:///s:/mozilla/layout/html/tests/block/bugs/55250.html: done loading
(930 msec)
###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
C:\moz_sour\mozilla\mozilla\layout\html\base\src\nsFrameManager.cpp, line 1003
frame state mismatch: 0xc01014 vs. 0xc00004
 

Comment 9

16 years ago
Created attachment 75439 [details]
slightly more reduced

Comment 10

16 years ago
As per Karnaze's request to see when this regressed, it looks like it has been
in build since Print preview appeared (Dec 7th). In this build (2001-12-07-03),
the application crashs only when exiting the page like using the back/forward
arrows. It doesn't immediately crash when switching into preview mode like it
does on newer builds.

Comment 11

16 years ago
Chris: I think rods tried to fix that already in bug 114139. Then there was
wfm??? close of bug 117088. And rods wfm'ed also bug 119372. 

Comment 12

16 years ago
btw dbaron checked in today some stuff that may help bug 121055.

Comment 13

16 years ago
The original URL asserts like hell:

the first ASSERT  

NS_ASSERTION(bodyContent, "no body node"); // bug 118829 

already looks pretty serious. David added the assertion just to catch these 
cases.
Marking bugs dealing with re-addition to the primary frame map with [PFM].
Summary: M099 Trunk crash trying to print preview [@ BasicTableLayoutStrategy::AssignPctColumnWidths] → [PFM]M099 Trunk crash trying to print preview [@ BasicTableLayoutStrategy::AssignPctColumnWidths]
(Assignee)

Comment 15

16 years ago
I'm not having any problems with the url or test cases any more. wfm.
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → WORKSFORME

Comment 16

16 years ago
verified URL and testcase WFM with build ID 20020412
Status: RESOLVED → VERIFIED
Crash Signature: [@ BasicTableLayoutStrategy::AssignPctColumnWidths]
You need to log in before you can comment on or make changes to this bug.