134481 - Crash when tearing down the layout objects used for printing [@ nsGfxScrollFrame::Destroy ]

Status: RESOLVED WORKSFORME

(Core :: Printing: Output, defect, P1)

Description

[Henri Sivonen (:hsivonen)]

Build ID: 2002032608 FizzillaCFM

Reproducible: Always

Steps to reproduce:
1) Load http://www.macsanomat.com/moz-bug.html (an article about the new dual 1
GHz PowerMac)
2) Choose File -> Print
3) Click "Preview" (in order to save paper)

Actual results:
Mozilla crashes when freeing the print layout from memory.

Expected results:
No crash.

Additional information:
A non-crashing version of the same article is at
http://www.macsanomat.com/nayta.php?id=834
The main difference is that the non-crashing version hides the commenting form
(titled "Lisää kommentti"). Even when the problematic print stylesheet was
applied to the entire site, Mozilla crashed with only that one article.

The crashing version uses http://www.macsanomat.com/moz-bug-print.css while the
noncrasing one uses http://www.macsanomat.com/print.css

Comment 1

[Henri Sivonen (:hsivonen)]

Attachment: Crash log excerpt

Comment 2

[rods (gone)]

I can't reproduce on Win2k, over to Don

Comment 3

[Chris Petersen]

Confirming crash when clicking Print instead of Preview. Occurs under OS 9.1
with April 9th trunk build as well. Macsbug stack trace coming soon.

Comment 4

[Chris Petersen]

Attachment: Macsbug stack trace

Comment 5

[dcone (gone)]

Chris.. can you re-check this.

Comment 6

[Kurt Weinschenker]

Yes, this bug is still here.  Went to test site, hit File -> Print Preview. 
Print Preview came up nicely.  Hit 'Close' button, and Mozilla blew up.

iMac DV G3/400, Mac OS 9.2.2, QT 6.0.2.  MacsBug stdlog follows.

Comment 7

[Kurt Weinschenker]

Attachment: Macsbug stdlog from crash with trunk build 2002102308

Trunk build 2002102308

Comment 8

[Olivier Cahagne]

crashing linux debug build 20021226

#0  0x088cd3e4 in ?? ()
#1  0x41c416c7 in nsGfxScrollFrame::Destroy (this=0x8b13d10, 
    aPresContext=0x8b88288) at nsGfxScrollFrame.cpp:462
#2  0x41d72699 in nsFrameList::DestroyFrames (this=0x8b13a88, 
    aPresContext=0x8b88288) at nsFrameList.cpp:130
#3  0x41c2933d in nsContainerFrame::Destroy (this=0x8b13a54, 
    aPresContext=0x8b88288) at nsContainerFrame.cpp:142
#4  0x41d45d63 in nsBoxFrame::Destroy (this=0x8b13a54, aPresContext=0x8b88288)
    at nsBoxFrame.cpp:1116

Comment 9

[Olivier Cahagne]

Attachment: Stacktrace linux build 20021226

Comment 10

[Mats Palmgren (inactive)]

WFM, Mozilla 1.5 and 2003-10-18-05 trunk Linux

Comment 11

[Mats Palmgren (inactive)]

Most likely fixed by bug 193686.

WFM, Mozilla 1.6a and 2003-11-19-08 trunk on Windows 98 SE.
WFM, Mozilla 2003-11-10-05 trunk on Linux.

-> WORKSFORME