190992 - Crash in print preview when switching to Landscape (or back to Portrait) (on destroying/reflowing overflow:hidden container?)

Status: RESOLVED DUPLICATE of bug 203206

(Core :: Layout: Block and Inline, defect)

Description

[Alexandru Savulov]

there is a problem in print preview when opening the attached document (a HTML
listing of all files in /mozilla/layout). first of all there are missing pages,
secondly there is a crash happening when destroying overflow lines. (open the
document in print preview and switch to landscape or close the print preview).
the bug is been around since a while (at least since 20021212) and i see it on a
recent trunk pull and a recent 7.01 nightly. here is the call stack:

nsContainerFrame::Destroy(nsContainerFrame * const 0x03ed3c1c, nsIPresContext *
0x0414b0a8) line 138 + 11 bytes
nsBlockFrame::Destroy(nsBlockFrame * const 0x03ed3c1c, nsIPresContext *
0x0414b0a8) line 425
nsLineBox::DeleteLineList(nsIPresContext * 0x0414b0a8, nsLineList & {...}) line 311
nsBlockFrame::Destroy(nsBlockFrame * const 0x03ed3bc8, nsIPresContext *
0x0414b0a8) line 422 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x0414b0a8, nsLineList & {...}) line 311
nsBlockFrame::Destroy(nsBlockFrame * const 0x03ed39a4, nsIPresContext *
0x0414b0a8) line 422 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x0414b0a8, nsLineList & {...}) line 311
nsBlockFrame::Destroy(nsBlockFrame * const 0x03ed3950, nsIPresContext *
0x0414b0a8) line 422 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x0414b0a8, nsLineList & {...}) line 311
DestroyOverflowLines(nsIPresContext * 0x0414b0a8, nsIFrame * 0x03ed37f8, nsIAtom
* 0x00a68e38, void * 0x03e36118) line 4711 + 13 bytes
DestroyPropertyEnumerator(PLDHashTable * 0x04c747b4, PLDHashEntryHdr *
0x04c74818, unsigned int 0, void * 0x0414b0a8) line 2766 + 33 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x04c747b4, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x01233680
DestroyPropertyEnumerator(PLDHashTable *, PLDHashEntryHdr *, unsigned int, void
*), void * 0x0414b0a8) line 604 + 34 bytes
FrameManager::PropertyList::Destroy(nsIPresContext * 0x0414b0a8) line 2776 + 21
bytes
FrameManager::DestroyPropertyList(nsIPresContext * 0x0414b0a8) line 2472
FrameManager::Destroy(FrameManager * const 0x04163c50) line 529
PresShell::Destroy(PresShell * const 0x04152550) line 1814
DocumentViewerImpl::ReturnToGalleyPresentation() line 3632
DocumentViewerImpl::ExitPrintPreview(DocumentViewerImpl * const 0x034d8648) line
3364
XPTC_InvokeByIndex(nsISupports * 0x034d8648, unsigned int 18, unsigned int 0,
nsXPTCVariant * 0x0012d69c) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2023 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x01042f08, JSObject * 0x030fe9f0, unsigned int 0,
long * 0x029331b8, long * 0x0012d94c) line 1292 + 14 bytes
js_Invoke(JSContext * 0x01042f08, unsigned int 0, unsigned int 0) line 839 + 23
bytes
js_Interpret(JSContext * 0x01042f08, long * 0x0012e268) line 2803 + 15 bytes
js_Invoke(JSContext * 0x01042f08, unsigned int 1, unsigned int 2) line 856 + 13
bytes
js_InternalInvoke(JSContext * 0x01042f08, JSObject * 0x03362a80, long 10546216,
unsigned int 0, unsigned int 1, long * 0x0012e4c8, long * 0x0012e398) line 931 +
20 bytes
JS_CallFunctionValue(JSContext * 0x01042f08, JSObject * 0x03362a80, long
10546216, unsigned int 1, long * 0x0012e4c8, long * 0x0012e398) line 3431 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x0104a598, void * 0x03362a80,
void * 0x00a0ec28, unsigned int 1, void * 0x0012e4c8, int * 0x0012e4cc, int 0)
line 1040 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x043a2860, nsIDOMEvent
* 0x018425f8) line 181 + 77 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0425cbb0,
nsIDOMEvent * 0x018425f8, nsIDOMEventTarget * 0x02949a30, unsigned int 8,
unsigned int 7) line 1216 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x043a2430,
nsIPresContext * 0x0292ff70, nsEvent * 0x0012efbc, nsIDOMEvent * * 0x0012ee70,
nsIDOMEventTarget * 0x02949a30, unsigned int 7, nsEventStatus * 0x0012f008) line
2215 + 36 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0432b540, nsIPresContext *
0x0292ff70, nsEvent * 0x0012efbc, nsIDOMEvent * * 0x0012ee70, unsigned int 7,
nsEventStatus * 0x0012f008) line 3361
PresShell::HandleDOMEventWithTarget(PresShell * const 0x0292d8a8, nsIContent *
0x0432b540, nsEvent * 0x0012efbc, nsEventStatus * 0x0012f008) line 6268 + 39 bytes
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x0292ff70, nsGUIEvent *
0x0012f1cc) line 200
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x0309fb88,
nsIPresContext * 0x0292ff70, nsGUIEvent * 0x0012f1cc, nsEventStatus *
0x0012f558) line 147
PresShell::HandleEventInternal(nsEvent * 0x0012f1cc, nsIView * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012f558) line 6236 + 38 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x0292d8a8, nsEvent *
0x0012f1cc, nsIFrame * 0x0309fb88, nsIContent * 0x0432b540, unsigned int 1,
nsEventStatus * 0x0012f558) line 6174 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext * 0x0292ff70,
nsMouseEvent * 0x0012f75c, nsEventStatus * 0x0012f558) line 2866 + 66 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x02e8b178,
nsIPresContext * 0x0292ff70, nsEvent * 0x0012f75c, nsIFrame * 0x0309fb88,
nsEventStatus * 0x0012f558, nsIView * 0x028692e8) line 1847 + 23 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f75c, nsIView * 0x028692e8,
unsigned int 1, nsEventStatus * 0x0012f558) line 6241 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x0292d8ac, nsIView * 0x028692e8,
nsGUIEvent * 0x0012f75c, nsEventStatus * 0x0012f558, int 1, int & 1) line 6128 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x028692e8, nsGUIEvent * 0x0012f75c, int 1)
line 2208
nsView::HandleEvent(nsViewManager * 0x028690a8, nsGUIEvent * 0x0012f75c, int 1)
line 304
nsViewManager::DispatchEvent(nsViewManager * const 0x028690a8, nsGUIEvent *
0x0012f75c, nsEventStatus * 0x0012f65c) line 1942 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f75c) line 83
nsWindow::DispatchEvent(nsWindow * const 0x02869394, nsGUIEvent * 0x0012f75c,
nsEventStatus & nsEventStatus_eIgnore) line 1115 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f75c) line 1136
nsWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5376 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5633
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 1049285, long *
0x0012fbec) line 4087 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x00090708, unsigned int 514, unsigned int 0, long
1049285) line 1402 + 27 bytes
USER32! 77d67ad7()
USER32! 77d6ccd4()
USER32! 77d44455()
USER32! 77d495d5()
nsAppShellService::Run(nsAppShellService * const 0x00fe6f80) line 480
main1(int 1, char * * 0x002a2698, nsISupports * 0x00987ee0) line 1273 + 32 bytes
main(int 1, char * * 0x002a2698) line 1636 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e814c7()

Comment 1

[Alexandru Savulov]

Attachment: testcase document

open the atatchment, go to print preview, close print preview or switch to
landscape.

Comment 2

[Alexandru Savulov]

ok, there are some missing gif's but they are not important for the testcase. if
you want the full functionality, download the document and provide 3 16x16 gifs
called ffc.gif, ffo.gif and fi.gif in the same dir.

Comment 3

[Daniel Wang]

Attachment: reduced testcase

note: if you remove line e30, Mozilla will not crash on switching to
landscape, but will:
- on switching back to portrait, or
- on [close]

note: because of overflow:hidden, missing pages are to be expected

Comment 4

[Matthias Versen [:Matti]]

*** This bug has been marked as a duplicate of 203206 ***