Closed Bug 215760 Opened 21 years ago Closed 19 years ago

//html-tags.info reliably crashes Mozilla 1.4 if printed / print-previewed [@ nsIFrame::GetNextSibling]

Categories

(Core :: Printing: Output, defect)

Product:
Core
Component:
Printing: Output
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gcf, Assigned: roc)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(2 files)

Testcase
561 bytes, text/html
Details
fix
2.22 KB, patch
dbaron
: review+
dbaron
: superreview+
asa
: approval1.8b2+
Details | Diff | Splinter Review 
User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko/20030624

http://html-tags.info/ crashed Mozilla 1.4 when I attempted
to print it (3 times).


Reproducible: Always

Steps to Reproduce:
1. go to above URL
2. select PRINT from File menu.
3.

Actual Results:  
Crash

Expected Results:  
Printed the page, or explained why it could not be printed.

This does not look like an exact duplicate of anything above,
however, even if it is, it may prove useful if your experience 
with the page is as forthright as mine (reliable crashes).
Crashes a current tip Linux build as well.  I see:

###!!! ASSERTION: no font available: 'font && font->entry', file
/home/bzbarsky/mozilla/xlib/mozilla/gfx/src/ps/nsFontMetricsPS.cpp, line 162

repeated a bunch of times (I see this on other, not-crashing pages too).  Then I
see:

###!!! ASSERTION: data loss - incomplete row needed more height than available,
on top of page: 'rowMetrics.height <= rowReflowState.availableHeight', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1088

repeated a couple times, then:

###!!! ASSERTION: bad geometric parent: 'IsChild(aPresContext, aNextInFlow)',
file /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5023
###!!! ASSERTION: can't find deleted frame in lines: 'line != line_end', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4886
###!!! ASSERTION: bad prevSibling: '!prevSibling ||
prevSibling->GetNextSibling() == aDeletedFrame', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4887

repeated a couple times (as a group of 3 assertions in that order), then a
couple of repetitions of "several 'data loss' assertions followed by several
repetitions of that group of three assertions", then the crash.  The stack is:

#0  0x41225372 in nsIFrame::GetNextSibling() const (this=0x0)
    at ../../../../dist/include/layout/nsIFrame.h:693
#1  0x4123122f in nsBlockFrame::SplitPlaceholder(nsIPresContext&, nsIFrame&) (
    this=0x89afea4, aPresContext=@0x8991778, aPlaceholder=@0x89b0120)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3920
#2  0x412860d1 in nsInlineFrame::ReflowInlineFrame(nsIPresContext*,
nsHTMLReflowState const&, nsInlineFrame::InlineReflowState&, nsIFrame*,
unsigned&) (this=0x89c349c, 
    aPresContext=0x8991778, aReflowState=@0xbfff6b74, irs=@0xbfff6a14,
aFrame=0x89b0120, 
    aStatus=@0xbfff6d24)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsInlineFrame.cpp:793
#3  0x412858ee in nsInlineFrame::ReflowFrames(nsIPresContext*, nsHTMLReflowState
const&, nsInlineFrame::InlineReflowState&, nsHTMLReflowMetrics&, unsigned&)
(this=0x89c349c, 
    aPresContext=0x8991778, aReflowState=@0xbfff6b74, irs=@0xbfff6a14, 
    aMetrics=@0xbfff6b24, aStatus=@0xbfff6d24)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsInlineFrame.cpp:540
#4  0x4128562d in nsInlineFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x89c349c, aPresContext=0x8991778,
aMetrics=@0xbfff6b24, 
    aReflowState=@0xbfff6b74, aStatus=@0xbfff6d24)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsInlineFrame.cpp:449
#5  0x4128c8b3 in nsLineLayout::ReflowFrame(nsIFrame*, unsigned&,
nsHTMLReflowMetrics*, int&) (this=0xbfff6e24, aFrame=0x89c349c,
aReflowStatus=@0xbfff6d24, aMetrics=0x0, 
    aPushedFrame=@0xbfff6d20)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsLineLayout.cpp:1019
#6  0x41230af7 in nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, nsIFrame*, unsigned char*) (this=0x89afea4,
aState=@0xbfff7734, 
    aLineLayout=@0xbfff6e24, aLine={mCurrent = 0x89c34d4, mListLink = 0x89afee0}, 
    aFrame=0x89c349c, aLineReflowStatus=0xbfff6da3 "")
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3704
#7  0x412306fb in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, int*, unsigned char*, int, int)
(this=0x89afea4, aState=@0xbfff7734, 
    aLineLayout=@0xbfff6e24, aLine={mCurrent = 0x89c34d4, mListLink = 0x89afee0}, 
    aKeepReflowGoing=0xbfff74dc, aLineReflowStatus=0xbfff72c3 "\002", 
    aUpdateMaximumWidth=0, aDamageDirtyArea=1)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3571
#8  0x412303cb in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState&,
nsLineList_iterator, int*, unsigned char*, int, int) (this=0x89afea4,
aState=@0xbfff7734, aLine=
      {mCurrent = 0x89c34d4, mListLink = 0x89afee0}, aKeepReflowGoing=0xbfff74dc, 
    aLineReflowStatus=0xbfff72c3 "\002", aUpdateMaximumWidth=0, aDamageDirtyArea=1)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3472
#9  0x4123019f in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, int*, int, int) (this=0x89afea4, aState=@0xbfff7734, aLine=
      {mCurrent = 0x89c34d4, mListLink = 0x89afee0}, aKeepReflowGoing=0xbfff74dc, 
    aDamageDirtyArea=1, aUpdateMaximumWidth=0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3416
#10 0x4122e397 in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x89afea4, aState=@0xbfff7734, aLine=
      {mCurrent = 0x89c34d4, mListLink = 0x89afee0}, aKeepReflowGoing=0xbfff74dc, 
    aDamageDirtyArea=1)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2533
#11 0x4122d40c in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x89afea4, 
    aState=@0xbfff7734)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2180
#12 0x4122a310 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x89afea4, aPresContext=0x8991778,
aMetrics=@0xbfff7c68, 
    aReflowState=@0xbfff7b54, aStatus=@0xbfff7b20)
    at /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:849
#13 0x4123c5e7 in nsBlockReflowContext::ReflowBlock(nsRect const&, int,
nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&)
(this=0xbfff7c24, aSpace=@0xbfff7b34, 
    aApplyTopMargin=1, aPrevBottomMargin=@0xbfff81a8, aIsAdjacentWithTop=0, 
    aComputedOffsets=@0xbfff7b44, aFrameRS=@0xbfff7b54,
aFrameReflowStatus=@0xbfff7b20)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockReflowContext.cpp:533
#14 0x4122f9bb in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, int*) (this=0x8a4e3f0, aState=@0xbfff8144, aLine=
      {mCurrent = 0x89a5f48, mListLink = 0x8a4e42c}, aKeepReflowGoing=0xbfff7eec)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3186
#15 0x4122de00 in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x8a4e3f0, aState=@0xbfff8144, aLine=
      {mCurrent = 0x89a5f48, mListLink = 0x8a4e42c}, aKeepReflowGoing=0xbfff7eec, 
    aDamageDirtyArea=1)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2397
#16 0x4122d40c in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x8a4e3f0, 
    aState=@0xbfff8144)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2180
#17 0x4122a310 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x8a4e3f0, aPresContext=0x8991778,
aMetrics=@0xbfff8564, 
    aReflowState=@0xbfff8494, aStatus=@0xbfff8710)
    at /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:849
#18 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e390, 
    aKidFrame=0x8a4e3f0, aPresContext=0x8991778, aDesiredSize=@0xbfff8564, 
    aReflowState=@0xbfff8494, aX=98, aY=98, aFlags=0, aStatus=@0xbfff8710)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#19 0x41370a19 in nsTableCellFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x8a4e390,
aPresContext=0x8991778, 
    aDesiredSize=@0xbfff8814, aReflowState=@0xbfff8714, aStatus=@0xbfff8710)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableCellFrame.cpp:903
#20 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e33c, 
    aKidFrame=0x8a4e390, aPresContext=0x8991778, aDesiredSize=@0xbfff8814, 
    aReflowState=@0xbfff8714, aX=0, aY=0, aFlags=0, aStatus=@0xbfff8710)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#21 0x41391d63 in nsTableRowFrame::ReflowChildren(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame&, unsigned&, int)
(this=0x8a4e33c, 
    aPresContext=0x8991778, aDesiredSize=@0xbfff8a44, aReflowState=@0xbfff8a94, 
    aTableFrame=@0x8a4e4cc, aStatus=@0xbfff96c0, aDirtyOnly=0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowFrame.cpp:1033
#22 0x41392e78 in nsTableRowFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x8a4e33c, aPresContext=0x8991778, 
    aDesiredSize=@0xbfff8a44, aReflowState=@0xbfff8a94, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowFrame.cpp:1441
#23 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e444, 
    aKidFrame=0x8a4e33c, aPresContext=0x8991778, aDesiredSize=@0xbfff8a44, 
    aReflowState=@0xbfff8a94, aX=0, aY=0, aFlags=3, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#24 0x413965bf in nsTableRowGroupFrame::SplitRowGroup(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame*, unsigned&)
(this=0x8a4e444, 
    aPresContext=0x8991778, aDesiredSize=@0xbfff8f24, aReflowState=@0xbfff8e64, 
    aTableFrame=0x8a4e4cc, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp:1075
#25 0x41396f8f in nsTableRowGroupFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x8a4e444,
aPresContext=0x8991778, 
    aDesiredSize=@0xbfff8f24, aReflowState=@0xbfff8e64, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp:1309
#26 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e4cc, 
    aKidFrame=0x8a4e444, aPresContext=0x8991778, aDesiredSize=@0xbfff8f24, 
    aReflowState=@0xbfff8e64, aX=0, aY=0, aFlags=0, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#27 0x4137bfed in nsTableFrame::ReflowChildren(nsIPresContext*,
nsTableReflowState&, int, int, unsigned&, nsIFrame*&, int*) (this=0x8a4e4cc,
aPresContext=0x8991778, 
    aReflowState=@0xbfff9034, aDoColGroups=1, aDirtyOnly=0, aStatus=@0xbfff96c0, 
    aLastChildReflowed=@0xbfff90f8, aReflowedAtLeastOne=0x0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableFrame.cpp:3235
#28 0x413797b0 in nsTableFrame::ReflowTable(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, nsReflowReason, nsIFrame*&,
int&, int&, unsigned&) (
    this=0x8a4e4cc, aPresContext=0x8991778, aDesiredSize=@0xbfff9404, 
    aReflowState=@0xbfff9224, aAvailHeight=13538, aReason=eReflowReason_Initial, 
    aLastChildReflowed=@0xbfff90f8, aDoCollapse=@0xbfff9134,
aDidBalance=@0xbfff912c, 
    aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableFrame.cpp:2182
#29 0x413791e6 in nsTableFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x8a4e4cc, aPresContext=0x8991778, 
    aDesiredSize=@0xbfff9404, aReflowState=@0xbfff9224, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableFrame.cpp:2042
#30 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e480, 
    aKidFrame=0x8a4e4cc, aPresContext=0x8991778, aDesiredSize=@0xbfff9404, 
    aReflowState=@0xbfff9224, aX=0, aY=0, aFlags=3, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#31 0x4138c6f3 in nsTableOuterFrame::OuterReflowChild(nsIPresContext*,
nsIFrame*, nsHTMLReflowState const&, nsHTMLReflowMetrics&, int, nsSize&,
nsMargin&, nsMargin&, nsMargin&, nsReflowReason, unsigned&) (this=0x8a4e480,
aPresContext=0x8991778, aChildFrame=0x8a4e4cc, 
    aOuterRS=@0xbfff96f4, aMetrics=@0xbfff9404, aAvailWidth=9940, 
    aDesiredSize=@0xbfff93c4, aMargin=@0xbfff93d4, aMarginNoAuto=@0xbfff93e4, 
    aPadding=@0xbfff93f4, aReflowReason=eReflowReason_Resize, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableOuterFrame.cpp:1318
#32 0x4138ea62 in nsTableOuterFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x8a4e480,
aPresContext=0x8991778, 
    aDesiredSize=@0xbfff9808, aOuterRS=@0xbfff96f4, aStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableOuterFrame.cpp:1991
#33 0x4123c5e7 in nsBlockReflowContext::ReflowBlock(nsRect const&, int,
nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&)
(this=0xbfff97c4, aSpace=@0xbfff96d4, 
    aApplyTopMargin=0, aPrevBottomMargin=@0xbfff9d48, aIsAdjacentWithTop=1, 
    aComputedOffsets=@0xbfff96e4, aFrameRS=@0xbfff96f4,
aFrameReflowStatus=@0xbfff96c0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockReflowContext.cpp:533
#34 0x4122f9bb in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, int*) (this=0x8a4e638, aState=@0xbfff9ce4, aLine=
      {mCurrent = 0x8a4e554, mListLink = 0x8a4e674}, aKeepReflowGoing=0xbfff9a8c)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3186
#35 0x4122de00 in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x8a4e638, aState=@0xbfff9ce4, aLine=
      {mCurrent = 0x8a4e554, mListLink = 0x8a4e674}, aKeepReflowGoing=0xbfff9a8c, 
    aDamageDirtyArea=1)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2397
#36 0x4122d40c in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x8a4e638, 
    aState=@0xbfff9ce4)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2180
#37 0x4122a310 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x8a4e638, aPresContext=0x8991778,
aMetrics=@0xbfffa104, 
    aReflowState=@0xbfffa034, aStatus=@0xbfffa2b0)
    at /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:849
#38 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e5d8, 
    aKidFrame=0x8a4e638, aPresContext=0x8991778, aDesiredSize=@0xbfffa104, 
    aReflowState=@0xbfffa034, aX=70, aY=70, aFlags=0, aStatus=@0xbfffa2b0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#39 0x41370a19 in nsTableCellFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x8a4e5d8,
aPresContext=0x8991778, 
    aDesiredSize=@0xbfffa3b4, aReflowState=@0xbfffa2b4, aStatus=@0xbfffa2b0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableCellFrame.cpp:903
#40 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e584, 
    aKidFrame=0x8a4e5d8, aPresContext=0x8991778, aDesiredSize=@0xbfffa3b4, 
    aReflowState=@0xbfffa2b4, aX=0, aY=0, aFlags=0, aStatus=@0xbfffa2b0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#41 0x41391d63 in nsTableRowFrame::ReflowChildren(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame&, unsigned&, int)
(this=0x8a4e584, 
    aPresContext=0x8991778, aDesiredSize=@0xbfffa5e4, aReflowState=@0xbfffa634, 
    aTableFrame=@0x8a4e714, aStatus=@0xbfffb260, aDirtyOnly=0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowFrame.cpp:1033
#42 0x41392e78 in nsTableRowFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x8a4e584, aPresContext=0x8991778, 
    aDesiredSize=@0xbfffa5e4, aReflowState=@0xbfffa634, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowFrame.cpp:1441
#43 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e68c, 
    aKidFrame=0x8a4e584, aPresContext=0x8991778, aDesiredSize=@0xbfffa5e4, 
    aReflowState=@0xbfffa634, aX=0, aY=0, aFlags=3, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#44 0x413965bf in nsTableRowGroupFrame::SplitRowGroup(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame*, unsigned&)
(this=0x8a4e68c, 
    aPresContext=0x8991778, aDesiredSize=@0xbfffaac4, aReflowState=@0xbfffaa04, 
    aTableFrame=0x8a4e714, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp:1075
#45 0x41396f8f in nsTableRowGroupFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x8a4e68c,
aPresContext=0x8991778, 
    aDesiredSize=@0xbfffaac4, aReflowState=@0xbfffaa04, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp:1309
#46 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e714, 
    aKidFrame=0x8a4e68c, aPresContext=0x8991778, aDesiredSize=@0xbfffaac4, 
    aReflowState=@0xbfffaa04, aX=0, aY=0, aFlags=0, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#47 0x4137bfed in nsTableFrame::ReflowChildren(nsIPresContext*,
nsTableReflowState&, int, int, unsigned&, nsIFrame*&, int*) (this=0x8a4e714,
aPresContext=0x8991778, 
    aReflowState=@0xbfffabd4, aDoColGroups=1, aDirtyOnly=0, aStatus=@0xbfffb260, 
    aLastChildReflowed=@0xbfffac98, aReflowedAtLeastOne=0x0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableFrame.cpp:3235
#48 0x413797b0 in nsTableFrame::ReflowTable(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, nsReflowReason, nsIFrame*&,
int&, int&, unsigned&) (
    this=0x8a4e714, aPresContext=0x8991778, aDesiredSize=@0xbfffafa4, 
    aReflowState=@0xbfffadc4, aAvailHeight=13678, aReason=eReflowReason_Initial, 
    aLastChildReflowed=@0xbfffac98, aDoCollapse=@0xbfffacd4,
aDidBalance=@0xbfffaccc, 
    aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableFrame.cpp:2182
#49 0x413791e6 in nsTableFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x8a4e714, aPresContext=0x8991778, 
    aDesiredSize=@0xbfffafa4, aReflowState=@0xbfffadc4, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableFrame.cpp:2042
#50 0x412474ce in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x8a4e6c8, 
    aKidFrame=0x8a4e714, aPresContext=0x8991778, aDesiredSize=@0xbfffafa4, 
    aReflowState=@0xbfffadc4, aX=0, aY=0, aFlags=3, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsContainerFrame.cpp:924
#51 0x4138c6f3 in nsTableOuterFrame::OuterReflowChild(nsIPresContext*,
nsIFrame*, nsHTMLReflowState const&, nsHTMLReflowMetrics&, int, nsSize&,
nsMargin&, nsMargin&, nsMargin&, nsReflowReason, unsigned&) (this=0x8a4e6c8,
aPresContext=0x8991778, aChildFrame=0x8a4e714, 
    aOuterRS=@0xbfffb294, aMetrics=@0xbfffafa4, aAvailWidth=10080, 
    aDesiredSize=@0xbfffaf64, aMargin=@0xbfffaf74, aMarginNoAuto=@0xbfffaf84, 
    aPadding=@0xbfffaf94, aReflowReason=eReflowReason_Initial, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableOuterFrame.cpp:1318
#52 0x4138ea62 in nsTableOuterFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x8a4e6c8,
aPresContext=0x8991778, 
    aDesiredSize=@0xbfffb3a8, aOuterRS=@0xbfffb294, aStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableOuterFrame.cpp:1991
#53 0x4123c5e7 in nsBlockReflowContext::ReflowBlock(nsRect const&, int,
nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&)
(this=0xbfffb364, aSpace=@0xbfffb274, 
    aApplyTopMargin=0, aPrevBottomMargin=@0xbfffb8e8, aIsAdjacentWithTop=1, 
    aComputedOffsets=@0xbfffb284, aFrameRS=@0xbfffb294,
aFrameReflowStatus=@0xbfffb260)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockReflowContext.cpp:533
#54 0x4122f9bb in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, int*) (this=0x8a4e7cc, aState=@0xbfffb884, aLine=
      {mCurrent = 0x8a4e79c, mListLink = 0x8a4e808}, aKeepReflowGoing=0xbfffb62c)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3186
#55 0x4122de00 in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x8a4e7cc, aState=@0xbfffb884, aLine=
      {mCurrent = 0x8a4e79c, mListLink = 0x8a4e808}, aKeepReflowGoing=0xbfffb62c, 
    aDamageDirtyArea=0)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:2397
#56 0x4122d40c in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x8a4e7cc, 

... and so forth for 50 more frames or so (so this is not stack overflow).

(gdb) frame 1
#1  0x4123122f in nsBlockFrame::SplitPlaceholder(nsIPresContext&, nsIFrame&) (
    this=0x89afea4, aPresContext=@0x8991778, aPlaceholder=@0x89b0120)
    at
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp:3920
3920      nsIFrame *next = contFrame->GetNextSibling();
(gdb) p contFrame
$1 = (nsIFrame *) 0x0

It looks like the problem is that the continuation stuff is not doing the right
thing somehow and the nextSibling of aPlaceholder ends up null...
OS: Windows 98 → All
Hardware: PC → All
This worked in mozilla1.2b and mozilla1.2.1 but crashed in mozilla1.3a.
Confirming using 2003082004/trunk/W2K -> TB22936606X
Same signature (nsIFrame::GetNextSibling) as Boris' crash has bug 185357.
Severity: major → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
Summary: //html-tags.info reliably crashes Mozilla 1.4 if printed → //html-tags.info reliably crashes Mozilla 1.4 if printed / print-previewed
regression between linux trunk 2002120309 and 2002120422, probably bug 127286
Keywords: regression
Depends on: 185357
Summary: //html-tags.info reliably crashes Mozilla 1.4 if printed / print-previewed → //html-tags.info reliably crashes Mozilla 1.4 if printed / print-previewed [@ nsIFrame::GetNextSibling]
Still crashes - Firefox 1.0:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

Talkback: TB3386585Y
Also still crashes latest Firefox trunk:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050129 Firefox/1.0+

Talkback TB3386825Y
a reduced testcase would be helpful http://www.mozilla.org/newlayout/bugathon.html
Attached file Testcase — 
This still crashes for me on print preview in a 20050324 trunk build.
this is a line layout problem, thats also the place where it crashes
Attached patch fix — — Splinter Review 
This is (now) a simple one. In DrainOverflowLines we search for the right
descendent block in which to insert a float continuation placeholder. When the
float was inside an inline that continues to the next page/column, as in this
testcase, the loop can actually identify the inline's next in flow as the
containing block for the continuation placeholder. Not a good idea. The loop
should skip frames that aren't actually blocks able to contain a float.
Assignee: printing → roc
Status: NEW → ASSIGNED
Attachment #180335 - Flags: superreview?(dbaron)
Attachment #180335 - Flags: review?(dbaron)
Attachment #180335 - Flags: superreview?(dbaron)
Attachment #180335 - Flags: superreview+
Attachment #180335 - Flags: review?(dbaron)
Attachment #180335 - Flags: review+
Comment on attachment 180335 [details] [diff] [review]
fix

simple fix to longstanding crasher bug.
Attachment #180335 - Flags: approval1.8b2?
Comment on attachment 180335 [details] [diff] [review]
fix

a=asa
Attachment #180335 - Flags: approval1.8b2? → approval1.8b2+
checked in
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsIFrame::GetNextSibling]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: