Closed Bug 215818 Opened 19 years ago Closed 19 years ago

browser crash when trying to print or print preview [@ nsLineBox::LastChild]

Categories

(Core :: Printing: Output, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 185357

People

(Reporter: nvw, Unassigned)

References

()

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624

browser crashes with segfault every time i try to either print or print preview
the page with the url given above. Other pages from this website are printing
fine. The printer is a hp laserjet 4000N with the hp pcl driver.

Reproducible: Always

Steps to Reproduce:
1. goto the url
http://www.enterprisenetworkingmagazine.com/monthly/2003/02/welcher.shtml
2. press the print button or press Ctrl-P
3. see the segfault message :-)

Actual Results:  
Mozilla can be restarted without problems

Expected Results:  
Print the page or show the preview.

Only testet with this machine.
###!!! ASSERTION: data loss - incomplete row needed more height than available,
on top of page: 'rowMetrics.height <= rowReflowState.availableHeight', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1088
###!!! ASSERTION: bad push: 'overBegin != begin_lines()', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4343
###!!! ASSERTION: running past end: 'mCurrent != mListLink', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsLineBox.h, line 546

(gdb) frame 1
#1  0x412885bc in nsLineBox::LastChild() const (this=0x8975624)
    at /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsLineBox.cpp:249
249         frame = frame->GetNextSibling();
(gdb) p frame
$1 = (class nsIFrame *) 0x0
(gdb) list
244     nsLineBox::LastChild() const
245     {
246       nsIFrame* frame = mFirstChild;
247       PRInt32 n = GetChildCount() - 1;
248       while (--n >= 0) {
249         frame = frame->GetNextSibling();
250       }
251       return frame;
252     }
253
(gdb) p n
$2 = 35186

So it looks like GetChildCount returns a bogus value...
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
OS: Windows 2000 → All
Hardware: PC → All
Summary: browser crash when trying to print or print preview → browser crash when trying to print or print preview
Depends on: 215760
This broke between 1.4alpha and 1.4beta.
Keywords: regression
don't see a crash on winxp current 1.5b candidates?  has to bug gone away?
worksforme with linux trunk 20030818, 20030810 and 1.4
I'm guessing the URL changed.
Saved version of webpage in ZIP archive that causes crash of Mozilla when Print
Preview is attempted in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5)
Gecko/20030916
Summary: browser crash when trying to print or print preview → browser crash when trying to print or print preview [@ nsLineBox::LastChild]
Reproduced on linux using cvs build 20031230. Partial stack trace:

Program received signal SIGSEGV, Segmentation fault.
0x40ee4434 in nsIFrame::GetNextSibling() const (this=0x0)
    at ../../../../dist/include/layout/nsIFrame.h:693
693     in ../../../../dist/include/layout/nsIFrame.h
(gdb) bt 20
#0  0x40ee4434 in nsIFrame::GetNextSibling() const (this=0x0)
    at ../../../../dist/include/layout/nsIFrame.h:693
#1  0x40f2a37d in nsLineBox::LastChild() const (this=0x0)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsLineBox.cpp:249
#2  0x40eedc9a in nsBlockFrame::PushLines(nsBlockReflowState&,
nsLineList_iterator) (
    this=0x88ea2ac, aState=@0xbfffb550, aLineBefore=
      {mCurrent = 0x88ea2e8, mListLink = 0x88ea2e8})
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:4265
#3  0x40eec4a4 in
nsBlockFrame::PushTruncatedPlaceholderLine(nsBlockReflowState&,
nsLineList_iterator, nsIFrame*, int&) (this=0x88ea2ac, aState=@0xbfffb550,
aLastPlaceholder=0x0,
    aKeepReflowGoing=@0x0)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3391
#4  0x40eec8d9 in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, int*, unsigned char*, int, int)
(this=0x88ea2ac, aState=@0xbfffb550,
    aLineLayout=@0xbfffac9c, aLine={mCurrent = 0x8918664, mListLink = 0x88ea2e8},
    aKeepReflowGoing=0xbfffb260, aLineReflowStatus=0x0, aUpdateMaximumWidth=0,
    aDamageDirtyArea=1)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3492
#5  0x40eec43c in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState&,
nsLineList_iterator, int*, unsigned char*, int, int) (this=0x88ea2ac,
aState=@0xbfffb550,
    aKeepReflowGoing=0xbfffb260, aLineReflowStatus=0xbfffb12b "\002(w7Axµÿ¿\001",
    aUpdateMaximumWidth=0, aDamageDirtyArea=1)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3370
#6  0x40eec2fd in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, int*, int, int) (this=0x88ea2ac, aState=@0xbfffb550,
aKeepReflowGoing=0xbfffb260,
    aDamageDirtyArea=1, aUpdateMaximumWidth=0)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3314
#7  0x40eeaa8a in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x88ea2ac, aState=@0xbfffb550, aLine=
      {mCurrent = 0x8918664, mListLink = 0x88ea2e8}, aKeepReflowGoing=0xbfffb260,
    aDamageDirtyArea=1)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:2460
#8  0x40ee9da6 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x88ea2ac,
    aState=@0xbfffb550)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:2106


Resolving as a dupe of bug 185357 based on the stack trace.

*** This bug has been marked as a duplicate of 185357 ***
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsLineBox::LastChild]
You need to log in before you can comment on or make changes to this bug.