215818 - browser crash when trying to print or print preview [@ nsLineBox::LastChild]

Status: RESOLVED DUPLICATE of bug 185357

(Core :: Printing: Output, defect)

Description

[Volker Westphal]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624

browser crashes with segfault every time i try to either print or print preview
the page with the url given above. Other pages from this website are printing
fine. The printer is a hp laserjet 4000N with the hp pcl driver.

Reproducible: Always

Steps to Reproduce:
1. goto the url
http://www.enterprisenetworkingmagazine.com/monthly/2003/02/welcher.shtml
2. press the print button or press Ctrl-P
3. see the segfault message :-)

Actual Results:  
Mozilla can be restarted without problems

Expected Results:  
Print the page or show the preview.

Only testet with this machine.

Comment 1

[Boris Zbarsky [:bzbarsky]]

###!!! ASSERTION: data loss - incomplete row needed more height than available,
on top of page: 'rowMetrics.height <= rowReflowState.availableHeight', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1088
###!!! ASSERTION: bad push: 'overBegin != begin_lines()', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4343
###!!! ASSERTION: running past end: 'mCurrent != mListLink', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsLineBox.h, line 546

(gdb) frame 1
#1  0x412885bc in nsLineBox::LastChild() const (this=0x8975624)
    at /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsLineBox.cpp:249
249         frame = frame->GetNextSibling();
(gdb) p frame
$1 = (class nsIFrame *) 0x0
(gdb) list
244     nsLineBox::LastChild() const
245     {
246       nsIFrame* frame = mFirstChild;
247       PRInt32 n = GetChildCount() - 1;
248       while (--n >= 0) {
249         frame = frame->GetNextSibling();
250       }
251       return frame;
252     }
253
(gdb) p n
$2 = 35186

So it looks like GetChildCount returns a bogus value...

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This broke between 1.4alpha and 1.4beta.

Comment 3

[chris hofmann]

don't see a crash on winxp current 1.5b candidates?  has to bug gone away?

Comment 4

[Andrew Schultz]

worksforme with linux trunk 20030818, 20030810 and 1.4
I'm guessing the URL changed.

Comment 5

[John Navas]

Attachment: Web page saved to computer as HTML complete

Saved version of webpage in ZIP archive that causes crash of Mozilla when Print
Preview is attempted in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5)
Gecko/20030916

Comment 6

[Kenneth Herron]

Reproduced on linux using cvs build 20031230. Partial stack trace:

Program received signal SIGSEGV, Segmentation fault.
0x40ee4434 in nsIFrame::GetNextSibling() const (this=0x0)
    at ../../../../dist/include/layout/nsIFrame.h:693
693     in ../../../../dist/include/layout/nsIFrame.h
(gdb) bt 20
#0  0x40ee4434 in nsIFrame::GetNextSibling() const (this=0x0)
    at ../../../../dist/include/layout/nsIFrame.h:693
#1  0x40f2a37d in nsLineBox::LastChild() const (this=0x0)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsLineBox.cpp:249
#2  0x40eedc9a in nsBlockFrame::PushLines(nsBlockReflowState&,
nsLineList_iterator) (
    this=0x88ea2ac, aState=@0xbfffb550, aLineBefore=
      {mCurrent = 0x88ea2e8, mListLink = 0x88ea2e8})
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:4265
#3  0x40eec4a4 in
nsBlockFrame::PushTruncatedPlaceholderLine(nsBlockReflowState&,
nsLineList_iterator, nsIFrame*, int&) (this=0x88ea2ac, aState=@0xbfffb550,
aLastPlaceholder=0x0,
    aKeepReflowGoing=@0x0)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3391
#4  0x40eec8d9 in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, int*, unsigned char*, int, int)
(this=0x88ea2ac, aState=@0xbfffb550,
    aLineLayout=@0xbfffac9c, aLine={mCurrent = 0x8918664, mListLink = 0x88ea2e8},
    aKeepReflowGoing=0xbfffb260, aLineReflowStatus=0x0, aUpdateMaximumWidth=0,
    aDamageDirtyArea=1)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3492
#5  0x40eec43c in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState&,
nsLineList_iterator, int*, unsigned char*, int, int) (this=0x88ea2ac,
aState=@0xbfffb550,
    aKeepReflowGoing=0xbfffb260, aLineReflowStatus=0xbfffb12b "\002(w7Axµÿ¿\001",
    aUpdateMaximumWidth=0, aDamageDirtyArea=1)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3370
#6  0x40eec2fd in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, int*, int, int) (this=0x88ea2ac, aState=@0xbfffb550,
aKeepReflowGoing=0xbfffb260,
    aDamageDirtyArea=1, aUpdateMaximumWidth=0)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:3314
#7  0x40eeaa8a in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x88ea2ac, aState=@0xbfffb550, aLine=
      {mCurrent = 0x8918664, mListLink = 0x88ea2e8}, aKeepReflowGoing=0xbfffb260,
    aDamageDirtyArea=1)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:2460
#8  0x40ee9da6 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x88ea2ac,
    aState=@0xbfffb550)
    at /home/kherron/cvs/mozilla/layout/html/base/src/nsBlockFrame.cpp:2106


Resolving as a dupe of bug 185357 based on the stack trace.

*** This bug has been marked as a duplicate of 185357 ***