Closed Bug 229184 Opened 21 years ago Closed 21 years ago

MozIlla crashes when printing web page [@ nsIFrame::GetNextSibling ]

Categories

(Core :: Layout, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 185357

People

(Reporter: throop, Unassigned)

References

()

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6b) Gecko/20031210
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6b) Gecko/20031210

Mozilla crashes every time when printing this normal-looking web page.  Page has
a few flash ads which play fine.

Reproducible: Always

Steps to Reproduce:
1. Visit URL
2. Hit Print, and print to either file or printer
3. 

Actual Results:  
Mozilla crashes every time.

Talkback (on 1.5) catches the crash but then talkback hangs.  The bug crashes
mozilla on 1.6b also.

Expected Results:  
Print w/o crashing.
Keywords: crash
WFM printing to a file with a 20031220 Linux CVS build.
I just tried using the 20031220 nightly and get the same crash.  This happens on
two different systems, both running RH9.

The newest talkback-enabled Linux build I could find on the download page was
1.5rc2.  I get the same crash on this.  The TB ID is 27805360Y.  Talkback itself
hangs on this crash, but it appears to have sent the report successfully.
Top of stack:

#6  nsIFrame::GetNextSibling (this=0x0) at
../../../../dist/include/layout/nsIFrame.h:693
#7  0x4039d84c in nsLineBox::LastChild (this=0x89dcab0) at nsLineBox.cpp:249
#8  0x4035741f in nsBlockFrame::PushLines (this=0x89dca74, aState=@0xbfff6074,
aLineBefore=
      {mCurrent = 0x89dcab0, mListLink = 0x89dcab0}) at nsBlockFrame.cpp:4273
#9  0x40355128 in nsBlockFrame::PushTruncatedPlaceholderLine (this=0x89dca74,
aState=@0xbfff6074, aLine=
      {mCurrent = 0x83d2560, mListLink = 0x89dcab0}, aLastPlaceholder=0x0,
aKeepReflowGoing=@0xbfff5e08)
    at nsBlockFrame.cpp:3399
#10 0x40356f8d in nsBlockFrame::PlaceLine (this=0x89dca74, aState=@0xbfff6074,
aLineLayout=@0xbfff5780, aLine=
      {mCurrent = 0x83d2560, mListLink = 0x89dcab0},
aKeepReflowGoing=0xbfff5e08, aUpdateMaximumWidth=0)
    at nsBlockFrame.cpp:4148
#11 0x403557a1 in nsBlockFrame::DoReflowInlineFrames (this=0x89dca74,
aState=@0xbfff6074, aLineLayout=@0xbfff5780, aLine=
      {mCurrent = 0x83d2560, mListLink = 0x89dcab0},
aKeepReflowGoing=0xbfff5e08, aLineReflowStatus=0xbfff5c17 "\002",
    aUpdateMaximumWidth=0, aDamageDirtyArea=1) at nsBlockFrame.cpp:3564
#12 0x4035507f in nsBlockFrame::DoReflowInlineFramesAuto (this=0x89dca74,
aState=@0xbfff6074, aLine=
      {mCurrent = 0x83d2560, mListLink = 0x89dcab0},
aKeepReflowGoing=0xbfff5e08, aLineReflowStatus=0xbfff5c17 "\002",
    aUpdateMaximumWidth=0, aDamageDirtyArea=1) at nsBlockFrame.cpp:3378
#13 0x40354e42 in nsBlockFrame::ReflowInlineFrames (this=0x89dca74,
aState=@0xbfff6074, aLine=
      {mCurrent = 0x83d2560, mListLink = 0x89dcab0},
aKeepReflowGoing=0xbfff5e08, aDamageDirtyArea=1, aUpdateMaximumWidth=0)
    at nsBlockFrame.cpp:3324
#14 0x40352cb7 in nsBlockFrame::ReflowLine (this=0x89dca74, aState=@0xbfff6074,
aLine=
      {mCurrent = 0x83d2560, mListLink = 0x89dcab0},
aKeepReflowGoing=0xbfff5e08, aDamageDirtyArea=1) at nsBlockFrame.cpp:2461
#15 0x40351c46 in nsBlockFrame::ReflowDirtyLines (this=0x89dca74,
aState=@0xbfff6074) at nsBlockFrame.cpp:2107
#16 0x4034e6e3 in nsBlockFrame::Reflow (this=0x89dca74, aPresContext=0x876ac38,
aMetrics=@0xbfff65c0,

[...]

(gdb) frame 7
#7  0x4039d84c in nsLineBox::LastChild (this=0x89dcab0) at nsLineBox.cpp:249
249         frame = frame->GetNextSibling();
Current language:  auto; currently c++
(gdb) list
244     nsLineBox::LastChild() const
245     {
246       nsIFrame* frame = mFirstChild;
247       PRInt32 n = GetChildCount() - 1;
248       while (--n >= 0) {
249         frame = frame->GetNextSibling();
250       }
251       return frame;
252     }
253
(gdb) p frame
$1 = (nsIFrame *) 0x0
(gdb) p n
$2 = 265073
(gdb) p *this
$3 = {<nsLineLink> = {_mNext = 0x89dcab0, _mPrev = 0x89dcab0}, mFirstChild =
0x8770420, mBounds = {x = 0, y = 0,
    width = 1085569472, height = 0}, mMaxElementWidth = 0, mMaximumWidth = 0,
mAscent = 105, {mAllFlags = 1085756224,
    mFlags = {mDirty = 0, mPreviousMarginDirty = 0, mBlock = 0, mImpactedByFloat
= 0, mHasPercentageChild = 0,
      mLineWrapped = 0, mForceInvalidate = 1, mResizeReflowOptimizationDisabled
= 0, mBreakType = 3, mChildCount = 265077}}, {
    mData = 0x834b0f8, mBlockData = 0x834b0f8, mInlineData = 0x834b0f8}}
(gdb)
Status: UNCONFIRMED → NEW
Depends on: 212315
Ever confirmed: true
Summary: MozIlla crashes when printing web page → MozIlla crashes when printing web page [@ nsIFrame::GetNextSibling ]
*** Bug 227453 has been marked as a duplicate of this bug. ***
--> layout based on the stack trace.
Assignee: core.printing → nobody
Component: Printing → Layout
QA Contact: core.layout
Actually, this looks like a dupe of bug 185357.

*** This bug has been marked as a duplicate of 185357 ***
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsIFrame::GetNextSibling ]
You need to log in before you can comment on or make changes to this bug.