234062 - crash on print preview of page with float:left and image over page break [@ nsContainerFrame::PaintChild ]

Status: RESOLVED WORKSFORME

(Core :: Printing: Output, defect)

Description

[Place Holder]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7a) Gecko/20040212

When I tried to print the attached HTML (from CNet) from Firefox it just
silently crashed and closed.  On repeated attempts it causes an invalid write to
location "0x00000020"...  I tried the latest nightly build of Mozilla, and it
just hangs and becomes unresposive so that I have to use task manager to kill it.

Reproducible: Always
Steps to Reproduce:
1. Drag the shortcut to the window and let it load the page
2. Select file print, change preferences to double side
3. Okay the print, watch it crash

Actual Results:  
The program hangs or crashes

Expected Results:  
A successful print job

In Firefox, I get this message:
 The instructiopn at "0x00635336" referenced memory at "0x00000020".  The memory
could not be "written". 
 [...Click OK, CANCEL...]

Comment 1

[Place Holder]

Attachment: The HTML that causes the crash

This is a zip that was saved from Firefox of the page before trying to print it
and experiencing the crash.

Comment 2

[Mats Palmgren (inactive)]

Confirming bug, 2004-02-12-08 trunk Linux

Comment 3

[WD]

Attachment: VS7 stack trace from Mozilla 1.6

The last two lines in nsBlockFrame::ReflowInlineFrames is:
      printf(": yikes! spinning on a line over 1000 times!\n");
      NS_ABORT();
And then the access violation occurs in nsDebugImpl::Abort
      long* __p = (long*) 0x7;
->    *__p = 0x7;

Comment 4

[James Napolitano]

Attachment: testcase

This is a simplified testcase that reliably crashes the Mozilla App Suite.  (As
I edited parts of the original page away, Mozilla would sometimes hang
instead).  The testcase is merely a DIV with style "float: left;" containing an
image that is split between two pages.	Load up the testcase, hit print
preview, scroll down, and *crash!*

Comment 5

[James Napolitano]

Changing summary to reflect problem.  Did not find any dupes of this bug.

Comment 6

[James "Dexter" Akula]

I'm using 1.6 on WinXP and I can't make the testcase crash my Mozilla.

Comment 7

[James Napolitano]

Reproduced this crash in Mozilla 1.7b (Win98se)
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040316
Talkback ID is TB4154G

Also, if anyone can't make the testcase crash, can you check as to whether the
original page crashes Mozilla for you?

Comment 8

[Adam Hauner]

Attachment: TB 4154 Stacktrace

Comment 9

[Mats Palmgren (inactive)]

The URL and testcase worksforme, tried both with Print and Print Preview.
Mozilla 2004-12-16-06 trunk Linux.

Comment 10

[Xanthor Sccas]

The URL still crashes my Moz 1.8a6 Linux with print preview :
"line 131: 29425 Erreur de segmentation  "$prog" ${1+"$@"}"

Comment 11

[Martijn Wargers (dead)]

Works for me in:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050323
Firefox/1.0+
The fix for bug 263825 should probably fix the crash. Xanthor, could you test
again with the latest nightly trunk build?

Comment 12

[Martijn Wargers (dead)]

I'm marking this WORKSFORME, if someone can still reproduce this in the latest
nightly trunk build, then please reopen.