234414 - crash on print or print-preview of long table containing styled elements, page-break-before: always [@ nsSplittableFrame::RemoveFromFlow]

Status: RESOLVED WORKSFORME

(Core :: Printing: Output, defect)

Description

[Francesco Negri]

User-Agent:       
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040207 Firefox/0.8

if I click file-print preview, firefox crashes.

if I click file-print, then ok, a dialog appears for a couple of seconds
("preparing..."), then firefox crashes. nothing is sent to the printer.

Reproducible: Always
Steps to Reproduce:
1.browse to http://www.echoaudio.com/Products/Detailed_Product_Specifications.php
2.click file-print preview or file-print then ok


Actual Results:  
firefox crashed

Expected Results:  
print preview -> show the print preview
print -> send the page to the printer

using gtk2+xft binary build from mozilla.org, haven't tried the plain gtk build.

the crash is reproducible on my system with firefox 0.8, mozilla 1.4, galeon and
epiphany (slackware 9.1 default builds) so i guess it's not firefox-specific.
didn't know where else to report it, though.

Comment 1

[José Jeria]

Also crashing with Gecko/20040214 Firebird/0.8.0+, Windows XP.

Comment 2

[Lukas Petrovicky (CZilla)]

I can confirm this bug...
see it for yourself on http://dreamsign.cz/weblog/

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

Comment 3

[James Napolitano]

confirming this on Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040111.
That's win98se with the Mozilla Suite.  I am going to try to create a testcase.

Comment 4

[James Napolitano]

Attachment: testcase1

I reduced the webpage down to a table with one cell.  This cell contains
several paragraphs containing text as well as two <p><br></p>'s.  Mozilla will
crash as long as there are enough <p> tags to stretch the table onto more than
one page on print preview.  Also, Mozilla won't crash if you remove any of this
style information:

 p { margin-top: 0px; margin-bottom: 0px; }
br {page-break-before: always;} 

There is some other odd behavior that I've noted in comments in the testcase.

Comment 5

[James Napolitano]

In case this is useful at all, I've got the following information from the
(many) times this bug crashed Mozilla:

MOZILLA caused an invalid page fault in
module <unknown> at 0084:00000007.
Registers:
EAX=01e3d070 CS=0197 EIP=00000007 EFLGS=00010202
EBX=00eff210 SS=019f ESP=0066f064 EBP=0066f078
ECX=01e40780 DS=019f ESI=01e4512c FS=6c0f
EDX=012e5c80 ES=019f EDI=00eff210 GS=0000
Bytes at CS:EIP:
00 80 af 0e d6 65 04 70 00 65 04 70 00 54 ff 00 
Stack dump:
01136b60 01e3d000 00000000 01e4512c 01e3d000 0066f09c 01136ad4 00000000 01e4512c
011317c1 01e4512c 00eff210 00eff210 01e4512c 0066f0d8 0113739c 

When I chose 'Debug', Windows brings up MS Visual Studio, which sometimes gave
this message:
"Unhandled Exception in mozilla.exe: 0xC000001D: Illegal Instruction"
and points to this instruction in memory: "BFF768A0 int 3"

but usually this:
"Unhandled Exception in mozilla.exe: 0xC0000005: Access Violation"
and points to this instruction in memory: "01E36EAF add byte ptr [eax+eax].cl"

Comment 6

[James Napolitano]

(sorry for the bug spam)
I haven't found any dupes.
This bug should be changed to:
Product: Browser
Component: Printing
Status: New
Keywords: crash, testcase

Comment 7

[James Napolitano]

My TalkBack ID for this crash is TB30551784Z
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040219

Comment 8

[Adam Hauner]

TB30650063Y on 1.7a/W2K

Comment 9

[James Napolitano]

Attachment: talkback

Asa told me on IRC that, for the period in which we submitted them, the
talkbacks weren't being saved anywhere.  Fortunately I saved a copy of mine, so
here it is.

Comment 10

[James Napolitano]

On doing print previews with this bug, I have seen signs of bug 136714 (which
applies to page-break-before as well as page-break-after).  Perhaps we should
list it as a dependency.  If it were fixed, this crash might not occur.

Comment 11

[Andreas Kunz]

On XP I get no crash, but a "An unknown error occurred while printing" message
with a somewhat current debug build.

Comment 12

[Andreas Kunz]

Ugh! I get that message on _every_ page I try to print with that debug build, so
the crash might just be later, where this build doesn't get. Sorry.

Comment 13

[Jon Henry]

This is a hard stack to make, because (at least on my WinXP system) the testcase
asserts something like 50 times when you click Print Preview. The page in the
URL field asserted so many times I never even got to the print preview dialog to
find out if it crashed! I'm attaching two stack traces, one is the code that is
going assertion-crazy with a message about the height being "Not Reached", and
the other from when I actually got Firefox to crash.

Comment 14

[Jon Henry]

Attachment: Assertion stack trace

Comment 15

[Jon Henry]

Attachment: Stack trace from actual crash

Comment 16

[Wladimir Palant]

*** Bug 238427 has been marked as a duplicate of this bug. ***

Comment 17

[Asa Dotzler [:asa]]

from the talkback:
0x00000000
nsSplittableFrame::RemoveFromFlow[/mozilla/layout/html/base/src/nsSplittableFrame.cpp,
line 139]
nsSplittableFrame::Destroy[/mozilla/layout/html/base/src/nsSplittableFrame.cpp,
line 71]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 142]
nsBlockFrame::Destroy[/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 309]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsTableFrame::Destroy[/mozilla/layout/html/table/src/nsTableFrame.cpp, line 311]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsTableOuterFrame::Destroy[/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 83]
nsLineBox::DeleteLineList[/mozilla/layout/html/base/src/nsLineBox.cpp, line 303]
nsBlockFrame::Destroy[/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 303]
nsLineBox::DeleteLineList[/mozilla/layout/html/base/src/nsLineBox.cpp, line 303]
nsBlockFrame::Destroy[/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 303]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
ViewportFrame::Destroy[/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsBoxFrame::Destroy[/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1066]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
nsBoxFrame::Destroy[/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1066]
nsGfxScrollFrame::Destroy[/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 428]
nsFrameList::DestroyFrames[/mozilla/layout/base/src/nsFrameList.cpp, line 130]
nsContainerFrame::Destroy[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 137]
ViewportFrame::Destroy[/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
nsFrameManager::Destroy[/mozilla/layout/html/base/src/nsFrameManager.cpp, line 331]
PresShell::Destroy[/mozilla/layout/html/base/src/nsPresShell.cpp, line 1878]
nsPrintObject::DestroyPresentation[/mozilla/content/base/src/nsPrintObject.cpp,
line 110]
nsPrintEngine::SetupToPrintContent[/mozilla/content/base/src/nsPrintEngine.cpp,
line 2409]

Comment 18

[Gunnar Eikman]

Attachment: Testcase2: Html page which causes crash when being print-previewed

Comment 19

[Gunnar Eikman]

Comment on attachment 145918 [details]
Testcase2: Html page which causes crash when being print-previewed

Testcase 1 does NOT fail on my computer (Linux RedHat9), but this pages does,
very repeatably,

Comment 20

[James Napolitano]

Hmm... a print preview of testcase1 and the original URL no longer crashes with
1.7 rc 1.
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040421
Apparently this bug was fixed in some other bug.  Perhaps we should close this
bug then.

Gunnar, I can confirm that your testcase crashes Mozilla on print preview, but I
don't see what it has to do with this particular bug.  My talkback ID for that
crash was TB28084H, and by looking it up at http://talkback-public.mozilla.org,
I can see the stacktrace doesn't match the ones in this bug.  I'd recommend that
you open a new bug report and attach your testcase (and my stacktrace) there. 
(also see if you can simplify your testcase some more).  

Comment 21

[Andrew Schultz]

WORKSFORME with linux trunk and 1.7rc1 at URL and testcase

marking WORKSFORME

Comment 22

[James Napolitano]

(In reply to comment #18)
> Created an attachment (id=145918)
> Html page which causes crash when being print-previewed
> 

I created another bug report to investigate Gunnar's crasher.  See bug 244665.