248825 - (ign) Crash with Print Preview on ign.com [@ nsBlockFrame::SplitPlaceholder][@ 0x00000000 - nsIView::Destroy]

Status: VERIFIED FIXED

(Core :: Layout: Images, Video, and HTML Frames, defect, P1)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: 2004-06-27-08, Windows XP trunk Seamonkey.

This is definitely NOT the same crash experienced originally in bug 185357.  I
have verified that the reduced testcase at
http://bugzilla.mozilla.org/attachment.cgi?id=151258&action=view NO LONGER crashes.

Steps to Reproduce:

1.  Load http://www.ign.com (get past the ad page)
2.  File | Print Preview

Actual Results:

Crashes here:

nsBlockFrame::SplitPlaceholder 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3768]
nsInlineFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 780]
nsInlineFrame::ReflowFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 443]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 990]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::ComputeFinalSize 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 1210]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 914]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5024]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 865]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1014]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5024]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 865]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1014]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3040]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2306]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5024]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 865]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1014]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3040]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2306]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3040]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2306]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]

Comment 1

[beanladen]

WFM Linux 1.8a1 Linux gcc 2.95.3 Linux 2.6.7 compiled. Windows only problem ?

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Alright, we'll need another reduced testcase that works on Linux :-)

Comment 3

[(not reading, please use [e-mail] instead)]

debugging this on win xp, against mozilla 1.7 branch.

first thing that happens is I hit an assert here:

in nsLayoutUtils::CompareTreePosition(), aContent1 and aContent2 are both null.

 	ntdll.dll!77f75a58() 	
 	xpcom.dll!nsDebugImpl::Break(const char * aFile=0x019deb18, int aLine=222) 
Line 356	C++
 	xpcom.dll!nsDebugImpl::Assertion(const char * aStr=0x019deb6c, const char *
aExpr=0x019deb60, const char * aFile=0x019deb18, int aLine=222)  Line 272	C++
 	xpcom.dll!nsDebug::Assertion(const char * aStr=0x019deb6c, const char *
aExpr=0x019deb60, const char * aFile=0x019deb18, int aLine=222)  Line 109	C++
>	gklayout.dll!nsLayoutUtils::CompareTreePosition(nsIContent *
aContent1=0x00000000, nsIContent * aContent2=0x00000000, nsIContent *
aCommonAncestor=0x0387d4b0)  Line 222 + 0x20	C++
 	gklayout.dll!nsLayoutUtils::FindSiblingViewFor(nsIView *
aParentView=0x04baff98, nsIFrame * aFrame=0x04c66d1c)  Line 323 + 0x21	C++
 	gklayout.dll!nsHTMLContainerFrame::CreateViewForFrame(nsIFrame *
aFrame=0x04c66d1c, nsIFrame * aContentParentFrame=0x00000000, int aForce=1) 
Line 559 + 0xd	C++
 	gklayout.dll!nsCSSFrameConstructor::ConstructPageFrame(nsIPresShell *
aPresShell=0x026418b8, nsIPresContext * aPresContext=0x0385cc50, nsIFrame *
aParentFrame=0x033adf64, nsIFrame * aPrevPageFrame=0x04ba6358, nsIFrame * &
aPageFrame=0x04c66d1c, nsIFrame * & aPageContentFrame=0x00000000)  Line 3940 +
0xf	C++
 	gklayout.dll!nsCSSFrameConstructor::CreateContinuingFrame(nsIPresContext *
aPresContext=0x0385cc50, nsIFrame * aFrame=0x04ba6358, nsIFrame *
aParentFrame=0x033adf64, nsIFrame * * aContinuingFrame=0x0012da80)  Line 10697
+ 0x26	C++
 
gklayout.dll!nsSimplePageSequenceFrame::CreateContinuingPageFrame(nsIPresContext
* aPresContext=0x0385cc50, nsIFrame * aPageFrame=0x04ba6358, nsIFrame * *
aContinuingPage=0x0012da80)  Line 203	C++
 	gklayout.dll!nsSimplePageSequenceFrame::Reflow(nsIPresContext *
aPresContext=0x0385cc50, nsHTMLReflowMetrics & aDesiredSize={...}, const
nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 461	C++
 	gklayout.dll!nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & aState={...},
nsIPresContext * aPresContext=0x0385cc50, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int &
aStatus=0, int aX=0, int aY=0, int aWidth=11520, int aHeight=15077, int
aMoveFrame=1)  Line 880	C++
 	gklayout.dll!nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState & aState={...}) 
Line 626 + 0x2e	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsScrollBoxFrame::DoLayout(nsBoxLayoutState & aState={...}) 
Line 337	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsContainerBox::LayoutChildAt(nsBoxLayoutState & aState={...},
nsIBox * aBox=0x033ae278, const nsRect & aRect={...})  Line 650 + 0x10	C++
 	gklayout.dll!nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & aState={...},
nsIBox * aBox=0x033ae278, const nsRect & aRect={...})  Line 1256 + 0x11	C++
 	gklayout.dll!nsGfxScrollFrameInner::Layout(nsBoxLayoutState & aState={...})
 Line 1412	C++
 	gklayout.dll!nsGfxScrollFrame::DoLayout(nsBoxLayoutState & aState={...})  Line
1264 + 0xf	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsBoxFrame::Reflow(nsIPresContext * aPresContext=0x0385cc50,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 868	C++
 	gklayout.dll!nsGfxScrollFrame::Reflow(nsIPresContext *
aPresContext=0x0385cc50, nsHTMLReflowMetrics & aDesiredSize={...}, const
nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 864 +
0x19	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x033ae130,
nsIPresContext * aPresContext=0x0385cc50, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int
aY=0, unsigned int aFlags=0, unsigned int & aStatus=0)  Line 967 + 0x1f	C++
 	gklayout.dll!ViewportFrame::Reflow(nsIPresContext * aPresContext=0x0385cc50,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 248 + 0x2b	C++
 	gklayout.dll!PresShell::InitialReflow(int aWidth=11520, int aHeight=15077) 
Line 2827	C++
 	gklayout.dll!nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO=0x03a93930,
int aDoCalcShrink=1)  Line 2795 + 0x2b	C++
 	gklayout.dll!nsPrintEngine::ReflowDocList(nsPrintObject * aPO=0x03a93930, int
aSetPixelScale=0, int aDoCalcShrink=1)  Line 2553 + 0x10	C++
 	gklayout.dll!nsPrintEngine::SetupToPrintContent(nsIDeviceContext *
aDContext=0x035ef748, nsIDOMWindow * aCurrentFocusedDOMWin=0x00000000)  Line
2362 + 0x20	C++
 	gklayout.dll!nsPrintEngine::DocumentReadyForPrinting()  Line 2177 + 0x26	C++
 	gklayout.dll!nsPrintEngine::FinishPrintPreview()  Line 4474 + 0x8	C++
 	gklayout.dll!nsPrintEngine::PrintPreview(nsIPrintSettings *
aPrintSettings=0x038eae70, nsIDOMWindow * aChildDOMWin=0x00000000,
nsIWebProgressListener * aWebProgressListener=0x0385aae4)  Line 1258 + 0x8	C++
 	gklayout.dll!DocumentViewerImpl::PrintPreview(nsIPrintSettings *
aPrintSettings=0x038eae70, nsIDOMWindow * aChildDOMWin=0x00000000,
nsIWebProgressListener * aWebProgressListener=0x0385aae4)  Line 3177 + 0x1e	C++
 	xpcom.dll!XPTC_InvokeByIndex(nsISupports * that=0x03879308, unsigned int
methodIndex=14, unsigned int paramCount=3, nsXPTCVariant * params=0x0012ed78)
 Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...},
XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2028 + 0x1e	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x0256ddf0, JSObject *
obj=0x036dc3d0, unsigned int argc=3, long * argv=0x02744100, long *
vp=0x0012f04c)  Line 1287 + 0xe	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x0256ddf0, unsigned int argc=3, unsigned
int flags=0)  Line 941 + 0x20	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0256ddf0, long * result=0x0012f9c4) 
Line 2972 + 0xf	C
 	js3250.dll!js_Invoke(JSContext * cx=0x0256ddf0, unsigned int argc=1, unsigned
int flags=2)  Line 958 + 0xd	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x0256ddf0, JSObject *
obj=0x009dc5e8, long fval=51144992, unsigned int flags=0, unsigned int argc=1,
long * argv=0x03aa5bc0, long * rval=0x0012fb58)  Line 1035 + 0x14	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x0256ddf0, JSObject *
obj=0x009dc5e8, long fval=51144992, unsigned int argc=1, long * argv=0x03aa5bc0,
long * rval=0x0012fb58)  Line 3607 + 0x1f	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * aTarget=0x009dc5e8,
JSObject * aHandler=0x030c6920, unsigned int argc=1, long * argv=0x03aa5bc0,
long * rval=0x0012fb58)  Line 1297 + 0x21	C++
 	gklayout.dll!GlobalWindowImpl::RunTimeout(nsTimeoutImpl * aTimeout=0x03aa18f8)
 Line 5177	C++
 	gklayout.dll!GlobalWindowImpl::TimerCallback(nsITimer * aTimer=0x0361d5a8,
void * aClosure=0x03aa18f8)  Line 5537	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 382 + 0x11	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 616	C++
 	gkwidget.dll!nsAppShell::Run()  Line 142	C++
 	appshell.dll!nsAppShellService::Run()  Line 524	C++
 	mozilla.exe!main1(int argc=2, char * * argv=0x002a5778, nsISupports *
nativeApp=0x009d25c0)  Line 1303 + 0x20	C++
 	mozilla.exe!main(int argc=2, char * * argv=0x002a5778)  Line 1780 + 0x25	C++
 	mozilla.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!77e814c7() 	

Comment 4

[(not reading, please use [e-mail] instead)]

hmm, but if I continue on, I don't crash.

Comment 5

[(not reading, please use [e-mail] instead)]

one interesting thing:  that page has a some flash content in the middle, and
when I print preview, it doesn't show up (which is probably how it is supposed
to work)

I'll attach the screen shots (browser and print preview)

maybe that is related?

note, I get lots of asserts (I'll attach my console output)

Comment 6

[(not reading, please use [e-mail] instead)]

Attachment: browser screen shot (with flash)

Comment 7

[(not reading, please use [e-mail] instead)]

Attachment: print preview screen shot, no flash

Comment 8

[(not reading, please use [e-mail] instead)]

Attachment: console output, with lots of asserts (but no crash)

Comment 9

[(not reading, please use [e-mail] instead)]

I was testing with 1.7, and hammer reported this on the trunk (2004-06-27).

I'll update and rebuild the trunk and see if I crash there.

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

You definitely want to do this on trunk, because only the trunk contains the fix
I just checked in for the first crasher bug on this page :-).

Comment 11

[(not reading, please use [e-mail] instead)]

> You definitely want to do this on trunk

thanks for clarifying.

I'm rebuilding (in mozilla/xpcom now...) and I'll report back.

Comment 12

[(not reading, please use [e-mail] instead)]

hmm, no crash on debug trunk "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8a2) Gecko/20040628" on windows xp

I still get lots of asserts:

could it be possible that we have some debug code that prevents the crash (by
asserting and returning) but in opt, we continue on and crash?

Document http://www.ign.com/ loaded successfully
++WEBSHELL == 5
++DOMWINDOW == 5
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: Out of flow frame doesn't have the expected parent: 'outOfFlow
Frame->GetParent() == aBlockParent', file c:/mozilla/trees/trunk/mozilla/layout/
html/base/src/nsBlockFrame.cpp, line 6475
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
WARNING: getting z level of unregistered window, file c:/mozilla/trees/trunk/moz
illa/xpfe/appshell/src/nsWindowMediator.cpp, line 636
WARNING: getting z level of unregistered window, file c:/mozilla/trees/trunk/moz
illa/xpfe/appshell/src/nsWindowMediator.cpp, line 636

Comment 13

[Nobu Nari]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040628 Firefox/0.8.0+

Print previewing ign.com does not crash firefox-2004-06-28-trunk on Win98SE, 
but gives wrong layout.

Comment 14

[Nobu Nari]

Attachment: ScreenShot of print preview (png file)

ScreenShot of print preview window in firefox-2004-06-28-trunk on Win98SE shows
wrong layout.

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

This bug is not about wrong layout, it's about a crash.  Please limit your
comments to reduced testcases on Linux or Win32.

Comment 16

[Ferdinand]

Attachment: Reduced testcase

This testcase crashes reliably on linux for me when opening print preview.
(Today's trunk)
I haven't commented it, and it can almost certainly be reduced further, but
it's quite a bit more manageable than the original.

Comment 17

[timeless]

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=314269

Comment 18

[OstGote!]

Hit the bug ... TB341806Y, TB341701G
http://www.oop-trainer.de/Themen/Singleton.html
Crash after printing (without print preview) or closing the print preview.

0x00000000
nsIView::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 253]
nsFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 644]
nsSplittableFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsSplittableFrame.cpp,
line 72]
...

Comment 19

[Jay Patel [:jay]]

This might be related to bug 230417...maybe something there can be of some help?

Comment 20

[Jay Patel [:jay]]

This looks a lot like another print preview bug we had a while back...see my
previous comment.  Marking topcrash+ since it's still a topcrasher.

Comment 21

[Ferdinand]

Attachment: testcase (new & improved)

I've created a testcase from the site mentioned in comment #18. It's much
smaller and much cleaner. It crashes when print preview is closed.
Tested with today's trunk.

Comment 22

[Ferdinand]

Attachment: a bit smaller

Comment 23

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

###!!! ASSERTION: aContent1 must not be null: 'aContent1', file
d:/cvs-1.11.5/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227  

###!!! ASSERTION: aContent2 must not be null: 'aContent2', file
d:/cvs-1.11.5/mozilla/layout/base/src/nsLayoutUtils.cpp, line 228 

When print previewing the testcase (doesn't happen when it loads in the browser,
only when I choose print preview).

Comment 24

[Robert O'Callahan (:roc) (email my personal email if necessary)]

With the code I checked in yesterday, we now get an assertion noting that a
float is not being properly reparented. In fact I think I actually have a fix
for this bug in my columns work.

Comment 25

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Okay, my columns patches don't fix this, but it should be fairly easy to fix now.

Comment 26

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Okay, I have a fix at last. I could not have done it without the testcase;
Ferdinand, whoever you are, thank you very very much.

The problem is that the code for pushing an overflow placeholder onto the start
of the overflow lines was completely bogus. First problem: it appended the new
line box to the wrong line list. Second problem: it failed to set the next
sibling of the last overflow placeholder to the first frame of the overflow
lines if the first overflow line was a block. The fix is therefore quite easy.

Comment 27

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I should say:

The problem is that the code for pushing an overflow placeholder onto the start
of the overflow lines if the first overflow line is a block was completely
bogus. First problem: it appended the new line box to the wrong line list.
Second problem: it failed to set the next sibling of the last overflow
placeholder to the first frame of the overflow lines. The fix is therefore quite
easy.

Comment 28

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 159061 [details] [diff] [review]
fix

Simple fix for a very annoying, and very hard to track down, crasher

Comment 29

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Comment on attachment 159061 [details] [diff] [review]
fix

r+sr=dbaron.  I still think the whole design of the float splitting code is
wrong, but this seems fine.

Comment 30

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in. If ign.com still has problems for you then please open a new bug.

BTW David, now that I understand the overflow placeholder stuff, I think the
design is OK.

Comment 31

[Stephen Donner [:stephend] Not actively reading bugmail]

The minimized testcase at
https://bugzilla.mozilla.org/attachment.cgi?id=158491&action=view is verified to
work with the latest build 2004-09-22 on Windows XP Seamonkey trunk.

Caveat:  IGN.com still crashes during Print Preview, but that'll need to be
another bug, per roc's request.  As soon as I get a stack trace for the current
IGN.com crasher (it may have changed since this fix landed), I'll file a new bug.

I'll also note this bug # when I do file, for convenience.

Comment 32

[Stephen Donner [:stephend] Not actively reading bugmail]

I just filed bug 262403, due to its new crash stack trace in
nsBlockFrame::DrainOverflowLines.  Minimal testcases welcome (and desired) in
that bug.

Comment 33

[Asa Dotzler [:asa]]

roc, dbaron, is this something that should land for 1.7.x and aviary, or is it
too risky at this late stage in the game?

Comment 34

[Robert O'Callahan (:roc) (email my personal email if necessary)]

It's not even completely fixed yet. I would not take this for Aviary.

Comment 35

[Asa Dotzler [:asa]]

OK, since this didn't completely fix ign.com, minusing for 1.0. If we do finish
the fix, we can revisit the issue. Thanks.

Comment 36

[Jay Patel [:jay]]

*** Bug 255075 has been marked as a duplicate of this bug. ***

Comment 37

[Jay Patel [:jay]]

*** Bug 251943 has been marked as a duplicate of this bug. ***