Closed Bug 248825 (ign) Opened 20 years ago Closed 20 years ago

Crash with Print Preview on ign.com [@ nsBlockFrame::SplitPlaceholder][@ 0x00000000 - nsIView::Destroy]

Categories

(Core :: Layout: Images, Video, and HTML Frames, defect, P1)

x86
Windows XP
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: stephend, Assigned: roc)

References

()

Details

(Keywords: crash, testcase, topcrash+)

Crash Data

Attachments

(6 files, 2 obsolete files)

Build ID: 2004-06-27-08, Windows XP trunk Seamonkey.

This is definitely NOT the same crash experienced originally in bug 185357.  I
have verified that the reduced testcase at
http://bugzilla.mozilla.org/attachment.cgi?id=151258&action=view NO LONGER crashes.

Steps to Reproduce:

1.  Load http://www.ign.com (get past the ad page)
2.  File | Print Preview

Actual Results:

Crashes here:

nsBlockFrame::SplitPlaceholder 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3768]
nsInlineFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 780]
nsInlineFrame::ReflowFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 443]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 990]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::ComputeFinalSize 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 1210]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 914]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5024]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 865]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1014]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5024]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 865]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1014]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3040]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2306]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5024]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 865]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1014]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3587]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3415]
nsBlockFrame::DoReflowInlineFramesAuto 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3316]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3261]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2428]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3040]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2306]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3040]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2306]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2087]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 815]
WFM Linux 1.8a1 Linux gcc 2.95.3 Linux 2.6.7 compiled. Windows only problem ?
Alright, we'll need another reduced testcase that works on Linux :-)
debugging this on win xp, against mozilla 1.7 branch.

first thing that happens is I hit an assert here:

in nsLayoutUtils::CompareTreePosition(), aContent1 and aContent2 are both null.

 	ntdll.dll!77f75a58() 	
 	xpcom.dll!nsDebugImpl::Break(const char * aFile=0x019deb18, int aLine=222) 
Line 356	C++
 	xpcom.dll!nsDebugImpl::Assertion(const char * aStr=0x019deb6c, const char *
aExpr=0x019deb60, const char * aFile=0x019deb18, int aLine=222)  Line 272	C++
 	xpcom.dll!nsDebug::Assertion(const char * aStr=0x019deb6c, const char *
aExpr=0x019deb60, const char * aFile=0x019deb18, int aLine=222)  Line 109	C++
>	gklayout.dll!nsLayoutUtils::CompareTreePosition(nsIContent *
aContent1=0x00000000, nsIContent * aContent2=0x00000000, nsIContent *
aCommonAncestor=0x0387d4b0)  Line 222 + 0x20	C++
 	gklayout.dll!nsLayoutUtils::FindSiblingViewFor(nsIView *
aParentView=0x04baff98, nsIFrame * aFrame=0x04c66d1c)  Line 323 + 0x21	C++
 	gklayout.dll!nsHTMLContainerFrame::CreateViewForFrame(nsIFrame *
aFrame=0x04c66d1c, nsIFrame * aContentParentFrame=0x00000000, int aForce=1) 
Line 559 + 0xd	C++
 	gklayout.dll!nsCSSFrameConstructor::ConstructPageFrame(nsIPresShell *
aPresShell=0x026418b8, nsIPresContext * aPresContext=0x0385cc50, nsIFrame *
aParentFrame=0x033adf64, nsIFrame * aPrevPageFrame=0x04ba6358, nsIFrame * &
aPageFrame=0x04c66d1c, nsIFrame * & aPageContentFrame=0x00000000)  Line 3940 +
0xf	C++
 	gklayout.dll!nsCSSFrameConstructor::CreateContinuingFrame(nsIPresContext *
aPresContext=0x0385cc50, nsIFrame * aFrame=0x04ba6358, nsIFrame *
aParentFrame=0x033adf64, nsIFrame * * aContinuingFrame=0x0012da80)  Line 10697
+ 0x26	C++
 
gklayout.dll!nsSimplePageSequenceFrame::CreateContinuingPageFrame(nsIPresContext
* aPresContext=0x0385cc50, nsIFrame * aPageFrame=0x04ba6358, nsIFrame * *
aContinuingPage=0x0012da80)  Line 203	C++
 	gklayout.dll!nsSimplePageSequenceFrame::Reflow(nsIPresContext *
aPresContext=0x0385cc50, nsHTMLReflowMetrics & aDesiredSize={...}, const
nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 461	C++
 	gklayout.dll!nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & aState={...},
nsIPresContext * aPresContext=0x0385cc50, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int &
aStatus=0, int aX=0, int aY=0, int aWidth=11520, int aHeight=15077, int
aMoveFrame=1)  Line 880	C++
 	gklayout.dll!nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState & aState={...}) 
Line 626 + 0x2e	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsScrollBoxFrame::DoLayout(nsBoxLayoutState & aState={...}) 
Line 337	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsContainerBox::LayoutChildAt(nsBoxLayoutState & aState={...},
nsIBox * aBox=0x033ae278, const nsRect & aRect={...})  Line 650 + 0x10	C++
 	gklayout.dll!nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & aState={...},
nsIBox * aBox=0x033ae278, const nsRect & aRect={...})  Line 1256 + 0x11	C++
 	gklayout.dll!nsGfxScrollFrameInner::Layout(nsBoxLayoutState & aState={...})
 Line 1412	C++
 	gklayout.dll!nsGfxScrollFrame::DoLayout(nsBoxLayoutState & aState={...})  Line
1264 + 0xf	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsBoxFrame::Reflow(nsIPresContext * aPresContext=0x0385cc50,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 868	C++
 	gklayout.dll!nsGfxScrollFrame::Reflow(nsIPresContext *
aPresContext=0x0385cc50, nsHTMLReflowMetrics & aDesiredSize={...}, const
nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 864 +
0x19	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x033ae130,
nsIPresContext * aPresContext=0x0385cc50, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int
aY=0, unsigned int aFlags=0, unsigned int & aStatus=0)  Line 967 + 0x1f	C++
 	gklayout.dll!ViewportFrame::Reflow(nsIPresContext * aPresContext=0x0385cc50,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 248 + 0x2b	C++
 	gklayout.dll!PresShell::InitialReflow(int aWidth=11520, int aHeight=15077) 
Line 2827	C++
 	gklayout.dll!nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO=0x03a93930,
int aDoCalcShrink=1)  Line 2795 + 0x2b	C++
 	gklayout.dll!nsPrintEngine::ReflowDocList(nsPrintObject * aPO=0x03a93930, int
aSetPixelScale=0, int aDoCalcShrink=1)  Line 2553 + 0x10	C++
 	gklayout.dll!nsPrintEngine::SetupToPrintContent(nsIDeviceContext *
aDContext=0x035ef748, nsIDOMWindow * aCurrentFocusedDOMWin=0x00000000)  Line
2362 + 0x20	C++
 	gklayout.dll!nsPrintEngine::DocumentReadyForPrinting()  Line 2177 + 0x26	C++
 	gklayout.dll!nsPrintEngine::FinishPrintPreview()  Line 4474 + 0x8	C++
 	gklayout.dll!nsPrintEngine::PrintPreview(nsIPrintSettings *
aPrintSettings=0x038eae70, nsIDOMWindow * aChildDOMWin=0x00000000,
nsIWebProgressListener * aWebProgressListener=0x0385aae4)  Line 1258 + 0x8	C++
 	gklayout.dll!DocumentViewerImpl::PrintPreview(nsIPrintSettings *
aPrintSettings=0x038eae70, nsIDOMWindow * aChildDOMWin=0x00000000,
nsIWebProgressListener * aWebProgressListener=0x0385aae4)  Line 3177 + 0x1e	C++
 	xpcom.dll!XPTC_InvokeByIndex(nsISupports * that=0x03879308, unsigned int
methodIndex=14, unsigned int paramCount=3, nsXPTCVariant * params=0x0012ed78)
 Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...},
XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2028 + 0x1e	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x0256ddf0, JSObject *
obj=0x036dc3d0, unsigned int argc=3, long * argv=0x02744100, long *
vp=0x0012f04c)  Line 1287 + 0xe	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x0256ddf0, unsigned int argc=3, unsigned
int flags=0)  Line 941 + 0x20	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0256ddf0, long * result=0x0012f9c4) 
Line 2972 + 0xf	C
 	js3250.dll!js_Invoke(JSContext * cx=0x0256ddf0, unsigned int argc=1, unsigned
int flags=2)  Line 958 + 0xd	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x0256ddf0, JSObject *
obj=0x009dc5e8, long fval=51144992, unsigned int flags=0, unsigned int argc=1,
long * argv=0x03aa5bc0, long * rval=0x0012fb58)  Line 1035 + 0x14	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x0256ddf0, JSObject *
obj=0x009dc5e8, long fval=51144992, unsigned int argc=1, long * argv=0x03aa5bc0,
long * rval=0x0012fb58)  Line 3607 + 0x1f	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * aTarget=0x009dc5e8,
JSObject * aHandler=0x030c6920, unsigned int argc=1, long * argv=0x03aa5bc0,
long * rval=0x0012fb58)  Line 1297 + 0x21	C++
 	gklayout.dll!GlobalWindowImpl::RunTimeout(nsTimeoutImpl * aTimeout=0x03aa18f8)
 Line 5177	C++
 	gklayout.dll!GlobalWindowImpl::TimerCallback(nsITimer * aTimer=0x0361d5a8,
void * aClosure=0x03aa18f8)  Line 5537	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 382 + 0x11	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 616	C++
 	gkwidget.dll!nsAppShell::Run()  Line 142	C++
 	appshell.dll!nsAppShellService::Run()  Line 524	C++
 	mozilla.exe!main1(int argc=2, char * * argv=0x002a5778, nsISupports *
nativeApp=0x009d25c0)  Line 1303 + 0x20	C++
 	mozilla.exe!main(int argc=2, char * * argv=0x002a5778)  Line 1780 + 0x25	C++
 	mozilla.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!77e814c7() 	
Assignee: nobody → sspitzer
hmm, but if I continue on, I don't crash.
one interesting thing:  that page has a some flash content in the middle, and
when I print preview, it doesn't show up (which is probably how it is supposed
to work)

I'll attach the screen shots (browser and print preview)

maybe that is related?

note, I get lots of asserts (I'll attach my console output)
I was testing with 1.7, and hammer reported this on the trunk (2004-06-27).

I'll update and rebuild the trunk and see if I crash there.
Status: NEW → ASSIGNED
You definitely want to do this on trunk, because only the trunk contains the fix
I just checked in for the first crasher bug on this page :-).
> You definitely want to do this on trunk

thanks for clarifying.

I'm rebuilding (in mozilla/xpcom now...) and I'll report back.
hmm, no crash on debug trunk "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8a2) Gecko/20040628" on windows xp

I still get lots of asserts:

could it be possible that we have some debug code that prevents the crash (by
asserting and returning) but in opt, we continue on and crash?

Document http://www.ign.com/ loaded successfully
++WEBSHELL == 5
++DOMWINDOW == 5
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: Out of flow frame doesn't have the expected parent: 'outOfFlow
Frame->GetParent() == aBlockParent', file c:/mozilla/trees/trunk/mozilla/layout/
html/base/src/nsBlockFrame.cpp, line 6475
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
Write(Enter Game Title): wrap col = 72
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 226
###!!! ASSERTION: aContent2 must not be null: 'aContent2', file c:/mozilla/trees
/trunk/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file c:/mozilla/
trees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4909
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file c:/mozilla/tr
ees/trunk/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4775
WARNING: getting z level of unregistered window, file c:/mozilla/trees/trunk/moz
illa/xpfe/appshell/src/nsWindowMediator.cpp, line 636
WARNING: getting z level of unregistered window, file c:/mozilla/trees/trunk/moz
illa/xpfe/appshell/src/nsWindowMediator.cpp, line 636
Keywords: topcrash
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040628 Firefox/0.8.0+

Print previewing ign.com does not crash firefox-2004-06-28-trunk on Win98SE, 
but gives wrong layout.
ScreenShot of print preview window in firefox-2004-06-28-trunk on Win98SE shows
wrong layout.
This bug is not about wrong layout, it's about a crash.  Please limit your
comments to reduced testcases on Linux or Win32.
Attached file Reduced testcase (obsolete) —
This testcase crashes reliably on linux for me when opening print preview.
(Today's trunk)
I haven't commented it, and it can almost certainly be reduced further, but
it's quite a bit more manageable than the original.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=314269
Summary: Crash with Print Preview on ign.com [@ nsBlockFrame::SplitPlaceholder] → Crash with Print Preview on ign.com [@ nsBlockFrame::SplitPlaceholder][@ 0x00000000 - nsIView::Destroy]
Hit the bug ... TB341806Y, TB341701G
http://www.oop-trainer.de/Themen/Singleton.html
Crash after printing (without print preview) or closing the print preview.

0x00000000
nsIView::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 253]
nsFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 644]
nsSplittableFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsSplittableFrame.cpp,
line 72]
...
This might be related to bug 230417...maybe something there can be of some help?
Flags: blocking-aviary1.0+
Priority: -- → P1
This looks a lot like another print preview bug we had a while back...see my
previous comment.  Marking topcrash+ since it's still a topcrasher.
Keywords: topcrashtopcrash+
Attachment #152074 - Attachment is obsolete: true
Attached file testcase (new & improved) (obsolete) —
I've created a testcase from the site mentioned in comment #18. It's much
smaller and much cleaner. It crashes when print preview is closed.
Tested with today's trunk.
Attached file a bit smaller
Attachment #158487 - Attachment is obsolete: true
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file
d:/cvs-1.11.5/mozilla/layout/base/src/nsLayoutUtils.cpp, line 227  

###!!! ASSERTION: aContent2 must not be null: 'aContent2', file
d:/cvs-1.11.5/mozilla/layout/base/src/nsLayoutUtils.cpp, line 228 

When print previewing the testcase (doesn't happen when it loads in the browser,
only when I choose print preview).
Keywords: testcase
With the code I checked in yesterday, we now get an assertion noting that a
float is not being properly reparented. In fact I think I actually have a fix
for this bug in my columns work.
Okay, my columns patches don't fix this, but it should be fairly easy to fix now.
Attached patch fixSplinter Review
Okay, I have a fix at last. I could not have done it without the testcase;
Ferdinand, whoever you are, thank you very very much.

The problem is that the code for pushing an overflow placeholder onto the start
of the overflow lines was completely bogus. First problem: it appended the new
line box to the wrong line list. Second problem: it failed to set the next
sibling of the last overflow placeholder to the first frame of the overflow
lines if the first overflow line was a block. The fix is therefore quite easy.
Assignee: sspitzer → roc
I should say:

The problem is that the code for pushing an overflow placeholder onto the start
of the overflow lines if the first overflow line is a block was completely
bogus. First problem: it appended the new line box to the wrong line list.
Second problem: it failed to set the next sibling of the last overflow
placeholder to the first frame of the overflow lines. The fix is therefore quite
easy.
Comment on attachment 159061 [details] [diff] [review]
fix

Simple fix for a very annoying, and very hard to track down, crasher
Attachment #159061 - Flags: superreview?(dbaron)
Attachment #159061 - Flags: review?(dbaron)
Comment on attachment 159061 [details] [diff] [review]
fix

r+sr=dbaron.  I still think the whole design of the float splitting code is
wrong, but this seems fine.
Attachment #159061 - Flags: superreview?(dbaron)
Attachment #159061 - Flags: superreview+
Attachment #159061 - Flags: review?(dbaron)
Attachment #159061 - Flags: review+
checked in. If ign.com still has problems for you then please open a new bug.

BTW David, now that I understand the overflow placeholder stuff, I think the
design is OK.
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
The minimized testcase at
https://bugzilla.mozilla.org/attachment.cgi?id=158491&action=view is verified to
work with the latest build 2004-09-22 on Windows XP Seamonkey trunk.

Caveat:  IGN.com still crashes during Print Preview, but that'll need to be
another bug, per roc's request.  As soon as I get a stack trace for the current
IGN.com crasher (it may have changed since this fix landed), I'll file a new bug.

I'll also note this bug # when I do file, for convenience.
Status: RESOLVED → VERIFIED
I just filed bug 262403, due to its new crash stack trace in
nsBlockFrame::DrainOverflowLines.  Minimal testcases welcome (and desired) in
that bug.
roc, dbaron, is this something that should land for 1.7.x and aviary, or is it
too risky at this late stage in the game?
It's not even completely fixed yet. I would not take this for Aviary.
OK, since this didn't completely fix ign.com, minusing for 1.0. If we do finish
the fix, we can revisit the issue. Thanks.
Flags: blocking-aviary1.0+ → blocking-aviary1.0-
*** Bug 255075 has been marked as a duplicate of this bug. ***
*** Bug 251943 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsBlockFrame::SplitPlaceholder] [@ 0x00000000 - nsIView::Destroy]
Product: Core → Core Graveyard
Component: Layout: HTML Frames → Layout: Images
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: