255075 - Crash on Print Preview of page with floats [@ 0x00000000 - nsIView::Destroy ]

Status: RESOLVED DUPLICATE of bug 248825

(Core :: Print Preview, defect)

Description

[Joe Schmetzer]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040802 Firefox/0.9.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040802 Firefox/0.9.1

The example page will trigger a crash in Mozilla Firefox when selecting "File |
Print Preview..."

The crash has been demonstrated on both Windows and Linux:

* Mozilla Firefox 0.9.2 running under Windows 2000 (UA String is Mozilla/5.0
(Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040707 Firefox/0.8)

* Mozilla Firefox 0.9.1 running under Linux Debian Sid (UA String is Mozilla/5.0
(X11; U; Linux i686; en-US; rv:1.7) Gecko/20040802 Firefox/0.9.1)

The example uses css to float a number of elements to the right. It appears that
adjacent floating elements on this page cause the crash when selecting print
preview.

Reproducible: Always
Steps to Reproduce:
1. Go to http://www.exubero.com/mozcrash.html
2. Select "File | Print Preview" from the menu
3. Boom!

Actual Results:  
Firefox crashed.

Expected Results:  
Displayed the print preview.

Comment 1

[Adam Hauner]

I was able to reproduce after several rescales.

TB532018Z from 2004080908/Seamonkey-trunk/W2K:
0x00000000
nsIView::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 253]
nsFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 644]

TB532006M, 532005 from FF093/W2K:
0x00000000
nsIView::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 253]
nsSplittableFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsSplittableFrame.cpp,
line 71]
nsBlockFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 313]
nsPositionedInlineFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 1103]
nsFrameList::DestroyFrames 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsFrameList::DestroyFrames 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsFrameList::DestroyFrames 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsGfxScrollFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 427]
nsPositionedInlineFrame::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 1103]
PresShell::Destroy 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 1892]
DocumentViewerImpl::InstallNewPresentation 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 3795]
nsPrintEngine::FinishPrintPreview 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 4498]
nsPrintEngine::PrintPreview 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintEngine.cpp,
line 1258]
DocumentViewerImpl::PrintPreview 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 3198]
XPTC_InvokeByIndex 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2027]
XPC_WN_CallMethod 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Execute 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1162]
JS_EvaluateUCScriptForPrincipals 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c,
line 3558]
nsJSContext::EvaluateString 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 946]
GlobalWindowImpl::RunTimeout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5138]
GlobalWindowImpl::TimerCallback 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5515]
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
KERNEL32.DLL + 0x11af6 (0x796e1af6)

-> Browser/Print Preview

Comment 2

[James Napolitano]

The above URL is no longer valid.

Comment 3

[Joe Schmetzer]

The url at http://www.exubero.com/mozcrash.html has been re-enabled. I've just
updated the DNS ANAME record to point back at the new server, so it may take a
while for the change to percolate through. (My last webserver died a horrible
death at the hands of a power spike last month, and it's taken me a while to get
things back up and running again).

Comment 4

[James Napolitano]

Print preview of the testcase WFM with the Firefox 1.0 Preview Release:
   Mozilla/5.0 (Windows; U; Win98; rv:1.7.3) Gecko/20040913 Firefox/0.10
and a Seamonkey 1.8alpha4 nightly:
   Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a4) Gecko/20040916.

Comment 5

[Joe Schmetzer]

I was able to reproduce the crash using Firefox 1.0PR [Mozilla/5.0 (Windows; U;
Windows NT 5.0; rv:1.7.3) Gecko/20040913 Firefox/0.10]. I had to rescale the
page a few times to reproduce, though. It may be something to do with an element
that crosses a page boundary(??)

Comment 6

[James Napolitano]

OK, this crashes Firefox 1.0 PR if you scale to 60%, but no matter what I scaled
to in a recently nightly (1.8a5, Gecko/20040930) there was no crash.  Apparently
this has been fixed on the trunk but not on the Firefox 1.0 branch.

Comment 7

[Jay Patel [:jay]]

If this crash is working for Joe and James on the Trunk, but still crashing
Firefox PR, it's related to or a dup of bug 248825.

*** This bug has been marked as a duplicate of 248825 ***