print preview of www.ign.com results in a crash [@ nsBlockFrame::PrepareResizeReflow nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy]

VERIFIED FIXED

Status

()

Core
Layout: Block and Inline
--
critical
VERIFIED FIXED
14 years ago
7 years ago

People

(Reporter: stephend, Assigned: roc)

Tracking

({crash, testcase})

Trunk
x86
All
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
blocking-aviary1.0 -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: reproducible, crash signature, URL)

Attachments

(6 attachments, 1 obsolete attachment)

(Reporter)

Description

14 years ago
Build ID: 2004-09-30-05, Windows XP Seamonkey trunk.

Summary: Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000] in Print Preview
of www.ign.com

Steps to Reproduce:

1.  Load http://www.ign.com
2.  File | Print Preview
3.  Click Landscape or Portrait (Not available on Linux)
4.  Crash, here:

0x3f800000
nsBlockFrame::DrainOverflowLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 4279]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 735]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5089]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 868]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1015]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3597]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3425]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2467]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5089]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 868]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1015]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3597]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3425]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2467]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3079]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2349]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5089]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 868]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowState.cpp,
line 672]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1015]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3597]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3425]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2467]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3079]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2349]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 544]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3079]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2349]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2062]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 828]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 993]
nsPageContentFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPageContentFrame.cpp,
line 105]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 993]
nsPageFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPageFrame.cpp,
line 210]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 993]
nsSimplePageSequenceFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsSimplePageSequence.cpp,
line 411]
nsFrame::BoxReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 5267]
nsFrame::DoLayout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 5007]
nsIFrame::Layout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 799]
nsScrollBoxFrame::DoLayout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp,
line 339]
nsIFrame::Layout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 799]
nsBoxFrame::LayoutChildAt 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 2693]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1669]
(Reporter)

Comment 1

14 years ago
See bug 185357 and bug 248825.

3rd time's a charm.

Comment 2

14 years ago
Created attachment 161096 [details]
Testcase

Crashes in print preview with orientation: landscape.

Comment 3

14 years ago
The testcase crashes in Linux, with a backtrace almost identical to the one
Stephen gave. (The orientation is set in Page Setup before opening Print Preview.)
Keywords: testcase
OS: Windows XP → All

Comment 4

14 years ago
Created attachment 161199 [details]
Testcase (better)

I've improved the testcase a bit (got rid of the imgs mainly), this one still
has the same trace. However, if you remove the border:solid; or the last br the
browser does draw the print preview screen, but then crashes in
nsContainerFrame::PaintChild.
Attachment #161096 - Attachment is obsolete: true
(Reporter)

Comment 5

14 years ago
Created attachment 161494 [details]
Updatest stack trace

Since the landing of bug bug 251162, the line numbers have changed, but the
stack trace (based on the methods and functions) still looks about the same.
Hmm, I can't get either of the testcases here to crash on my GTK1 trunk build.

Comment 7

14 years ago
I tested the latest linux nightly, and it crashes. I could send the talkback
data, but I doubt that would help you. Maybe there's something in your print or
page setup preferences which prevents the crash. The rather obvious things I can
come up with right now are: Check that page orientation is set to landscape, and
check that page size is A4 or letter.
(Reporter)

Comment 8

14 years ago
Roc: if I remember correctly, do you not have page orientation in your Linux
build for Print Preview?
I changed to Landscape in the Page Setup dialog
(Reporter)

Updated

14 years ago
Flags: blocking-aviary1.0?

Comment 10

14 years ago
know if this is happening on the aviary branch?
(Reporter)

Comment 11

14 years ago
Yes, this crashes Firefox branch build Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.7.3) Gecko/20041020 Firefox/1.0

TB1429473E

Comment 12

14 years ago
yeah, I was able to reproduce too..  be good if there is an simple fix for this
and we could get it on the branches.  roc, what do you think?
Assignee: nobody → roc
Flags: blocking-aviary1.0? → blocking-aviary1.0+

Updated

14 years ago
Summary: Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000] in Print Preview of www.ign.com → print preview Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000] in Print Preview of www.ign.com
Whiteboard: reproducable

Comment 13

14 years ago
Why is a not-topcrash print preview crash on our blocker list? 

Comment 14

14 years ago
This crash is probably related to bug 240490 and bug 248825 in some way, and so
although this bug itself is not yet a topcrasher, it might still be worth
getting a fix in if it will help bring down the topcrash count of the various
print preview bugs out there (many of which involve ign.com).

Updated

14 years ago
Summary: print preview Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000] in Print Preview of www.ign.com → print preview of www.ign.com results in a Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000]

Comment 16

14 years ago
roc says this isn't goint to make 1.0.
Flags: blocking-aviary1.0+ → blocking-aviary1.0-
(Reporter)

Comment 17

14 years ago
Ferdinand's testcase for this
https://bugzilla.mozilla.org/attachment.cgi?id=161199 doesn't crash for me any
longer, but Print Preview/Print of http://www.ign.com still does, which means
any help creating a new testcase is appreciated...

Comment 18

14 years ago
Created attachment 169143 [details]
Testcase (new crash, branch)

I only saw a crash on branch, I've created this testcase for that one. It is, I
guess, technically a new bug.
Stephen, can you tell if it's the same crash you're talking about?
If you're seeing one on the trunk I'll have to take another look at it.
(Reporter)

Comment 19

14 years ago
Ferdinand: thanks for creating that testcase
(https://bugzilla.mozilla.org/attachment.cgi?id=169143), but unfortunately it
doesn't crash my 2004-12-22-04 trunk Windows XP build...
(Reporter)

Updated

14 years ago
Summary: print preview of www.ign.com results in a Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000] → print preview of www.ign.com results in a Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy]

Comment 20

13 years ago
Created attachment 172269 [details]
Testcase (new crash, trunk)

Take 2: On the trunk this time.
Can you confirm this is the right one, Stephen?
(Reporter)

Comment 21

13 years ago
Ferdinand: thanks!

nsFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 679]
nsSplittableFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSplittableFrame.cpp,
line 71]
nsBlockFrame::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 314]
nsPropertyTable::PropertyList::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsPropertyTable.cpp,
line 249]
(Reporter)

Updated

13 years ago
Whiteboard: reproducable → reproducible
(Reporter)

Updated

13 years ago
Depends on: 263825
(Reporter)

Updated

13 years ago
Summary: print preview of www.ign.com results in a Crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy] → print preview of www.ign.com results in a crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy]
The patch in bug 263825 fixes this testcase but it *still* crashes on ign.com!!
Sigh :-) Hopefully it at least moves us closer. BTW thanks for the testcase
Ferdinand, but we'll need your services again :-)

Comment 23

13 years ago
The site crashes both in landscape and in portrait mode, do you want me to add
testcases for each, or should the portrait crash be put in a new bug?

Comment 24

13 years ago
Created attachment 178392 [details]
Testcase (new crash... again)

Here's a testcase that crashes regardless of page orientation, so you can
ignore my previous comment.
One crash at a time :-). Portrait's easier for me to test. I'll get to work on
this testcase. Thanks so much.
Created attachment 178413 [details] [diff] [review]
fix

This patch fixes the testcase. The problem is that when we reflow a float that
breaks across pages, the reflow of the placeholder returns status NOT_COMPLETE,
and normally for inlines that means we need to break the line after the frame.
Of course for placeholders we can and should continue along the line.
nsBlockFrame::ReflowInlineFrame detects this special case, but it doesn't
handle the case when the placeholder is inside some span. To get that one, we
need to check in nsInlineFrame::ReflowInlineFrame.

This patch also squashes some annoying assertions where we don't know how to
order the views of page frames because they don't have content. The order of
such views doesn't really matter...

With this patch I can actually successfully print preview ign.com! And it
doesn't look too bad.
Attachment #178413 - Flags: superreview?(dbaron)
Attachment #178413 - Flags: review?(dbaron)
Special thanks to Ferdinand without whose persistence this would not have been
possible.
Comment on attachment 178413 [details] [diff] [review]
fix

As long as changing what happens when f is null (when is that?) isn't a bad
thing to do, r+sr=dbaron.
Attachment #178413 - Flags: superreview?(dbaron)
Attachment #178413 - Flags: superreview+
Attachment #178413 - Flags: review?(dbaron)
Attachment #178413 - Flags: review+
(Reporter)

Updated

13 years ago
Summary: print preview of www.ign.com results in a crash [@ nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy] → print preview of www.ign.com results in a crash [@ nsBlockFrame::PrepareResizeReflow nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy]
Blocks: 156982
I don't think that can ever happen. It would have to be a view in the view tree
with no frame, and no ancestor with a frame. But the root of the view tree has
the viewport frame on it. I'll add an assertion that f is not null.
Oops, there already is one! And it's not firing :-)
Checked in. Thanks all.
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
Blocks: 210944
(Reporter)

Comment 32

13 years ago
Finally!

Verified FIXED with build Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b2) Gecko/20050324
Status: RESOLVED → VERIFIED

Comment 33

13 years ago
*** Bug 314644 has been marked as a duplicate of this bug. ***

Comment 34

13 years ago
I originally submitted Bug 314644, which was marked as a dupe of this one, which is now marked "Fixed".  However, Problem A seems to be fixed at the expense of Problem B, as I noted in 314644.  I can Preview and Print the test case for that bug in 1.5rc1, but the preview and output are very different from the desired and on-screen look.  Does this need to be submitted as a new bug?
Yes, please file one bug per problem.
Crash Signature: [@ nsBlockFrame::PrepareResizeReflow nsBlockFrame::DrainOverflowLines 0x3f800000 nsFrame::Destroy]
You need to log in before you can comment on or make changes to this bug.