263738 - crash on print/print preview [@ nsTableRowFrame::InsertCellFrame]

Status: VERIFIED FIXED

(Core :: Printing: Output, defect)

Description

[Felix von Delius]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041005 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041005 Firefox/0.10.1

This page can't be printed with any Gecko-based browser. When trying to print
this page, the browser crashes. Verified with Linux, Windows, MacOS X and
various Browsers (Mozilla 1.7 / Firefox 1.0PR)


Reproducible: Always
Steps to Reproduce:
1. open page http://www.lyngsat.com/astra19.html
2. Open Menu File->Print
3. Klick OK to start printing

Actual Results:  
Application crashes. On MacOS X it says "the Application exited unexpectedly",
on Linux it just disappears.

Expected Results:  
print the page without crashing ;-)

using default theme and any operating-system. Bug is reproduceable easily as
some colleagues / friends proofed.

Comment 1

[Mats Palmgren (inactive)]

Attachment: Crash data (Linux debug build)

Comment 2

[Mats Palmgren (inactive)]

Confirming bug, 2004-10-09-07 trunk Linux (both on Print and Print Preview).

Comment 3

[Bernd]

a reduced testcase would be nice

Comment 4

[Kenneth Herron]

The critical section of code seems to be
<http://lxr.mozilla.org/seamonkey/source/layout/html/table/src/nsTableRowGroupFrame.cpp#1111>.
The call to UndoContinuedRow() at line 1115 is apparently supposed to invalidate
contRow, and at least in debug builds causes the contRow data structure to be
filled with 0xdd. contRow is passed to SplitSpanningCells() at line 1121, which
passes it to nsTableRowFrame::InsertCellFrame(). InsertCellFrame() dereferences
a pointer which has been set to 0xdddddddd and segfaults.

Comment 5

[Ben Fowler]

Attachment: Backtrace (MacOS)

Looks very much the same as the one from Linux

Comment 6

[Andrew Schultz]

Attachment: testcase

This doesn't seem to be reduced, but everything I change "fixes" it.

Comment 7

[Andrew Schultz]

this regressed between linux trunk 2004041308 and 2004041409.  bug 231823 looks
like the likely culprit.

Comment 8

[Bernd]

taking the bug, bug 231823 only corrected the situation when we split, so
probably it only exposed the bug.

Comment 9

[Bernd]

Attachment: patch

Comment 10

[Andrew Schultz]

Bernd: with the patch, I still crash printing and print prviewing the URL and
testcase

Comment 11

[Bernd]

Attachment: revised patch

Comment 12

[Bernd]

Andrew, could you please retest?

Comment 13

[Andrew Schultz]

printing URL and testcase with the new patch works.

Comment 14

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 161761 [details] [diff] [review]
revised patch

r+sr=bzbarsky, but we really need to make this code more sane... :(

Comment 15

[Bernd]

Comment on attachment 161761 [details] [diff] [review]
revised patch

going for approval

Comment 16

[chris hofmann]

Comment on attachment 161761 [details] [diff] [review]
revised patch

a=chofmann for the branches

Comment 17

[Bernd]

fix checked in trunk + branches

Comment 18

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on the trunk with build 2004-10-14-05, Windows XP Seamonkey.