Closed Bug 275560 Opened 20 years ago Closed 20 years ago

browser crash [@ nsContainerFrame::PaintChild] when printing the above url (BuildFloatList removal)

Categories

(Core :: Layout: Block and Inline, defect)

Product:
Core
Component:
Layout: Block and Inline
Platform:
Sun
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: Anders.Grund, Unassigned)

References

(
URL
)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

output from truss before and during the crash
267.61 KB, text/plain
Details
Testcase
524 bytes, text/html
Details
User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0 Build Identifier: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0 Trying to print http://www.icakuriren.se/ArticlePages/200412/15/20041215112228_Icak770/20041215112228_Icak770.dbp.asp?iPageId=10&strAction=PRINT Browser crash with Segmentation Fault [2] Exit 139 , every time. happens on w2k too. Reproducible: Always Steps to Reproduce: 1.go to http://www.icakuriren.se/ArticlePages/200412/15/20041215112228_Icak770/20041215112228_Icak770.dbp.asp?iPageId=10&strAction=PRINT 2. select file, print 3. crash Actual Results: Browser crash Expected Results: Print the page
Attached file Testcase —
The following minimal testcase still crashes for me on print preview, using: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20041219 Firefox/1.0+
Well, the testcase doesn't contain a table, but I think this could be related to bug 245300. Talkback ID nr 1: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2675920Z nsContainerFrame::PaintChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 244] nsBlockFrame::PaintChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/../generic\nsBlockFrame.h, line 266] nsBlockFrame::PaintChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 6064] nsHTMLContainerFrame::PaintDecorationsAndChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 140] nsBlockFrame::Paint [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 5891] nsContainerFrame::PaintChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 306] nsBlockFrame::PaintChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/../generic\nsBlockFrame.h, line 266] nsBlockFrame::PaintChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 6064] nsHTMLContainerFrame::PaintDecorationsAndChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 140] nsBlockFrame::Paint [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 5891] PresShell::Paint [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5410] nsView::Paint [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 316] nsViewManager::RenderDisplayListElement [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1461] nsViewManager::RenderViews [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1376] nsViewManager::Refresh [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 941] nsViewManager::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1940] HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102] nsWindow::ProcessMessage [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 3897] nsWindow::WindowProc [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1383] USER32.dll + 0x1ef0 (0x77e11ef0) USER32.dll + 0x3869 (0x77e13869) USER32.dll + 0x38ab (0x77e138ab) ntdll.dll + 0x1ff57 (0x77f9ff57) USER32.dll + 0x4e1b (0x77e14e1b) nsWindow::ProcessMessage [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 4132] nsWindow::WindowProc [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1383] USER32.dll + 0x1ef0 (0x77e11ef0) USER32.dll + 0x204c (0x77e1204c) USER32.dll + 0x21af (0x77e121af) nsAppStartup::Run [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 156] main [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp, line 60] KERNEL32.DLL + 0x2893d (0x7c59893d) Talkback ID nr 2: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2675920Z nsLineBox::IsEmpty [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsLineBox.cpp, line 286] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3314] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowFloat [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 5548] nsBlockReflowState::FlowAndPlaceFloat [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowState.cpp, line 801] nsBlockReflowState::AddFloat [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowState.cpp, line 607] nsLineLayout::ReflowFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsLineLayout.cpp, line 1024] nsBlockFrame::ReflowInlineFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 4119] nsBlockFrame::DoReflowInlineFrames [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3809] nsBlockFrame::ReflowInlineFrames [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3698] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2723] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableCellFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableCellFrame.cpp, line 867] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableRowFrame::ReflowChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp, line 971] nsTableRowFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp, line 1426] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableRowGroupFrame::ReflowChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 386] nsTableRowGroupFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 1239] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableFrame::ReflowChildren [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp, line 3239] nsTableFrame::ReflowTable [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp, line 2158] nsTableFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp, line 2000] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableOuterFrame::OuterReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1329] nsTableOuterFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1996] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3427] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3427] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3427] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3427] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsPageContentFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsPageContentFrame.cpp, line 105] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsPageFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsPageFrame.cpp, line 210] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsSimplePageSequenceFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsSimplePageSequence.cpp, line 405] nsFrame::BoxReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp, line 5351] nsFrame::DoLayout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp, line 5091] nsIFrame::Layout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp, line 805] nsIFrame::Layout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp, line 805] nsGfxScrollFrameInner::LayoutBox [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1666] nsHTMLScrollFrame::DoLayout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1083] nsIFrame::Layout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp, line 805]
Assignee: firefox → nobody
Status: UNCONFIRMED → NEW
Component: General → Layout
Depends on: 245300
Ever confirmed: true
Keywords: testcase
OS: Solaris → All
Product: Firefox → Core
QA Contact: firefox.general → core.layout
Version: unspecified → Trunk
Talkback ID nr2 was probably from a not so minimal testcase yet, talkback ID nr 1 is from the minimal testcase. Two related bugs: bug 234062 and bug 265973.
Summary: browser crash when printing the above url → browser crash [@ nsContainerFrame::PaintChild] when printing the above url
Severity: normal → critical
Keywords: crash
So before we crash, I see: ###!!! ASSERTION: Out of flow frame doesn't have the expected parent: 'outOfFlowFrame->GetParent() == aBlockParent', file /home/bzbarsky/mozilla/debug/mozilla/layout/generic/nsBlockFrame.cpp, line 7053 ###!!! ASSERTION: no frame to paint!: 'aFrame', file /home/bzbarsky/mozilla/debug/mozilla/layout/generic/nsContainerFrame.cpp, line 243 Then crash. Looking up the stack to where we pass in the null frame, we are at: (gdb) frame #3 0x4131a9c9 in PaintLine (aLineArea=@0xbfffdd80, aDirtyRect=@0xbfffdf20, aLine=@0xbfffdd98, aDepth=0, aDrawnLines=@0xbfffddbc, aPresContext=0x899cf88, aRenderingContext=@0x8a47b90, aWhichLayer=eFramePaintLayer_Underlay, aFrame=0x89c8748) at /home/bzbarsky/mozilla/debug/mozilla/layout/generic/nsBlockFrame.cpp:5994 5994 aFrame->PaintChild(aPresContext, aRenderingContext, aDirtyRect, kid, (gdb) p kid $2 = (nsIFrame *) 0x0 (gdb) list 5989 } 5990 #endif 5991 nsIFrame* kid = aLine->mFirstChild; 5992 PRInt32 n = aLine->GetChildCount(); 5993 while (--n >= 0) { 5994 aFrame->PaintChild(aPresContext, aRenderingContext, aDirtyRect, kid, 5995 aWhichLayer); 5996 kid = kid->GetNextSibling(); 5997 } 5998 } (gdb) p n $3 = 0 I'm betting BuildFloatList screwed up here....
Blocks: 234062, 265973
Component: Layout → Layout: Block and Inline
QA Contact: layout → layout.block-and-inline
Summary: browser crash [@ nsContainerFrame::PaintChild] when printing the above url → browser crash [@ nsContainerFrame::PaintChild] when printing the above url (BuildFloatList removal)
This doesn't crash anymore on print preview in the 2005-3-23 trunk build, not with the testcase nor with the url (although the print preview output looks odd). It still crashes on me with a 2005-03-18 build. Most likely fixed by bug 263825.
Status: NEW → RESOLVED
Closed: 20 years ago
Depends on: 263825
Resolution: --- → WORKSFORME
Crash Signature: [@ nsContainerFrame::PaintChild]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: