Closed Bug 275560 Opened 20 years ago Closed 19 years ago

browser crash [@ nsContainerFrame::PaintChild] when printing the above url (BuildFloatList removal)

Categories

(Core :: Layout: Block and Inline, defect)

Product:
Core
Component:
Layout: Block and Inline
Platform:
Sun
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: Anders.Grund, Unassigned)

References

(
URL
)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

output from truss before and during the crash
267.61 KB, text/plain
Details
Testcase
524 bytes, text/html
Details 
User-Agent:       Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0
Build Identifier: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0

Trying to print
http://www.icakuriren.se/ArticlePages/200412/15/20041215112228_Icak770/20041215112228_Icak770.dbp.asp?iPageId=10&strAction=PRINT
Browser crash with Segmentation Fault [2]    Exit 139 , every time. happens on
w2k too.

Reproducible: Always

Steps to Reproduce:
1.go to
http://www.icakuriren.se/ArticlePages/200412/15/20041215112228_Icak770/20041215112228_Icak770.dbp.asp?iPageId=10&strAction=PRINT
 
2. select file, print
3. crash

Actual Results:  
Browser crash 

Expected Results:  
Print the page
Attached file Testcase — 
The following minimal testcase still crashes for me on print preview, using:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20041219
Firefox/1.0+
Well, the testcase doesn't contain a table, but I think this could be related to
bug 245300.

Talkback ID nr 1:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2675920Z

nsContainerFrame::PaintChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 244]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/../generic\nsBlockFrame.h,
line 266]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 6064]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLContainerFrame.cpp,
line 140]
nsBlockFrame::Paint 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 5891]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/../generic\nsBlockFrame.h,
line 266]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 6064]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLContainerFrame.cpp,
line 140]
nsBlockFrame::Paint 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 5891]
PresShell::Paint 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5410]
nsView::Paint 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line
316]
nsViewManager::RenderDisplayListElement 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1461]
nsViewManager::RenderViews 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1376]
nsViewManager::Refresh 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 941]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1940]
HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3897]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x1ef0 (0x77e11ef0)
USER32.dll + 0x3869 (0x77e13869)
USER32.dll + 0x38ab (0x77e138ab)
ntdll.dll + 0x1ff57 (0x77f9ff57)
USER32.dll + 0x4e1b (0x77e14e1b)
nsWindow::ProcessMessage 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4132]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x1ef0 (0x77e11ef0)
USER32.dll + 0x204c (0x77e1204c)
USER32.dll + 0x21af (0x77e121af)
nsAppStartup::Run 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 156]
main 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7c59893d)

Talkback ID nr 2:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2675920Z
nsLineBox::IsEmpty 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsLineBox.cpp,
line 286]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3314]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowFloat 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 5548]
nsBlockReflowState::FlowAndPlaceFloat 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowState.cpp,
line 801]
nsBlockReflowState::AddFloat 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowState.cpp,
line 607]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsLineLayout.cpp,
line 1024]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 4119]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3809]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3698]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2723]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableCellFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableCellFrame.cpp,
line 867]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableRowFrame::ReflowChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 971]
nsTableRowFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1426]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableRowGroupFrame::ReflowChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 386]
nsTableRowGroupFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1239]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableFrame::ReflowChildren 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 3239]
nsTableFrame::ReflowTable 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 2158]
nsTableFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 2000]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableOuterFrame::OuterReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1329]
nsTableOuterFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1996]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsPageContentFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsPageContentFrame.cpp,
line 105]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsPageFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsPageFrame.cpp,
line 210]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsSimplePageSequenceFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsSimplePageSequence.cpp,
line 405]
nsFrame::BoxReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 5351]
nsFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 5091]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1666]
nsHTMLScrollFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1083]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
Assignee: firefox → nobody
Status: UNCONFIRMED → NEW
Component: General → Layout
Depends on: 245300
Ever confirmed: true
Keywords: testcase
OS: Solaris → All
Product: Firefox → Core
QA Contact: firefox.general → core.layout
Version: unspecified → Trunk
Talkback ID nr2 was probably from a not so minimal testcase yet, talkback ID nr
1 is from the minimal testcase.
Two related bugs: bug 234062 and bug 265973.
Summary: browser crash when printing the above url → browser crash [@ nsContainerFrame::PaintChild] when printing the above url
Severity: normal → critical
Keywords: crash
So before we crash, I see:

###!!! ASSERTION: Out of flow frame doesn't have the expected parent:
'outOfFlowFrame->GetParent() == aBlockParent', file
/home/bzbarsky/mozilla/debug/mozilla/layout/generic/nsBlockFrame.cpp, line 7053

###!!! ASSERTION: no frame to paint!: 'aFrame', file
/home/bzbarsky/mozilla/debug/mozilla/layout/generic/nsContainerFrame.cpp, line 243

Then crash.

Looking up the stack to where we pass in the null frame, we are at:

(gdb) frame
#3  0x4131a9c9 in PaintLine (aLineArea=@0xbfffdd80, aDirtyRect=@0xbfffdf20, 
    aLine=@0xbfffdd98, aDepth=0, aDrawnLines=@0xbfffddbc, aPresContext=0x899cf88, 
    aRenderingContext=@0x8a47b90, aWhichLayer=eFramePaintLayer_Underlay, 
    aFrame=0x89c8748)
    at /home/bzbarsky/mozilla/debug/mozilla/layout/generic/nsBlockFrame.cpp:5994
5994          aFrame->PaintChild(aPresContext, aRenderingContext, aDirtyRect, kid,
(gdb) p kid
$2 = (nsIFrame *) 0x0
(gdb) list
5989        }
5990    #endif
5991        nsIFrame* kid = aLine->mFirstChild;
5992        PRInt32 n = aLine->GetChildCount();
5993        while (--n >= 0) {
5994          aFrame->PaintChild(aPresContext, aRenderingContext, aDirtyRect, kid,
5995                             aWhichLayer);
5996          kid = kid->GetNextSibling();
5997        }
5998      }
(gdb) p n
$3 = 0

I'm betting BuildFloatList screwed up here....
Blocks: 234062, 265973
Component: Layout → Layout: Block and Inline
QA Contact: layout → layout.block-and-inline
Summary: browser crash [@ nsContainerFrame::PaintChild] when printing the above url → browser crash [@ nsContainerFrame::PaintChild] when printing the above url (BuildFloatList removal)
This doesn't crash anymore on print preview in the 2005-3-23 trunk build, not
with the testcase nor with the url (although the print preview output looks odd).
It still crashes on me with a 2005-03-18 build.
Most likely fixed by bug 263825.
Status: NEW → RESOLVED
Closed: 19 years ago
Depends on: 263825
Resolution: --- → WORKSFORME
Crash Signature: [@ nsContainerFrame::PaintChild]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: