278868 - Print and print preview crashes on specific URL [@ nsBlockFrame::SplitPlaceholder ]

Status: RESOLVED DUPLICATE of bug 265867

(Core :: Printing: Output, defect)

Description

[Christian Franke]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a6) Gecko/20050111
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a6) Gecko/20050111

Mozilla crashes on print or print preview of http://www.fileplanet.com/index.shtml

Reproducible: Always

Steps to Reproduce:
1. open http://www.fileplanet.com/index.shtml
2. File|Print Preview or File|Print

Actual Results:  
Mozilla crashes with invalid page fault
in module GKLAYOUT.DLL at 019f:6028ed7f.
Registers:
EAX=00000000   CS=019f EIP=6028ed7f   EFLGS=00010246
EBX=[02b3a1ac] SS=01a7 ESP=00639dcc   EBP=00639dd8
ECX=[02b3a1ac] DS=01a7 ESI=00000000   FS=3d3f
EDX=00000100   ES=01a7 EDI=[02b3a2e4] GS=0000
Bytes at CS:EIP:
8b 46 20 89 47 20 83 66 20 00 e8 55 07 00 00 85 
All values except those in [..] are identical on each crash


Expected Results:  
Mozilla should not crash.

Bug could also be reproduced with 1.8a5 on Win98SE.

The testcases of the following other "crash on print/preview" bugs wfm (=no
crash;-) on Win98SE: Bug 215660, bug 234062, bug 269501.

Preview formatting problem with same URL on Win2K may be related, see bug 273363.

Comment 1

[Christian Franke]

Possibly related: bug 156982
(None of the attached test cases result in a crash with 1.8a6 on Win98SE)

Comment 2

[Chris Blore]

Confirmed under Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b)
Gecko/20050117 Firefox/1.0+

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming with build 2005-01-18-05 on Windows XP Seamonkey trunk.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Talkback symbols are screwed up right now, so no stack trace unless someone runs
their own debug build.

Comment 5

[Kenneth Herron]

This may be bug 265867. I can reproduce it with a current gtk2 trunk build on
solaris/sparc. It's not a debug build so I don't have line numbers, but here's a
partial stack trace:

#0  0xfcd453e0 in nsBlockFrame::SplitPlaceholder ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#1  0xfcd72eec in nsInlineFrame::ReflowInlineFrame ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#2  0xfcd7293c in nsInlineFrame::ReflowFrames ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#3  0xfcd72788 in nsInlineFrame::Reflow ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#4  0xfcd76688 in nsLineLayout::ReflowFrame ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#5  0xfcd44f54 in nsBlockFrame::ReflowInlineFrame ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#6  0xfcd44cac in nsBlockFrame::DoReflowInlineFrames ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#7  0xfcd44a7c in nsBlockFrame::ReflowInlineFrames ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#8  0xfcd43428 in nsBlockFrame::ReflowLine ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so
#9  0xfcd42864 in nsBlockFrame::ReflowDirtyLines ()
   from /opt/kherron/moz/ff/dist/bin/components/libgklayout.so

Talkback has 136 reports of crashing in nsBlockFrame::SplitPlaceholder().

Comment 6

[Mats Palmgren (inactive)]

(gdb) frame 8
#8  0x40e3e26a in nsBlockFrame::SplitPlaceholder(nsPresContext&, nsIFrame&)
(this=0x892051c, aPresContext=@0x887bce0,
    aPlaceholder=@0x8922a24) at nsBlockFrame.cpp:4167
4167      nsIFrame *next = contFrame->GetNextSibling();
(gdb) p contFrame
$2 = (class nsIFrame *) 0x0



*** This bug has been marked as a duplicate of 265867 ***