279316 - Crash closing Print Preview [@ nsFrameList::DestroyFrames]

Status: VERIFIED DUPLICATE of bug 274516

(Core :: Layout: Tables, defect)

Description

[Mats Palmgren (inactive)]

Crash closing Print Preview [@ nsFrameList::DestroyFrames]

STEPS TO REPRODUCE:
1. Load attached testcase
2. Print Preview
3. Close

100% reproducable crash at 3.

Before the crash I see:

###!!! ASSERTION: bad prev sibling: 'aPrevSibling->GetNextSibling() ==
aFromChild', file nsTableFrame.cpp, line 2210

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/tables/nsTableFrame.cpp&rev=3.603&root=/cvsroot&mark=2204,2210#2204


I bump into this a lot when coding a fix for bug 278983 but since it occurs
also without explicit 'page-break-after/before' I think it should be handled
separately (the core problem of bug 278983 is different).

SPECULATION: since row-groups are reflowed "out-of-order" this causes
problems when pushing them (PushChildren seems to assume document order)...

Comment 1

[Mats Palmgren (inactive)]

Attachment: Crash call stack

Comment 2

[Mats Palmgren (inactive)]

Attachment: Testcase (CRASH)

Comment 3

[Bernd]

hmm, seems that tables are the only ones that push children at all
http://lxr.mozilla.org/seamonkey/ident?i=PushChildren

Comment 4

[Bernd]

And as usual when something goes wrong with thead and tbody watch out for
OrderRowGroups it might not have been called when it should be.

Comment 5

[Mats Palmgren (inactive)]

Attachment: Testcase #2 (CRASH)

Comment 6

[Bernd]

Mats are you going to work on this?

Comment 7

[Mats Palmgren (inactive)]

Bernd, no, I don't intend to work on this bug.

Comment 8

[Bernd]

yep, no orphaned crash bugs please....

Comment 9

[Bernd]

this got fixed by bug 274516

*** This bug has been marked as a duplicate of 274516 ***

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

verified dup