285066 - printing crashes if linked stylesheet media attribute not specified [@ nsBlockFrame::SplitPlaceholder ]

Status: RESOLVED FIXED

(Core :: Printing: Output, defect)

Description

[dan willis]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3

If a number of stylesheets are specified as linked files in the header of an
HTML file, and one does not have a 'media' attribute specified, then the browser
will crash when attempting to print the page.

eg:
<link href="./style_screen.css" rel="stylesheet" type="text/css" />
<link href="./style_print.css" rel="stylesheet" type="text/css" media="print" />

... will crash, but this:

<link href="./style_screen.css" rel="stylesheet" type="text/css" media="print" />
<link href="./style_print.css" rel="stylesheet" type="text/css" media="print" />

... will not crash.

I had a look through the HTML 4.01 spec and it does not seem that the 'media'
attribute is mandatory. Therefore the browser should be able to cope with this
situation.



Reproducible: Always

Steps to Reproduce:

(see details above)
Actual Results:  
Browser crashed with and Application Error

Expected Results:  
Printed the page with the 'print' stylesheet.

Comment 1

[dan willis]

Sorry - I've made a typo - these lines:

 
><link href="./style_screen.css" rel="stylesheet" type="text/css" media="print" />
><link href="./style_print.css" rel="stylesheet" type="text/css" media="print" />

..should read

<link href="./style_screen.css" rel="stylesheet" type="text/css" media="screen" />
<link href="./style_print.css" rel="stylesheet" type="text/css" media="print" />

Comment 2

[Nickolay_Ponomarev]

Could you attach a testcase and re-test with a newer build from
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/
If you can reproduce it with a recent build, please provide a talkback incident ID.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The only difference between the two is that the no-media-specified sheet will be
applied for printing.  So the real issue is just that we crash with some set of
style rules when printing.

We're going to need an actual html+css testcase (or url to such) to do anything
here...

Comment 4

[dan willis]

Attachment: Sample page - hangs browser.

This HTML file does not have a media attribute specified for its screen
stylesheet link tag. 
Under Firefox 0.9.3 install, it crashes, but I have tried it in the latest
nightly build, and it hangs, rather than crashes

Comment 5

[dan willis]

Attachment: This is the same file but fixed to print ok.

This HTML file does a media attribute of value "screen" specified for its
screen stylesheet link tag. 
This does not hang or crash either 0.9.3 or the latest nightly build.

Comment 6

[Boris Zbarsky [:bzbarsky]]

This is probably relevant:

###!!! ASSERTION: Out of flow frame doesn't have the expected parent:
'outOfFlowFrame->GetParent() == aBlockParent', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/generic/nsBlockFrame.cpp, line 6990

A minimal testcase would be nice, as usual.  ;)

Comment 7

[Martijn Wargers (dead)]

Attachment: Testcase, not minimised yet

This is not minimised yet, I will continue on it tomorrow if needed.
I get Talkback ID: TB4186086X on this:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4186086X

This has as signature: nsBlockFrame::SplitPlaceholder
Searching for that:
http://bugzilla.mozilla.org/buglist.cgi?query_format=&short_desc_type=allwordssubstr&short_desc=nsBlockFrame::SplitPlaceholder&long_desc_type=substring&long_desc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=&emailtype1=exact&email1=&emailtype2=exact&email2=&bugidtype=include&bug_id=&votes=&chfieldfrom=&chfieldto=Now&chfieldvalue=&cmdtype=doit&order=Reuse+same+sort+as+last+time&field0-0-0=noop&type0-0-0=noop&value0-0-0=

Bug 265867 already has a simple testcase that gives the same stack signature.
So, is it still needed to minimise the testcase further?

Comment 8

[Boris Zbarsky [:bzbarsky]]

Probably not worth minimizing more till that's fixed (and then only if this is
not fixed by the same patch).

Comment 9

[Bernd]

I guess that dependency is bogus bug 265867 is a clear wfm, Boris I guess you
fixed that allready.

Comment 10

[Martijn Wargers (dead)]

Attachment: Testcase, still not minimised

With this testcase, I don't crash directly on print preview. But I crash when I
scroll down to the bottom in print preview.
Talkback ID: TB4207280G
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4207280G

Backtrace: nsContainerFrame::PaintChild
This gives bug 275560, bug 265973 and bug 2775560 for examples (all with
testcases). So I guess these ones could also be related.

Bernd, the testcase in bug 265867 crashes for me.

Comment 11

[Martijn Wargers (dead)]

My debug build with the patch from bug 263825 doesn't crash anymore with at
least two of the testcases I tried. (alhtough I get tons of assertions)

Comment 12

[Martijn Wargers (dead)]

Fixed by the fix for bug 263825.