294717 - crash in [@ nsFieldSetFrame::SetInitialChildList] printing <fieldset><legend>

Status: VERIFIED FIXED

(Core :: Layout: Form Controls, defect)

Description

[Marius Strumyla]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050513 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050513 Firefox/1.0+

If a page contains fieldset with a legend that spawns two pages and you try to
print preview a page. Firefox crashes. Firefox 1.0.d does not crash.

Reproducible: Always

Steps to Reproduce:
1. Load etstcase
2. Do Print Preview


Actual Results:  
==> Firefox Crashes

Expected Results:  
==> Does not crash.

Comment 1

[Marius Strumyla]

Attachment: Testcase

Comment 2

[Pavel Penaz]

Crash with latest beast build..
TB: TB5945952Z

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050518
Firefox/1.0+

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

nsComboboxControlFrame::OnOptionTextChanged 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/forms/nsComboboxControlFrame.cpp,
line 2497]
nsHTMLContainerFrame::GetTextDecorations 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp,
line 182]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4100]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3385]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2426]
nsBlockFrame::ReparentFloats 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2032]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 691]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 514]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3259]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2426]
nsBlockFrame::ReparentFloats 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2032]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 691]
nsContainerFrame::SyncFrameViewProperties 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 753]
ViewportFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 294]
nsContainerFrame::SyncFrameViewProperties 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 753]
nsPageFrame::nsPageFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsPageFrame.cpp,
line 113]
nsContainerFrame::SyncFrameViewProperties 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 753]
nsSimplePageSequenceFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp,
line 317]
nsContainerFrame::SyncFrameViewProperties 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 753]
ComputeInsideBorderSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 305]
nsHTMLScrollFrame::ReflowScrolledFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 473]
nsHTMLScrollFrame::PlaceScrollArea 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 642]
nsContainerFrame::SyncFrameViewProperties 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 753]
ViewportFrame::InsertFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 127]
PresShell::GetDisplaySelection 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 2598]
nsPrintEngine::ReflowPrintObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/printing/nsPrintEngine.cpp,
line 2742]
nsPrintEngine::SetupToPrintContent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/printing/nsPrintEngine.cpp,
line 2467]
nsPrintEngine::ShowPrintErrorDialog 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/printing/nsPrintEngine.cpp,
line 2291]
nsPrintEngine::GetDisplayTitleAndURL 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/printing/nsPrintEngine.cpp,
line 2101]
DocumentViewerImpl::Print 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsDocumentViewer.cpp,
line 3247]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 1920]
XPC_WN_CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1279]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1182]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3473]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1202]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1279]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 3857]
nsJSContext::CompileEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1301]
nsGlobalWindow::SetTimeoutOrInterval 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5095]
nsTimeout::Release 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5460]
nsAppStartup::Quit 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 237]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 4

[Bernd]

wfm seamonkey 2005051105 winxp.

The posted stack is bogus, there is no combox in the testcase

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

bernd: how about using a new build?  Yours is 7 days old already.

Anyways, here's the new stack, I just crashed with build 2005-05-18-05, WinXP.

nsFieldSetFrame::SetInitialChildList 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/forms/nsFieldSetFrame.cpp,
line 169]
nsHTMLContainerFrame::CreateNextInFlow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLContainerFrame.cpp,
line 325]
nsBlockFrame::CreateContinuationFor 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 4160]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3486]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2558]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2227]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 872]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 571]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3397]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2558]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2227]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 872]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsPageContentFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsPageContentFrame.cpp,
line 103]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsPageFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsPageFrame.cpp,
line 210]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsSimplePageSequenceFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSimplePageSequence.cpp,
line 405]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsHTMLScrollFrame::ReflowScrolledFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 496]
nsHTMLScrollFrame::ReflowContents 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 543]
nsHTMLScrollFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 733]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
ViewportFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
PresShell::InitialReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 2862]
nsPrintEngine::ReflowPrintObject 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/printing/nsPrintEngine.cpp,
line 2789]
nsPrintEngine::ReflowDocList 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/printing/nsPrintEngine.cpp,
line 2522]
nsPrintEngine::SetupToPrintContent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/printing/nsPrintEngine.cpp,
line 2332]
nsPrintEngine::DocumentReadyForPrinting 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/printing/nsPrintEngine.cpp,
line 2158]
DocumentViewerImpl::PrintPreview 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 3366]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1182]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1202]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsPrintProgress::DoneIniting 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/embedding/components/printingui/src/win/nsPrintProgress.cpp,
line 223]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1182]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1202]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1279]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3857]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1385]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5256]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5617]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1763]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1787]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 6

[Hermann Schwab]

Attachment: 2 page testcase crashing on Print Preview

First testcase didn´t validate because px was missing on height.
First testcase didn´t crash here as I saw only 1 page of 1, and comment 0
mentions two pages are needed to see the crash.

I doubled height to 800px, successfully:
TB5968861M, TB5967801G
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB5967801G

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB5968861M


<html><head><title>294717</title>
<style type="text/css">
  body { margin-top: 600px; }
  fieldset { height: 800px; }	/* was { height: 400 } */
</style></head>
<body>
<fieldset><legend>Firefox Trunk Crash</legend></fieldset>
</body></html>

Comment 7

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050516

forgot to mention my Talkbacks from comment 6 were made with Mozilla Suite,
and the first report is now available, identical to Stephen's report in comment 5.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB5967801G

Comment 8

[Marius Strumyla]

Firefox build http://archive.mozilla.org/pub/firefox/nightly/2005-01-02-00-trunk
works OK.
Firefox build http://archive.mozilla.org/pub/firefox/nightly/2005-01-03-11-trunk
CRASHES.

Comment 9

[Marius Strumyla]

Regression due to bug 236071?

2005-01-02 06:30	mats.palmgren%bredband.net 	Swap the order between the legend
and area frames in a fieldset to fix selection and tabbing problems. b=236071
r+sr=bzbarsky 	

Comment 10

[Mats Palmgren (inactive)]

Both testcases crash with a Linux debug build, a regression from bug 236071.

Comment 11

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Fixes the crash (last hunk, in |CreateContinuingFrame|),
also fixes |GetAbsoluteContainingBlock| which would return the legend frame (if

present), I couldn't find a testcase that triggered that line though -
maybe the inner area frame is also positioned when the fieldset is positioned?

Comment 12

[chris hofmann]

Comment on attachment 187320 [details] [diff] [review]
Patch rev. 1

a=chofmann

Comment 13

[Mats Palmgren (inactive)]

Checked in to trunk at 2005-06-28 14:21 PDT

-> FIXED

Comment 14

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using both testcases in this bug with Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050629 on Windows XP Seamonkey trunk.

No more crash.

Comment 15

[Mats Palmgren (inactive)]

This caused bug 299188