Crash [@ nsSubDocumentFrame::QueryInterface] when printing page that contains an iframe

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
14 years ago
8 years ago

People

(Reporter: u52928, Assigned: sharparrow1)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows 98
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

14 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060126 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060126 Firefox/1.6a1

When trying to print page with "marquess" FF crashes.



Reproducible: Always

Steps to Reproduce:
1. Go to http://news.bbc.co.uk/2/hi/default.stm
2. Try to print page

Actual Results:  
"Print" dialogue appears, and so does the "Printing" window, but then FF crashes.

Expected Results:  
Page should print.

Today's branch build prints it without a problem. Also, there's no problem when trying to print any other page from the BBC news. It seems to be related to the marquee.

The talkback ID is TB14459212Y 
FIREFOX caused an invalid page fault in module FIREFOX.EXE at 0177:0066e215. 

I have all the same extensions and use the same theme in both the branh and trunk profiles.
(Reporter)

Updated

14 years ago
Version: unspecified → Trunk
Incident ID: 14459212
Stack Signature	nsSubDocumentFrame::QueryInterface e0526491
Product ID	FirefoxTrunk
Build ID	2006012609
Trigger Time	2006-01-27 01:22:34.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	FIREFOX.EXE + (0026e215)
URL visited	
User Comments	
Since Last Crash	649 sec
Total Uptime	4374 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameFrame.cpp, line 203
Stack Trace 	
nsSubDocumentFrame::QueryInterface  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameFrame.cpp, line 203]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsTableCellFrame::PaintCellBackground  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableCellFrame.cpp, line 352]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1233]
nsTableRowFrame::UpdateHeight  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowFrame.cpp, line 489]
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1233]
nsTableRowGroupFrame::GetNextFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowGroupFrame.h, line 356]
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1233]
nsTableFrame::CollectRows  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1257]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsTableOuterFrame::`scalar deleting destructor'
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBlockFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6290]
nsBlockFrame::IsVisibleInSelection  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6142]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBoxFrame::GetLayoutManager  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2285]
nsBoxFrame::CheckBoxOrder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2270]
nsPageContentFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsPageContentFrame.cpp, line 134]
MarkOutOfFlowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1228]
nsBoxFrame::GetLayoutManager  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2285]
nsBoxFrame::CheckBoxOrder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 2270]
nsPageFrame::BuildDisplayList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsPageFrame.cpp, line 546]
nsFrame::DisplayBorderBackgroundOutline  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 908]
nsLayoutUtils::GetEventCoordinatesRelativeTo  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsLayoutUtils.cpp, line 500]
PresShell::ComputeRepaintRegionForCopy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5406]
nsSimplePageSequenceFrame::PrintNextPage  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp, line 828]
nsPrintEngine::PrintPage  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 3473]
nsXMLStylesheetPI::`scalar deleting destructor'
nsTimerImpl::Fire  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 413]
nsAppStartup::Quit  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 287]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
KERNEL32.DLL + 0x1b560 (0xbff8b560)
KERNEL32.DLL + 0x1b412 (0xbff8b412)
KERNEL32.DLL + 0x19dd5 (0xbff89dd5)
Summary: Can't print page with marquee → Can't print page with marquee [@ nsSubDocumentFrame::QueryInterface]

Updated

14 years ago
Severity: normal → critical
Component: General → Printing
Keywords: crash
Product: Firefox → Core
Summary: Can't print page with marquee [@ nsSubDocumentFrame::QueryInterface] → Printing page with marquee crashes [@ nsSubDocumentFrame::QueryInterface]
regression started on 26th (acc a forumpost)
Keywords: regression
Posted file testcase
Basically, the crash happens when trying to print a page that contains an iframe.
This is a regression from bug 317375.
Blocks: 317375
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: testcase
Summary: Printing page with marquee crashes [@ nsSubDocumentFrame::QueryInterface] → Crash [@ nsSubDocumentFrame::QueryInterface] when printing page that contains an iframe
(Assignee)

Comment 4

14 years ago
Posted patch PatchSplinter Review
Missing null check; I think this is right, although it is kind of weird.  I guess it has something to do with printing displaying the various documents one by one.

BTW, I don't know what Talkback's on; that trace is completely off.
Assignee: nobody → sharparrow1
Status: NEW → ASSIGNED
Attachment #210003 - Flags: review?(roc)
Blocks: 325206

Comment 5

14 years ago
*** Bug 325238 has been marked as a duplicate of this bug. ***

Updated

14 years ago
Whiteboard: [checkin needed]
(Assignee)

Comment 6

14 years ago
Checking in nsFrameFrame.cpp;
/cvsroot/mozilla/layout/generic/nsFrameFrame.cpp,v  <--  nsFrameFrame.cpp
new revision: 3.293; previous revision: 3.292
done

My first checkin, so tell me if I messed up anything.
Status: ASSIGNED → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → FIXED
Whiteboard: [checkin needed]
Crash Signature: [@ nsSubDocumentFrame::QueryInterface]
You need to log in before you can comment on or make changes to this bug.