332781 - Crash printing this page [@ 0x00000000 nsFrame::Destroy ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[peter]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; sk; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; sk; rv:1.8) Gecko/20051111 Firefox/1.5

Go to the page and try printing it. Firefox immediately crashes, however page prints after a while.

Might be a security problem (buffer overflow? arbitrary code eecution?)

Reproducible: Always




Debian Sarge, CUPS.

Comment 1

[Philip Withnall (unavailable)]

Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.8) Gecko/20051111 Firefox/1.5 - Build ID: 2005111116
WFM.

Can you reproduce this in safe mode with the latest version of Firefox (1.5.0.1)? (http://kb.mozillazine.org/Safe_Mode)

Comment 2

[peter]

I tested with 1.5.0.1 and still crashes. However, I don't understand, what do You mean by the "safe mode".

Comment 3

[Philip Withnall (unavailable)]

(In reply to comment #2)
> However, I don't understand, what do
> You mean by the "safe mode".
> 

Running Firefox in safe mode disables all extensions and themes, so we can check if it's a problem caused by any of them. For information on how to use it, go to http://kb.mozillazine.org/Safe_Mode.

Comment 4

[peter]

Safe mode -still crashes. Here's output from command line:

tuharsky@inform8:~$ /usr/local/firefox/firefox -safe-mode &
[1] 3724
tuharsky@inform8:~$ /usr/local/firefox/run-mozilla.sh: line 424:  3733 Chyba segmentácie       "$prog" ${1+"$@"}

Comment 5

[Philip Withnall (unavailable)]

OK. Still with the latest Mozilla build of Firefox, did you submit and talkback reports when it crashed? If so, what are the IDs?
(You can find out more about talkback: http://kb.mozillazine.org/Talkback)

Comment 6

[peter]

I don't know ID's (I have set talkback to autosend recently) but yes, I did send them. They are all originating from my email address.

Last time it crashed, the time reported by Talkback ("Captured at") is 04/07/06 01:26
The Firefox has been running twice. After print attemp from one of them, both crashed.

Comment 7

[peter]

As of IDs, there aren't any visible in Talkback -the ID column is empty. Only the time is displayed, and status (Queued or so).

Comment 8

[Philip Withnall (unavailable)]

If the status is "Queued", they haven't been sent yet. Could you send the reports, please?

Comment 9

[peter]

Well, there was a problem in proxy settings. The Talkback dosen't use the browser's settings, it must be set manually.

The ID's are TB17298238G, TB17298237K.

Comment 10

[Philip Withnall (unavailable)]

Looks like a problem with frames.
Confirming.

Comment 11

[timeless]

Incident ID: 17298238
Stack Signature	0x00000000 223c2800
Product ID	Firefox15
Build ID	2006012415
Trigger Time	2006-04-07 04:28:07.0
Platform	LinuxIntel
Operating System	Linux 2.6.15.6
Module	
URL visited	
User Comments	
Since Last Crash	5 sec
Total Uptime	5 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
0x00000000
nsFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp, line 669]
nsContainerFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 169]
nsBlockFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 318]
nsFrameList::DestroyFrames()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrameList.cpp, line 139]
nsBlockFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 303]
nsLineBox::DeleteLineList()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsLineBox.cpp, line 323]
nsBlockFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 306]
nsLineBox::DeleteLineList()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsLineBox.cpp, line 323]
nsBlockFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 306]
nsLineBox::DeleteLineList()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsLineBox.cpp, line 323]
nsBlockFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 306]
nsLineBox::DeleteLineList()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsLineBox.cpp, line 323]
nsBlockFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 306]
nsFrameList::DestroyFrames()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrameList.cpp, line 139]
nsContainerFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 164]
nsFrameList::DestroyFrames()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrameList.cpp, line 139]
nsContainerFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 164]
nsFrameList::DestroyFrames()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrameList.cpp, line 139]
nsContainerFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 164]
nsFrameList::DestroyFrames()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsFrameList.cpp, line 139]
nsContainerFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 164]
nsFrameManager::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsFrameManager.cpp, line 298]
PresShell::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 1957]
nsPrintObject::~nsPrintObject()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/printing/nsPrintObject.cpp, line 848]
nsPrintData::~nsPrintData()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/printing/nsPrintData.cpp, line 146]
nsPrintEngine::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 282]
DocumentViewerImpl::OnDonePrinting()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 4126]
HandlePLEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 4571]
PL_HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/threads/plevent.c, line 689]
PL_ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/threads/plevent.c, line 623]
nsEventQueueImpl::ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/threads/nsEventQueue.cpp, line 421]
event_processor_callback()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 67]
libglib-2.0.so.0 + 0x49dbf (0xb7986dbf)
libglib-2.0.so.0 + 0x24582 (0xb7961582)
libglib-2.0.so.0 + 0x255f8 (0xb79625f8)
libglib-2.0.so.0 + 0x25930 (0xb7962930)
libglib-2.0.so.0 + 0x25ed3 (0xb7962ed3)
libgtk-x11-2.0.so.0 + 0x11fbb3 (0xb7c13bb3)
nsAppShell::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2315]
main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x15974 (0xb7483974)

Comment 12

[Mats Palmgren (inactive)]

Can anyone still reproduce this crash in a nightly trunk build?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/
http://ftp.mozilla.org/pub/mozilla.org/seamonkey/nightly/latest-trunk/

or with Firefox 2 beta 1:
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/2.0b1/

Comment 13

[Philip Withnall (unavailable)]

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9a1) Gecko/20060708 Minefield/3.0a1
Still WFM.

Comment 14

[Hiro]

In Mac, it crashes when only Camino executes the print preview on the following pages. 
The stack trace looks like comment#11. 
TB21774428K

https://www.kao.co.jp/form/biore/biore060712a/index.html

Mac OS X 10.3.9
trunk Camino 2006080504 (v1.2+)

Comment 15

[Hiro]

Attachment: crash log of Camino

Comment 16

[Martijn Wargers (dead)]

Does it still crash on that page while printing with the latest 1.8 branch build?
And what does it do with the latest trunk build? A minimised testcase would be nice to have.

Comment 17

[peter]

I tested with Mozilla/5.0 (X11; U; Linux i686; sk; rv:1.8.1.8) Gecko/20071022 Ubuntu/7.10 (gutsy) Firefox/2.0.0.8

It dosen't crash.

Comment 18

[Martijn Wargers (dead)]

Peter, thanks for testing.
Marking worksforme, then.