The default bug view has changed. See this FAQ.

crash when print preview is opened on a certain file styled with meda=print [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth]

VERIFIED FIXED

Status

()

Core
Layout: Tables
--
critical
VERIFIED FIXED
11 years ago
4 years ago

People

(Reporter: Dakota, Assigned: Bernd)

Tracking

({crash, fixed1.8.1.15, testcase})

Trunk
crash, fixed1.8.1.15, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(3 attachments)

(Reporter)

Description

11 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6

Using print preview on this page crashes firefox. The reason for this seems to be the implementation of CSS page breaking. This does not occur if there is only one page of information.

Reproducible: Always

Steps to Reproduce:
1. View file (http://www.tensen.net/research/firefox/display.html)
2. Print Preview
Actual Results:  
Firefox crashes and brings up the crash manager.

Expected Results:  
A preview of the document should have been generated styling the page with the CSS linked to with media=print according to the latest CSS standard published by the W3C.

This problem occured on
Microsoft Windows 2000 5.00.2195
Service Pack 4
(Reporter)

Comment 1

11 years ago
This bug seems to apply only to the 'float' directive. This bug could lead to a loss of data in a different context (fill in a form on an affected page without submitting, print preview, crash, loss of data).
If firefox crashed and brought up the crash manager (called Talkback) did you submit crash data to mozilla? If so, what TalkbackID was it? (You can find talkback.exe in your firefox installation dir, run it, and it will list the crashes you have submitted).
(Reporter)

Comment 3

11 years ago
These are two talkback ids associated with this problem.
TB21774577X
TB21774578Q

Updated

11 years ago
Severity: normal → critical
Keywords: crash, talkbackid
Summary: firefox crashes when print preview is opened on a certain file styled with meda=print → firefox crashes when print preview is opened on a certain file styled with meda=print [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth]
Version: unspecified → 1.5.0.x Branch

Updated

11 years ago
Assignee: nobody → printing
Component: General → Print Preview
Product: Firefox → Core
QA Contact: general
Version: 1.5.0.x Branch → 1.8 Branch

Updated

11 years ago
Summary: firefox crashes when print preview is opened on a certain file styled with meda=print [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth] → firefox crashes when print preview is opened on a certain file styled with meda=print [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth]

Comment 4

11 years ago
Incident ID: 21774578
Stack Signature	BasicTableLayoutStrategy::CalcPctAdjTableWidth d1220000
Product ID	Firefox15
Build ID	2006072814
Trigger Time	2006-08-04 07:32:54.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (002f4691)
URL visited	http://www.tensen.net/research/firefox/display.html
User Comments	print preview on a page styled with media="print"
Since Last Crash	751 sec
Total Uptime	4645 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 1285
Stack Trace 	
BasicTableLayoutStrategy::CalcPctAdjTableWidth  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 1285]
BasicTableLayoutStrategy::AssignPctColumnWidths  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 1382]
BasicTableLayoutStrategy::BalanceColumnWidths  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 245]
nsTableFrame::BalanceColumnWidths  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 3361]
nsTableFrame::ReflowTable  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 2135]
nsTableFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1984]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
nsTableOuterFrame::OuterReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1317]
nsTableOuterFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1962]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3449]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2610]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::ComputeFinalSize  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 1332]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 997]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 5925]
nsBlockReflowState::FlowAndPlaceFloat  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowState.cpp, line 851]
nsBlockReflowState::AddFloat  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowState.cpp, line 629]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 4200]
nsBlockFrame::DoReflowInlineFrames  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3853]
nsBlockFrame::ReflowInlineFrames  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3735]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2729]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 904]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3449]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2610]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 904]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3449]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2610]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 904]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
nsPageContentFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsPageContentFrame.cpp, line 103]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
nsPageFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsPageFrame.cpp, line 210]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
nsSimplePageSequenceFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp, line 405]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
nsHTMLScrollFrame::ReflowScrolledFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 523]
nsHTMLScrollFrame::ReflowContents  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 571]
nsHTMLScrollFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 769]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 240]
PresShell::InitialReflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2871]
nsPrintEngine::ReflowPrintObject  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 2731]
nsPrintEngine::ReflowDocList  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 2499]
nsPrintEngine::SetupToPrintContent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 2309]
nsPrintEngine::DocumentReadyForPrinting  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/printing/nsPrintEngine.cpp, line 2135]
DocumentViewerImpl::PrintPreview  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 3434]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2155]
XPC_WN_CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1445]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1285]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4177]
XPC_NW_FunctionWrapper  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp, line 387]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1208]
Assignee: printing → nobody
Component: Print Preview → Layout: Tables
Keywords: talkbackid
QA Contact: layout.tables
Summary: firefox crashes when print preview is opened on a certain file styled with meda=print [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth] → crash when print preview is opened on a certain file styled with meda=print [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth]

Comment 5

11 years ago
This happens on Linux branch and trunk, too.
OS: Windows 2000 → All
Hardware: PC → All

Updated

11 years ago
Status: UNCONFIRMED → NEW
Ever confirmed: true
Created attachment 232185 [details]
testcase from url

Testcase from url, simplified a bit more, this crashes on print preview for me on current trunk build.
(Reporter)

Comment 7

11 years ago
testcase created at 2006-08-04 12:34 PDT does not crash

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.8) Gecko/20050524 Fedora/1.0.4-4 Firefox/1.0.4

but url does.
Sorry, indeed, the testcase is also only crashing in landscape format for me. It crashes also Mozilla1.7.12, so no (recent) regression.
Version: 1.8 Branch → Trunk
(Reporter)

Comment 9

11 years ago
It may be moot at this point since this bug seems to be platform independent, but the url also crashes

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6
(Assignee)

Comment 10

11 years ago
Martijn the stack is a typical cellmap crash watch for the rowgroups and how they split if you like to work on it, I am away till 06-08-21
(Assignee)

Comment 11

11 years ago
Created attachment 235667 [details] [diff] [review]
patch
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
(Assignee)

Comment 12

11 years ago
Comment on attachment 235667 [details] [diff] [review]
patch

have a look at OrderRowGroups to understand why reordering does not help with this.
Attachment #235667 - Flags: superreview?(roc)
Attachment #235667 - Flags: review?(roc)
Attachment #235667 - Flags: superreview?(roc)
Attachment #235667 - Flags: superreview+
Attachment #235667 - Flags: review?(roc)
Attachment #235667 - Flags: review+
(Assignee)

Comment 13

11 years ago
fix checked in
(Assignee)

Updated

11 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
(In reply to comment #8)
> Sorry, indeed, the testcase is also only crashing in landscape format for me.
> It crashes also Mozilla1.7.12, so no (recent) regression.

Don't we need a separate bug split off for this testcase using landscape?

I too no longer crash in portrait mode with the attachment, and neither landscape nor portrait with the live URL in comment 0, but I *do* still crash with Martijn's testcase in comment 8, with landscape.
(In reply to comment #14)
> I too no longer crash in portrait mode with the attachment, and neither
> landscape nor portrait with the live URL in comment 0, but I *do* still crash
> with Martijn's testcase in comment 8, with landscape.

Yeah, I'm crashing too with a 2006-09-07 trunk build, talkback ID: TB23149944K
This is still with the same kind of backtrace -> reopening

Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(Assignee)

Comment 16

11 years ago
argh, I forgot the other half to get reviewed. The problem is that we need something like http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/tables/nsTableRowGroupFrame.cpp&rev=3.367&mark=1528-1531#1525
at the end of the ::reflow method instead of the incr. reflow methods.

If we do this the testcase, will trigger the float hang like bug 285608.
(Assignee)

Comment 17

11 years ago
Created attachment 238671 [details] [diff] [review]
patch

Robert, I think this is the right thing to do, however once checked in the testcase will not crash but hang due to bug bug 285608. I am not sure that this is an improvement (other that we access deleted memory)
Attachment #238671 - Flags: superreview?(roc)
Attachment #238671 - Flags: review?(roc)
(Assignee)

Comment 18

11 years ago
We have this already on reflow branch

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/tables/nsTableRowGroupFrame.cpp&rev=REFLOW_20060830_BRANCH&root=/cvsroot&mark=1245-1250#1240
Comment on attachment 238671 [details] [diff] [review]
patch

I agree it's the right thing.
Attachment #238671 - Flags: superreview?(roc)
Attachment #238671 - Flags: superreview+
Attachment #238671 - Flags: review?(roc)
Attachment #238671 - Flags: review+
Comment on attachment 238671 [details] [diff] [review]
patch

I agree it's the right thing.
(Assignee)

Comment 21

11 years ago
fix checked in. Please note that the new behavior on the test case could/should be a hang
Status: REOPENED → RESOLVED
Last Resolved: 11 years ago11 years ago
Resolution: --- → FIXED
Verified FIXED with the testcase at https://bugzilla.mozilla.org/attachment.cgi?id=232185 (no longer causes a crash, but hangs due to bug 285608) using build 2006-10-01-08 of SeaMonkey trunk under Windows XP.
Status: RESOLVED → VERIFIED
(Assignee)

Updated

9 years ago
Blocks: 378027
(Assignee)

Comment 23

9 years ago
Comment on attachment 235667 [details] [diff] [review]
patch

taking both patches fixes the crash on the dependent bug
Attachment #235667 - Flags: approval1.8.1.14?
(Assignee)

Updated

9 years ago
Attachment #238671 - Flags: approval1.8.1.14?
Comment on attachment 235667 [details] [diff] [review]
patch

approved for 1.8.1.14, a=dveditz for release-drivers
Attachment #235667 - Flags: approval1.8.1.14? → approval1.8.1.14+
Comment on attachment 238671 [details] [diff] [review]
patch

approved for 1.8.1.14, a=dveditz for release-drivers
Attachment #238671 - Flags: approval1.8.1.14? → approval1.8.1.14+
(Assignee)

Comment 26

9 years ago
fix checked in into branch
Keywords: fixed1.8.1.14
Tried to verify on XP by checking to see if Firefox 2.0.0.14 (also 2.0.0.13) crashed with original test case, but it didn't. So I tried the test case mentioned in comment #8. Print preview in landscape mode crashed it. Then I looked at Firefox 2.0.0.15pre, but while it doesn't crash, it hangs, becomes unresponsive and eventually you get the option to kill it.

Updated

8 years ago
Flags: in-testsuite?
Keywords: testcase
Crash Signature: [@ BasicTableLayoutStrategy::CalcPctAdjTableWidth]
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2ad79139e529
Flags: in-testsuite? → in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/2ad79139e529
You need to log in before you can comment on or make changes to this bug.