362707 - Crash [@ nsGfxScrollFrameInner::SaveState] on print preview using thead, tfoot and overflow:scroll

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes current trunk builds on print preview.
It doesn't crash branch builds, so it seems like a regression.
It also doesn't crash reflow branch builds (so this crash is probably not that important).

Talkback ID: TB26837814Y
nsGfxScrollFrameInner::SaveState  [mozilla\layout\generic\nsgfxscrollframe.cpp, line 2688]
nsHTMLScrollFrame::SaveState  [mozilla\layout\generic\nsgfxscrollframe.h, line 311]
nsCSSFrameConstructor::CreateContinuingTableFrame  [mozilla\layout\base\nscssframeconstructor.cpp, line 10714]
nsCSSFrameConstructor::CreateContinuingFrame  [mozilla\layout\base\nscssframeconstructor.cpp, line 10823]
nsCSSFrameConstructor::CreateContinuingOuterTableFrame  [mozilla\layout\base\nscssframeconstructor.cpp, line 10637]
nsCSSFrameConstructor::CreateContinuingFrame  [mozilla\layout\base\nscssframeconstructor.cpp, line 10819]
nsHTMLContainerFrame::CreateNextInFlow  [mozilla\layout\generic\nshtmlcontainerframe.cpp, line 353]
nsBlockFrame::CreateContinuationFor  [mozilla\layout\generic\nsblockframe.cpp, line 4383]
nsBlockFrame::ReflowBlockFrame  [mozilla\layout\generic\nsblockframe.cpp, line 3637]
0x40000000

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[-fullmetaljacket-]

testcase does not crash, it successfully print previewed a two page document.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a1) Gecko/20061204 Minefield/3.0a1 ID:2006120400 [cairo]

Comment 3

[Carsten Book [:Tomcat]]

Does NOT crash on Print Preview, but DOES crash on Print with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20061201 GranParadiso/3.0a1 (RC2) on testcase

The Talkback ID TB26863585G isn`t really useful here.

Comment 4

[Bernd]

wfm with opt and debug :-(, not even a single assert. Either this testcase needs to be changed to use page-break properties or it will stay dormant for a long time.

Comment 5

[Martijn Wargers (dead)]

Attachment: testcase2

Ok, does this crash for you then?
This testcase is also crashing on branches for me.

Comment 6

[Bernd]

That does what *you* expect it to do, very nice, thanks, that is very fine to work on it.

Comment 7

[-fullmetaljacket-]

now it crashes on

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a1) Gecko/20061204 Minefield/3.0a1 ID:2006120423 [cairo]

Talkback ID: TB26938420H

http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB26938420H

Stack Signature	 nsSimplePageSequenceFrame::Reflow e4b8d20e
Product ID	FirefoxTrunk
Build ID	2006120408
Trigger Time	2006-12-05 15:50:20.0
Platform	Win32
Operating System	Windows NT 6.0 build 5744
Module	firefox.exe + (002deb00)
URL visited	
User Comments	testing some bug
Since Last Crash	20361 sec
Total Uptime	22890 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-mozilla1.9-release\winnt_5.2_depend\mozilla\layout\generic\nssimplepagesequence.cpp, line 350
Stack Trace 	
nsSimplePageSequenceFrame::Reflow   nsSimplePageSequenceFrame::Reflow   nsQuoteNode::`scalar deleting destructor'
nsCSSFrameConstructor::CreateContinuingFrame   nsCounterNode::nsCounterNode   nsCSSFrameConstructor::CreateContinuingFrame   nsStyleUtil::FindNextLargerFontSize   nsBlockFrame::PaintTextDecorationLine   nsBlockFrame::ReflowInlineFrames   nsBlockFrame::Reflow   nsCSSDisplay::~nsCSSDisplay   AtomTableMatchKey   nsScrollPortView::ScrollTo   

Comment 8

[Martijn Wargers (dead)]

The testcases don't crash anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061208 Minefield/3.0a1
Both testcases don't crash anymore on print preview.
The first testcase crashes Mozilla when closing print preview, but that's because the reflow branch has landed and has been filed as bug 362210.
So I guess this is indeed fixed by the patch for bug 362708.

Testcase2 however, doesn't show a second page anymore on print preview. That seems incorrect to me. I'm not sure if it's due to the fix for bug 362708 or because of the reflow branch landing.
I guess I should just file a new bug on that?

Comment 9

[Mats Palmgren (inactive)]

Martijn, please file a separate bug on the missing 2nd page and mark it
dependent on bug 362210. I tried the current patch in bug 362210 but it
didn't help so it might be a different problem. I noted that adding an
empty <td> in the <thead> (testcase2) does produce the 2nd page.

This crash was fixed by bug 362708.

Comment 10

[Martijn Wargers (dead)]

(In reply to comment #9)
> Martijn, please file a separate bug on the missing 2nd page and mark it

Ok, I filed bug 363726 (sorry for the delay).