Closed Bug 362724 Opened 13 years ago Closed 13 years ago

Crash [@ nsIView::Destroy] on print preview

Categories

(Core :: Layout, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: bernd_mozilla)

Details

(4 keywords, Whiteboard: [sg:moderate?])

Crash Data

Attachments

(5 files, 1 obsolete file)

See upcoming testcases.
The unminimised testcase crashes on print preview. The minimised testcase crashes when closing print preview for me.
The unminimised testcase also crashes on reflow branch builds for me.
But the testcase don't crash on the latest 1.8 branch. It seems to be fixed somehow on the 1.8 branch between 2006-08-02 and 2006-08-03:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-08-02+04&maxdate=2006-08-03+07&cvsroot=%2Fcvsroot
Maybe fixed somehow with the patch for bug 302911?
Attached file Minimised testcase (obsolete) —
This doesn't crash for me, can you produce a reflow log so that I can estimate what frames are involved.
Attached file logfile
This is the log from the moment when I opened up the unminimised testcase in print preview, until I closed print preview (in which I crash).
I hope it's useful.
Martijn, is it possible to convert your test cases from pixel heights to page-break properties (http://www.w3.org/TR/REC-CSS2/page.html#page-breaks)? This would make them much more reliable.
I get a couple of asserts with the unminimized testcase

###!!! ASSERTION: Allowed only one anonymous view between frames: 'ancestorView
== view->GetParent()->GetParent()', file d:/moz_src/mozilla/layout/generic/nsCon
tainerFrame.cpp, line 272
###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aN
extSibling', file d:\moz_src\mozilla\layout\generic\nsIFrame.h, line 677

could you please create minimized test cases for the asserts (bonus points if they work with the page-break properties ;-) )

Attached file Minimised testcase
(In reply to comment #5)
> Martijn, is it possible to convert your test cases from pixel heights to
> page-break properties (http://www.w3.org/TR/REC-CSS2/page.html#page-breaks)?
> This would make them much more reliable.

Ok, thanks, this allowed me to minimise the minimised testcase to this. I hope this one crashes for you when closing print preview, it does for me.
Attachment #247408 - Attachment is obsolete: true
Attached file testcase2
Testcase that gives the "###!!! ASSERTION: Allowed only one anonymous view between frames: 'ancestorView== view->GetParent()->GetParent()'" assertion.
It uses page-break-after: always; ==> 1st bonus point for me.
Attached file testcase3
No bonus points for this one.
This gives the "###!!! ASSERTION: Creating a circular frame list, this is very bad.:" on print preview for me.
It isn't as minimised as far as I could, but still quite a bit complicated.
cool that works now very smooth to get lizard down to its knees
Attached patch patchSplinter Review
This is basically what you did 3.5 years ago for blocks
https://bugzilla.mozilla.org/show_bug.cgi?id=201767#c19
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
Attachment #247852 - Flags: superreview?(roc)
Attachment #247852 - Flags: review?(roc)
The patch fixes the crash, but the assert from testcase 3 is something different
Testcase 3 should be split into a separate probably public bug as it has no views involved.
Attachment #247852 - Flags: superreview?(roc)
Attachment #247852 - Flags: superreview+
Attachment #247852 - Flags: review?(roc)
Attachment #247852 - Flags: review+
(In reply to comment #13)
> Testcase 3 should be split into a separate probably public bug as it has no
> views involved.

Ok, I filed bug 363120 for that.

fix checked in, we need this probably on every branch that is maintained
Attachment #247852 - Flags: approval1.8.1.2?
Attachment #247852 - Flags: approval1.8.0.10?
Comment on attachment 247852 [details] [diff] [review]
patch

bug 362837
Attachment #247852 - Flags: approval1.8.1.2?
Attachment #247852 - Flags: approval1.8.1.2+
Attachment #247852 - Flags: approval1.8.0.10?
Attachment #247852 - Flags: approval1.8.0.10+
fixed on branches on dec. 27th 2006
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: [sg:moderate?]
Verified fixed on the latest 1.8.0.x and latest 1.8.1 branch builds, no crash anymore when closing print preview on the testcases.
The latest trunk builds hang on print preview on certain testcases, I think that's what bug 363120 is basically about.
Status: RESOLVED → VERIFIED
Group: security
Depends on: 372487
No longer depends on: 372487
Crash Signature: [@ nsIView::Destroy]
You need to log in before you can comment on or make changes to this bug.