363272 - Print Preview crashes app when closing PP (or when changing paper orientation) [@ nsSplittableFrame::RemoveFromFlow]

Status: RESOLVED DUPLICATE of bug 362210

(Core :: Layout, defect)

Description

[Frank Wein [:mcsmurf]]

To reproduce:
1. Go to URL (other websites also "work" for crashing, not sure if a minimal testcase is needed here)
2. Open Print Preview
3. Close it with the "Close" button

Stacktrace:
ChildEBP RetAddr  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f2e8 018a4619 0x0
0012f300 018a46c2 gklayout!nsSplittableFrame::RemoveFromFlow(class nsIFrame * aFrame = 0x018a0077)+0x67 [h:\mozilla\tree-main\mozilla\layout\generic\nssplittableframe.cpp @ 224]
0012f30c 0189578e gklayout!nsSplittableFrame::Destroy(void)+0x15 [h:\mozilla\tree-main\mozilla\layout\generic\nssplittableframe.cpp @ 69]
0012f31c 018a0077 gklayout!nsContainerFrame::Destroy(void)+0x55 [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 168]
0012f334 018949f6 gklayout!nsBlockFrame::Destroy(void)+0x89 [h:\mozilla\tree-main\mozilla\layout\generic\nsblockframe.cpp @ 313]
0012f340 0189576a gklayout!nsFrameList::DestroyFrames(void)+0x12 [h:\mozilla\tree-main\mozilla\layout\generic\nsframelist.cpp @ 60]
0012f350 018949f6 gklayout!nsContainerFrame::Destroy(void)+0x31 [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 164]
0012f35c 0189576a gklayout!nsFrameList::DestroyFrames(void)+0x12 [h:\mozilla\tree-main\mozilla\layout\generic\nsframelist.cpp @ 60]
0012f36c 018949f6 gklayout!nsContainerFrame::Destroy(void)+0x31 [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 164]
0012f378 0189576a gklayout!nsFrameList::DestroyFrames(void)+0x12 [h:\mozilla\tree-main\mozilla\layout\generic\nsframelist.cpp @ 60]
0012f388 018949f6 gklayout!nsContainerFrame::Destroy(void)+0x31 [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 164]
0012f394 0189576a gklayout!nsFrameList::DestroyFrames(void)+0x12 [h:\mozilla\tree-main\mozilla\layout\generic\nsframelist.cpp @ 60]
0012f3a4 018949f6 gklayout!nsContainerFrame::Destroy(void)+0x31 [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 164]
0012f3b0 0189576a gklayout!nsFrameList::DestroyFrames(void)+0x12 [h:\mozilla\tree-main\mozilla\layout\generic\nsframelist.cpp @ 60]
0012f3c0 0187965f gklayout!nsContainerFrame::Destroy(void)+0x31 [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 164]
0012f3cc 0185cdde gklayout!nsFrameManager::Destroy(void)+0x29 [h:\mozilla\tree-main\mozilla\layout\base\nsframemanager.cpp @ 303]
0012f3e4 01864ec3 gklayout!PresShell::Destroy(void)+0x16a [h:\mozilla\tree-main\mozilla\layout\base\nspresshell.cpp @ 1676]
0012f42c 01a179ab gklayout!DocumentViewerImpl::InstallNewPresentation(void)+0xfc [h:\mozilla\tree-main\mozilla\layout\base\nsdocumentviewer.cpp @ 4208]
0012f438 01a189af gklayout!nsPrintEngine::FinishPrintPreview(void)+0x48 [h:\mozilla\tree-main\mozilla\layout\printing\nsprintengine.cpp @ 3634]
0012f488 018649e0 gklayout!nsPrintEngine::PrintPreview(class nsIPrintSettings * aPrintSettings = 0x0afc2a10, class nsIDOMWindow * aChildDOMWin = 0x00000000, class nsIWebProgressListener * aWebProgressListener = 0x0a43b914)+0x617 [h:\mozilla\tree-main\mozilla\layout\printing\nsprintengine.cpp @ 1078]

I get the same stack trace when changing the paper orientation.
This seems to be a regression from the reflow branch landing, 2006-12-07-08 does not crash, whereas 2006-12-08-08 crashes.

Comment 1

[Frank Wein [:mcsmurf]]

Actually Bug 362708 might also be to blame... (check-in comment was "Fix a Print Preview crash. b=362708 r=bernd sr=roc" and nsCSSFrameConstructor.cpp was changed).

Comment 2

[Frank Wein [:mcsmurf]]

Mats: May this bug here be caused by Bug 362708?

Comment 3

[Bernd]

Its highly unlikely that bug 362708 is involved, I see tons of 

###!!! ASSERTION: frame was not removed from primary frame map before destructio
n or was readded to map after being removed: 'Not Reached', file d:/moz_src/mozi
lla/layout/base/nsFrameManager.cpp, line 727

And the first mentions a blockframe without any reference to a table

Comment 4

[Frank Wein [:mcsmurf]]

Right, with a debug build it already crashes while opening print preview and spits out hundreds of assertions mentioned in Comment 3.
Stack trace:
ChildEBP RetAddr  
0012d57c 01ce6c99 gklayout!nsCSSFrameConstructor::FindFrameWithContent(class nsFrameManager * aFrameManager = 0x0351c54c, class nsIFrame * aParentFrame = 0x042a6a38, class nsIContent * aParentContent = 0x04349d50, class nsIContent * aContent = 0x0434a0a8, struct nsFindFrameHint * aHint = 0x00000000)+0x185 [h:\mozilla\tree-main\mozilla\layout\base\nscssframeconstructor.cpp @ 11077]
0012d5b4 01cede83 gklayout!nsCSSFrameConstructor::FindPrimaryFrameFor(class nsFrameManager * aFrameManager = 0x0351c54c, class nsIContent * aContent = 0x0434a0a8, class nsIFrame ** aFrame = 0x0012d5e4, struct nsFindFrameHint * aHint = 0x00000000)+0xa9 [h:\mozilla\tree-main\mozilla\layout\base\nscssframeconstructor.cpp @ 11168]
0012d5ec 01ce6c6b gklayout!nsFrameManager::GetPrimaryFrameFor(class nsIContent * aContent = 0x0434a0a8, int aIndexHint = -1)+0x1a3 [h:\mozilla\tree-main\mozilla\layout\base\nsframemanager.cpp @ 415]
0012d618 01cede83 gklayout!nsCSSFrameConstructor::FindPrimaryFrameFor(class nsFrameManager * aFrameManager = 0x0351c54c, class nsIContent * aContent = 0x03d78f58, class nsIFrame ** aFrame = 0x0012d648, struct nsFindFrameHint * aHint = 0x00000000)+0x7b [h:\mozilla\tree-main\mozilla\layout\base\nscssframeconstructor.cpp @ 11164]
0012d650 01caad4c gklayout!nsFrameManager::GetPrimaryFrameFor(class nsIContent * aContent = 0x03d78f58, int aIndexHint = -1)+0x1a3 [h:\mozilla\tree-main\mozilla\layout\base\nsframemanager.cpp @ 415]
0012d664 01ce4d9d gklayout!PresShell::GetPrimaryFrameFor(class nsIContent * aContent = 0x03d78f58)+0x1c [h:\mozilla\tree-main\mozilla\layout\base\nspresshell.cpp @ 5163]
0012d6a4 01caa665 gklayout!nsCSSFrameConstructor::CharacterDataChanged(class nsIContent * aContent = 0x03d78f58, int aAppend = 0)+0x3d [h:\mozilla\tree-main\mozilla\layout\base\nscssframeconstructor.cpp @ 10126]
0012d6bc 01feeba2 gklayout!PresShell::CharacterDataChanged(class nsIDocument * aDocument = 0x0422dba8, class nsIContent * aContent = 0x03d78f58, struct CharacterDataChangeInfo * aInfo = 0x0012d82c)+0xb5 [h:\mozilla\tree-main\mozilla\layout\base\nspresshell.cpp @ 4936]
0012d6e8 01f01d2e gklayout!nsBindingManager::CharacterDataChanged(class nsIDocument * aDocument = 0x0422dba8, class nsIContent * aContent = 0x03d78f58, struct CharacterDataChangeInfo * aInfo = 0x0012d82c)+0x62 [h:\mozilla\tree-main\mozilla\content\xbl\src\nsbindingmanager.cpp @ 1163]
0012d720 01f1403a gklayout!nsNodeUtils::CharacterDataChanged(class nsIContent * aContent = 0x03d78f58, struct CharacterDataChangeInfo * aInfo = 0x0012d82c)+0x8e [h:\mozilla\tree-main\mozilla\content\base\src\nsnodeutils.cpp @ 88]
0012d860 01f13b02 gklayout!nsGenericDOMDataNode::SetTextInternal(unsigned int aOffset = 0, unsigned int aCount = 1, unsigned short * aBuffer = 0x00919d3c, unsigned int aLength = 0, int aNotify = 1)+0x35a [h:\mozilla\tree-main\mozilla\content\base\src\nsgenericdomdatanode.cpp @ 470]
0012d880 01efe2e2 gklayout!nsGenericDOMDataNode::SetData(class nsAString_internal * aData = 0x0093e36c)+0x32 [h:\mozilla\tree-main\mozilla\content\base\src\nsgenericdomdatanode.cpp @ 312]
0012d88c 01d0a020 gklayout!nsTextNode::SetData(class nsAString_internal * aData = 0x0093e36c)+0x12 [h:\mozilla\tree-main\mozilla\content\base\src\nstextnode.cpp @ 70]
0012d8ac 01cd2e5d gklayout!nsQuoteList::RecalcAll(void)+0x70 [h:\mozilla\tree-main\mozilla\layout\base\nsquotelist.cpp @ 98]
0012d8b8 01cd2e0f gklayout!nsCSSFrameConstructor::QuotesDirty(void)+0x2d [h:\mozilla\tree-main\mozilla\layout\base\nscssframeconstructor.h @ 975]
0012d8c4 01ca4aa1 gklayout!nsCSSFrameConstructor::NotifyDestroyingFrame(class nsIFrame * aFrame = 0x042a6bc4)+0x2f [h:\mozilla\tree-main\mozilla\layout\base\nscssframeconstructor.cpp @ 1942]
0012d8d4 01d2c437 gklayout!PresShell::NotifyDestroyingFrame(class nsIFrame * aFrame = 0x042a6bc4)+0x21 [h:\mozilla\tree-main\mozilla\layout\base\nspresshell.cpp @ 2916]
0012d904 01d8f07d gklayout!nsFrame::Destroy(void)+0x87 [h:\mozilla\tree-main\mozilla\layout\generic\nsframe.cpp @ 648]
0012d910 01d46feb gklayout!nsSplittableFrame::Destroy(void)+0x2d [h:\mozilla\tree-main\mozilla\layout\generic\nssplittableframe.cpp @ 74]
0012d920 01d45d17 gklayout!nsContainerFrame::Destroy(void)+0x7b [h:\mozilla\tree-main\mozilla\layout\generic\nscontainerframe.cpp @ 169]

Comment 5

[Bernd]

dupe of bug 362210?

Comment 6

[Eli Friedman]

(In reply to comment #5)
> dupe of bug 362210?

I think so; marking.

*** This bug has been marked as a duplicate of 362210 ***