415447 - Crash when printing on https://www.which.co.uk/ [@ nsInlineFrame::ReparentFloatsForInlineChild]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[François Gagné]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080203 BonEcho/2.0.0.12pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080203 BonEcho/2.0.0.12pre ID:2008020305

Crash when printing https://www.which.co.uk/reports_and_campaigns/house_and_home/Reports/cleaning/Cleaning%20appliances/Vacuum%20cleaners/Vacuum_cleaners_essential_guide_574_70328_5.jsp

This is on 1.8 branch

The regression range is:
2007-07-02-03 GOOD
2007-07-03-03 BAD

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-02&maxdate=2007-07-03&cvsroot=%2Fcvsroot

Looks like Bug 368863 is the cause

Reproducible: Always

Steps to Reproduce:
1.Open https://www.which.co.uk/reports_and_campaigns/house_and_home/Reports/cleaning/Cleaning%20appliances/Vacuum%20cleaners/Vacuum_cleaners_essential_guide_574_70328_5.jsp
2.Print the page

Actual Results:  
Crash

Comment 1

[François Gagné]

Here the TB41000792W

Comment 2

[François Gagné]

Stack from TB41000792W:



nsInlineFrame::ReparentFloatsForInlineChild  [mozilla/layout/generic/nsInlineFrame.cpp, line 346]
nsInlineFrame::ReflowInlineFrame  [mozilla/layout/generic/nsInlineFrame.cpp, line 793]
nsInlineFrame::ReflowFrames  [mozilla/layout/generic/nsInlineFrame.cpp, line 593]
nsInlineFrame::Reflow  [mozilla/layout/generic/nsInlineFrame.cpp, line 490]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 996]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [mozilla/layout/generic/nsBlockFrame.cpp, line 6032]
nsBlockReflowState::FlowAndPlaceFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 863]
nsBlockReflowState::AddFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 637]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [mozilla/layout/generic/nsBlockFrame.cpp, line 6032]
nsBlockReflowState::FlowAndPlaceFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 863]
nsBlockReflowState::AddFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 637]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 3494]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2653]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 3494]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2653]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsPageContentFrame::Reflow  [mozilla/layout/generic/nsPageContentFrame.cpp, line 103]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsPageFrame::Reflow  [mozilla/layout/generic/nsPageFrame.cpp, line 212]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsSimplePageSequenceFrame::Reflow  [mozilla/layout/generic/nsSimplePageSequence.cpp, line 405]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
ViewportFrame::Reflow  [mozilla/layout/generic/nsViewportFrame.cpp, line 240]
PresShell::InitialReflow  [mozilla/layout/base/nsPresShell.cpp, line 2960]
nsPrintEngine::ReflowPrintObject  [mozilla/layout/printing/nsPrintEngine.cpp, line 2734]
nsPrintEngine::ReflowDocList  [mozilla/layout/printing/nsPrintEngine.cpp, line 2502]
nsPrintEngine::SetupToPrintContent  [mozilla/layout/printing/nsPrintEngine.cpp, line 2312]
nsPrintEngine::DocumentReadyForPrinting  [mozilla/layout/printing/nsPrintEngine.cpp, line 2138]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1379]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3950]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1398]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1473]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4353]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]

Comment 3

[Martijn Wargers (dead)]

I'm also crashing with this build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

So for me at least, the regression range isn't correct.
But I'm reliably crashing, so I can confirm this bug.

Comment 4

[François Gagné]

Why is the regression range not good?

2007-07-02-03 GOOD (Before 2007-07-02-03 it's not crashing)
2007-07-03-03 BAD (After 2007-07-03-03 it's crashing)

Comment 5

[Martijn Wargers (dead)]

Attachment: unminimized testcase

Comment 6

[Martijn Wargers (dead)]

Ah, sorry, I mistakenly thought the build I mentioned was before the regression range. Never mind, ignore (most of) comment 3.

Comment 7

[Martijn Wargers (dead)]

Attachment: smaller, unminimized testcase

I have to go now, if someone could try and minimize it further, that would be great!

Comment 8

[François Gagné]

Attachment: minimized testcase try 1

Comment 9

[François Gagné]

attachment 301149 [details] is smaller in HTML code but not that much in file size (due to the use of Tidy).

Pretty much everything left in the file seem necessary to make the thing crash when printing.

Comment 10

[Martijn Wargers (dead)]

Attachment: minimized testcase

François, thanks for minimizing! I managed to minimize it further now, with the use of page-break-before: always;page-break-after: always;.

Comment 11

[Daniel Veditz [:dveditz]]

blocking branch per bz, appears to be a regression from roc's fix

Comment 12

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Bug 386863 was a synthetic test, so probably we broke real sites by fixing a synthetic test :-(. Maybe we should just back that fix out and stop trying to fix obscure synthetic tests on the branch?

Comment 13

[Martijn Wargers (dead)]

(In reply to comment #12)
> Maybe we should just back that fix out and stop trying to
> fix obscure synthetic tests on the branch?

I completely agree with this.

Comment 14

[Daniel Veditz [:dveditz]]

Removing from blocking, I'd rather have a safe obscure printing crash than reopen a published vulnerability.

Comment 15

[Wayne Mery (:wsmwk)]

WFM with attachment 301275 [details] and trunk 20110327 to pdf, and 20110228 Firefox/4.0b13pre to real printer

may need another month or two to be sure it is gone via crash-stats because crash rate is very low - last 4 months is average 2-3 per month (for all releases). but no 4.0 crashes so far. and no crashes for 3.6.15.