Crash when printing on https://www.which.co.uk/ [@ nsInlineFrame::ReparentFloatsForInlineChild]

RESOLVED WORKSFORME

Status

()

Core
Layout
--
critical
RESOLVED WORKSFORME
10 years ago
7 years ago

People

(Reporter: François Gagné, Unassigned)

Tracking

({crash, regression, testcase})

1.8 Branch
x86
Windows XP
crash, regression, testcase
Points:
---
Bug Flags:
blocking1.8.1.13 -
wanted1.8.1.x +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(4 attachments)

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080203 BonEcho/2.0.0.12pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080203 BonEcho/2.0.0.12pre ID:2008020305

Crash when printing https://www.which.co.uk/reports_and_campaigns/house_and_home/Reports/cleaning/Cleaning%20appliances/Vacuum%20cleaners/Vacuum_cleaners_essential_guide_574_70328_5.jsp

This is on 1.8 branch

The regression range is:
2007-07-02-03 GOOD
2007-07-03-03 BAD

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-02&maxdate=2007-07-03&cvsroot=%2Fcvsroot

Looks like Bug 368863 is the cause

Reproducible: Always

Steps to Reproduce:
1.Open https://www.which.co.uk/reports_and_campaigns/house_and_home/Reports/cleaning/Cleaning%20appliances/Vacuum%20cleaners/Vacuum_cleaners_essential_guide_574_70328_5.jsp
2.Print the page

Actual Results:  
Crash
(Reporter)

Updated

10 years ago
Blocks: 368863
Keywords: crash, regression
(Reporter)

Comment 1

10 years ago
Here the TB41000792W
(Reporter)

Comment 2

10 years ago
Stack from TB41000792W:



nsInlineFrame::ReparentFloatsForInlineChild  [mozilla/layout/generic/nsInlineFrame.cpp, line 346]
nsInlineFrame::ReflowInlineFrame  [mozilla/layout/generic/nsInlineFrame.cpp, line 793]
nsInlineFrame::ReflowFrames  [mozilla/layout/generic/nsInlineFrame.cpp, line 593]
nsInlineFrame::Reflow  [mozilla/layout/generic/nsInlineFrame.cpp, line 490]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 996]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [mozilla/layout/generic/nsBlockFrame.cpp, line 6032]
nsBlockReflowState::FlowAndPlaceFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 863]
nsBlockReflowState::AddFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 637]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [mozilla/layout/generic/nsBlockFrame.cpp, line 6032]
nsBlockReflowState::FlowAndPlaceFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 863]
nsBlockReflowState::AddFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 637]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 3494]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2653]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 3494]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2653]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsPageContentFrame::Reflow  [mozilla/layout/generic/nsPageContentFrame.cpp, line 103]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsPageFrame::Reflow  [mozilla/layout/generic/nsPageFrame.cpp, line 212]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsSimplePageSequenceFrame::Reflow  [mozilla/layout/generic/nsSimplePageSequence.cpp, line 405]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
ViewportFrame::Reflow  [mozilla/layout/generic/nsViewportFrame.cpp, line 240]
PresShell::InitialReflow  [mozilla/layout/base/nsPresShell.cpp, line 2960]
nsPrintEngine::ReflowPrintObject  [mozilla/layout/printing/nsPrintEngine.cpp, line 2734]
nsPrintEngine::ReflowDocList  [mozilla/layout/printing/nsPrintEngine.cpp, line 2502]
nsPrintEngine::SetupToPrintContent  [mozilla/layout/printing/nsPrintEngine.cpp, line 2312]
nsPrintEngine::DocumentReadyForPrinting  [mozilla/layout/printing/nsPrintEngine.cpp, line 2138]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1379]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3950]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1398]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1473]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4353]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
Version: Trunk → 1.8 Branch
I'm also crashing with this build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

So for me at least, the regression range isn't correct.
But I'm reliably crashing, so I can confirm this bug.
Status: UNCONFIRMED → NEW
Ever confirmed: true
(Reporter)

Comment 4

10 years ago
Why is the regression range not good?

2007-07-02-03 GOOD (Before 2007-07-02-03 it's not crashing)
2007-07-03-03 BAD (After 2007-07-03-03 it's crashing)
Created attachment 301135 [details]
unminimized testcase
Ah, sorry, I mistakenly thought the build I mentioned was before the regression range. Never mind, ignore (most of) comment 3.
Created attachment 301138 [details]
smaller, unminimized testcase

I have to go now, if someone could try and minimize it further, that would be great!
(Reporter)

Comment 8

10 years ago
Created attachment 301149 [details]
minimized testcase try 1
(Reporter)

Comment 9

10 years ago
attachment 301149 [details] is smaller in HTML code but not that much in file size (due to the use of Tidy).

Pretty much everything left in the file seem necessary to make the thing crash when printing.
Flags: blocking1.8.1.13?
Created attachment 301275 [details]
minimized testcase

François, thanks for minimizing! I managed to minimize it further now, with the use of page-break-before: always;page-break-after: always;.
Keywords: testcase
blocking branch per bz, appears to be a regression from roc's fix
Assignee: nobody → roc
Flags: wanted1.8.1.x+
Flags: blocking1.8.1.13?
Flags: blocking1.8.1.13+
Bug 386863 was a synthetic test, so probably we broke real sites by fixing a synthetic test :-(. Maybe we should just back that fix out and stop trying to fix obscure synthetic tests on the branch?
(In reply to comment #12)
> Maybe we should just back that fix out and stop trying to
> fix obscure synthetic tests on the branch?

I completely agree with this.
Removing from blocking, I'd rather have a safe obscure printing crash than reopen a published vulnerability.
Flags: blocking1.8.1.13+ → blocking1.8.1.13-

Comment 15

7 years ago
WFM with attachment 301275 [details] and trunk 20110327 to pdf, and 20110228 Firefox/4.0b13pre to real printer

may need another month or two to be sure it is gone via crash-stats because crash rate is very low - last 4 months is average 2-3 per month (for all releases). but no 4.0 crashes so far. and no crashes for 3.6.15.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WORKSFORME
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsInlineFrame::ReparentFloatsForInlineChild]
You need to log in before you can comment on or make changes to this bug.