Closed Bug 415447 Opened 13 years ago Closed 10 years ago

Crash when printing on https://www.which.co.uk/ [@ nsInlineFrame::ReparentFloatsForInlineChild]

Categories

(Core :: Layout, defect)

1.8 Branch
x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: frenchfrog, Unassigned)

References

()

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(4 files)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080203 BonEcho/2.0.0.12pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080203 BonEcho/2.0.0.12pre ID:2008020305

Crash when printing https://www.which.co.uk/reports_and_campaigns/house_and_home/Reports/cleaning/Cleaning%20appliances/Vacuum%20cleaners/Vacuum_cleaners_essential_guide_574_70328_5.jsp

This is on 1.8 branch

The regression range is:
2007-07-02-03 GOOD
2007-07-03-03 BAD

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-02&maxdate=2007-07-03&cvsroot=%2Fcvsroot

Looks like Bug 368863 is the cause

Reproducible: Always

Steps to Reproduce:
1.Open https://www.which.co.uk/reports_and_campaigns/house_and_home/Reports/cleaning/Cleaning%20appliances/Vacuum%20cleaners/Vacuum_cleaners_essential_guide_574_70328_5.jsp
2.Print the page

Actual Results:  
Crash
Blocks: 368863
Keywords: crash, regression
Here the TB41000792W
Stack from TB41000792W:



nsInlineFrame::ReparentFloatsForInlineChild  [mozilla/layout/generic/nsInlineFrame.cpp, line 346]
nsInlineFrame::ReflowInlineFrame  [mozilla/layout/generic/nsInlineFrame.cpp, line 793]
nsInlineFrame::ReflowFrames  [mozilla/layout/generic/nsInlineFrame.cpp, line 593]
nsInlineFrame::Reflow  [mozilla/layout/generic/nsInlineFrame.cpp, line 490]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 996]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [mozilla/layout/generic/nsBlockFrame.cpp, line 6032]
nsBlockReflowState::FlowAndPlaceFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 863]
nsBlockReflowState::AddFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 637]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowFloat  [mozilla/layout/generic/nsBlockFrame.cpp, line 6032]
nsBlockReflowState::FlowAndPlaceFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 863]
nsBlockReflowState::AddFloat  [mozilla/layout/generic/nsBlockReflowState.cpp, line 637]
nsLineLayout::ReflowFrame  [mozilla/layout/generic/nsLineLayout.cpp, line 1019]
nsBlockFrame::ReflowInlineFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 4247]
nsBlockFrame::DoReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3900]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsBlockFrame.cpp, line 3781]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2774]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 3494]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2653]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsBlockReflowContext::ReflowBlock  [mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 3494]
nsBlockFrame::ReflowLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 2653]
nsBlockFrame::ReflowDirtyLines  [mozilla/layout/generic/nsBlockFrame.cpp, line 2304]
nsBlockFrame::Reflow  [mozilla/layout/generic/nsBlockFrame.cpp, line 906]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsPageContentFrame::Reflow  [mozilla/layout/generic/nsPageContentFrame.cpp, line 103]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsPageFrame::Reflow  [mozilla/layout/generic/nsPageFrame.cpp, line 212]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
nsSimplePageSequenceFrame::Reflow  [mozilla/layout/generic/nsSimplePageSequence.cpp, line 405]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 909]
ViewportFrame::Reflow  [mozilla/layout/generic/nsViewportFrame.cpp, line 240]
PresShell::InitialReflow  [mozilla/layout/base/nsPresShell.cpp, line 2960]
nsPrintEngine::ReflowPrintObject  [mozilla/layout/printing/nsPrintEngine.cpp, line 2734]
nsPrintEngine::ReflowDocList  [mozilla/layout/printing/nsPrintEngine.cpp, line 2502]
nsPrintEngine::SetupToPrintContent  [mozilla/layout/printing/nsPrintEngine.cpp, line 2312]
nsPrintEngine::DocumentReadyForPrinting  [mozilla/layout/printing/nsPrintEngine.cpp, line 2138]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1379]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3950]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1398]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1473]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4353]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
Version: Trunk → 1.8 Branch
I'm also crashing with this build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

So for me at least, the regression range isn't correct.
But I'm reliably crashing, so I can confirm this bug.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Why is the regression range not good?

2007-07-02-03 GOOD (Before 2007-07-02-03 it's not crashing)
2007-07-03-03 BAD (After 2007-07-03-03 it's crashing)
Ah, sorry, I mistakenly thought the build I mentioned was before the regression range. Never mind, ignore (most of) comment 3.
I have to go now, if someone could try and minimize it further, that would be great!
attachment 301149 [details] is smaller in HTML code but not that much in file size (due to the use of Tidy).

Pretty much everything left in the file seem necessary to make the thing crash when printing.
Flags: blocking1.8.1.13?
Attached file minimized testcase
François, thanks for minimizing! I managed to minimize it further now, with the use of page-break-before: always;page-break-after: always;.
Keywords: testcase
blocking branch per bz, appears to be a regression from roc's fix
Assignee: nobody → roc
Flags: wanted1.8.1.x+
Flags: blocking1.8.1.13?
Flags: blocking1.8.1.13+
Bug 386863 was a synthetic test, so probably we broke real sites by fixing a synthetic test :-(. Maybe we should just back that fix out and stop trying to fix obscure synthetic tests on the branch?
(In reply to comment #12)
> Maybe we should just back that fix out and stop trying to
> fix obscure synthetic tests on the branch?

I completely agree with this.
Removing from blocking, I'd rather have a safe obscure printing crash than reopen a published vulnerability.
Flags: blocking1.8.1.13+ → blocking1.8.1.13-
WFM with attachment 301275 [details] and trunk 20110327 to pdf, and 20110228 Firefox/4.0b13pre to real printer

may need another month or two to be sure it is gone via crash-stats because crash rate is very low - last 4 months is average 2-3 per month (for all releases). but no 4.0 crashes so far. and no crashes for 3.6.15.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ nsInlineFrame::ReparentFloatsForInlineChild]
You need to log in before you can comment on or make changes to this bug.