431242 - Crash [@ nsVoidArray::Count] while trying to print

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

(Sorry for not filing the previous print-crash bug as security sensitive, I'll file them as security sensitive from now on)

See testcase, when clicking on the print button and while the printing is going on, current trunk builds of Mozilla crash.
It doesn't seem to happen on branch. If wanted, I can look for a regression range.

http://crash-stats.mozilla.com/report/index/055793ab-1567-11dd-950b-001a4bd46e84?p=1
0  	xul.dll  	nsVoidArray::Count  	 nsVoidArray.h:63
1 	xul.dll 	nsTableFrame::GetColCount 	mozilla/layout/tables/nsTableFrame.h:798
2 	xul.dll 	TableBackgroundPainter::TableBackgroundPainter 	mozilla/layout/tables/nsTablePainter.cpp:249
3 	xul.dll 	nsTableFrame::PaintTableBorderBackground 	mozilla/layout/tables/nsTableFrame.cpp:1469
4 	xul.dll 	nsDisplayTableBorderBackground::Paint 	mozilla/layout/tables/nsTableFrame.cpp:1318
5 	xul.dll 	nsDisplayList::Paint 	mozilla/layout/base/nsDisplayList.cpp:296
6 	xul.dll 	nsLayoutUtils::PaintFrame 	mozilla/layout/base/nsLayoutUtils.cpp:988
7 	xul.dll 	nsPageFrame::PaintPageContent 	mozilla/layout/generic/nsPageFrame.cpp:562
8 	xul.dll 	PaintPageContent 	mozilla/layout/generic/nsPageFrame.cpp:403
9 	xul.dll 	nsDisplayGeneric::Paint 	mozilla/layout/base/nsDisplayList.h:862
10 	xul.dll 	nsDisplayList::Paint 	mozilla/layout/base/nsDisplayList.cpp:296
11 	xul.dll 	nsLayoutUtils::PaintFrame 	mozilla/layout/base/nsLayoutUtils.cpp:988
12 	xul.dll 	nsSimplePageSequenceFrame::PrintNextPage 	mozilla/layout/generic/nsSimplePageSequence.cpp:647
13 	xul.dll 	nsPrintEngine::PrintPage 	mozilla/layout/printing/nsPrintEngine.cpp:2368
14 	xul.dll 	nsPagePrintTimer::Notify 	mozilla/layout/printing/nsPagePrintTimer.cpp:90
15 	xul.dll 	nsTimerImpl::Fire 	mozilla/xpcom/threads/nsTimerImpl.cpp:403
16 	xul.dll 	nsTimerEvent::Run 	mozilla/xpcom/threads/nsTimerImpl.cpp:490
17 	xul.dll 	nsThread::ProcessNextEvent 	mozilla/xpcom/threads/nsThread.cpp:510
18 	xul.dll 	nsBaseAppShell::Run 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170

Comment 1

[Daniel Veditz [:dveditz]]

Looks like a null deref, anyone seeing something scarier here?

Comment 2

[Bernd]

I am the only one, see https://bugzilla.mozilla.org/show_bug.cgi?id=422294#c9

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Can't reproduce after bug 425265.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 318265 [details]
testcase

Hiding the testcase per comment 2