Crash [@ nsLayoutUtils::GetStyleFrame(nsIFrame*) ] when printing with tfoot::after position:fixed

RESOLVED FIXED in mozilla8

Status

()

Core
Printing: Output
P1
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: bz)

Tracking

(Depends on: 1 bug, {crash, regression, testcase})

Trunk
mozilla8
x86
Windows 7
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 549409 [details]
testcase

See testcase, which crashes current trunk build on print/print preview.

This looks like a regression from bug 577450.

https://crash-stats.mozilla.com/report/index/714bb842-6659-4ca6-9d30-b8b4d2110729
0 	xul.dll 	nsLayoutUtils::GetStyleFrame 	layout/base/nsLayoutUtils.cpp:419
1 	xul.dll 	nsCSSFrameConstructor::ReplicateFixedFrames 	layout/base/nsCSSFrameConstructor.cpp:8705
2 	xul.dll 	nsPageContentFrame::Reflow 	layout/generic/nsPageContentFrame.cpp:85
3 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:959
4 	xul.dll 	nsPageFrame::Reflow 	layout/generic/nsPageFrame.cpp:137
5 		@0xa7ab0ff
So uh....

(gdb) p fixed
$3 = (nsBlockFrame *) 0x107aac6d8
(gdb) p fixed->GetContent()
$4 = (nsXMLElement *) 0x145b0e8e0
(gdb) p fixed->GetContent()->GetPrimaryFrame()
$5 = (Cannot access memory at address 0x0
Assignee: nobody → bzbarsky
Priority: -- → P1
So we're replicating the tfoot, and we create a new generated content _node_ as part of the process.  But the "skip primary frame set" bit is on, of course, so we don't give it a primary frame.
Created attachment 549438 [details] [diff] [review]
Fix
Attachment #549438 - Flags: review?(roc)
Whiteboard: [need review]
Attachment #549438 - Flags: review?(roc) → review+
Whiteboard: [need review] → [need landing]
http://hg.mozilla.org/integration/mozilla-inbound/rev/c47fe225ea20
Flags: in-testsuite+
Whiteboard: [need landing]
Target Milestone: --- → mozilla8

Updated

6 years ago
Depends on: 675713
http://hg.mozilla.org/mozilla-central/rev/c47fe225ea20
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.