675246 - Crash [@ nsLayoutUtils::GetStyleFrame(nsIFrame*) ] when printing with tfoot::after position:fixed

Status: RESOLVED FIXED

(Core :: Printing: Output, defect, P1)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build on print/print preview.

This looks like a regression from bug 577450.

https://crash-stats.mozilla.com/report/index/714bb842-6659-4ca6-9d30-b8b4d2110729
0 	xul.dll 	nsLayoutUtils::GetStyleFrame 	layout/base/nsLayoutUtils.cpp:419
1 	xul.dll 	nsCSSFrameConstructor::ReplicateFixedFrames 	layout/base/nsCSSFrameConstructor.cpp:8705
2 	xul.dll 	nsPageContentFrame::Reflow 	layout/generic/nsPageContentFrame.cpp:85
3 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:959
4 	xul.dll 	nsPageFrame::Reflow 	layout/generic/nsPageFrame.cpp:137
5 		@0xa7ab0ff

Comment 1

[Boris Zbarsky [:bzbarsky]]

So uh....

(gdb) p fixed
$3 = (nsBlockFrame *) 0x107aac6d8
(gdb) p fixed->GetContent()
$4 = (nsXMLElement *) 0x145b0e8e0
(gdb) p fixed->GetContent()->GetPrimaryFrame()
$5 = (Cannot access memory at address 0x0

Comment 2

[Boris Zbarsky [:bzbarsky]]

So we're replicating the tfoot, and we create a new generated content _node_ as part of the process.  But the "skip primary frame set" bit is on, of course, so we don't give it a primary frame.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Comment 4

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/c47fe225ea20

Comment 5

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/c47fe225ea20