Last Comment Bug 675246 - Crash [@ nsLayoutUtils::GetStyleFrame(nsIFrame*) ] when printing with tfoot::after position:fixed
: Crash [@ nsLayoutUtils::GetStyleFrame(nsIFrame*) ] when printing with tfoot:...
: crash, regression, testcase
Product: Core
Classification: Components
Component: Printing: Output (show other bugs)
: Trunk
: x86 Windows 7
: P1 critical (vote)
: mozilla8
Assigned To: Boris Zbarsky [:bz]
Depends on: 675713
Blocks: 577450
  Show dependency treegraph
Reported: 2011-07-29 10:14 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2011-08-02 03:19 PDT (History)
3 users (show)
bzbarsky: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (205 bytes, application/xhtml+xml)
2011-07-29 10:14 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
Fix (3.29 KB, patch)
2011-07-29 12:08 PDT, Boris Zbarsky [:bz]
roc: review+
Details | Diff | Splinter Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2011-07-29 10:14:43 PDT
Created attachment 549409 [details]

See testcase, which crashes current trunk build on print/print preview.

This looks like a regression from bug 577450.
0 	xul.dll 	nsLayoutUtils::GetStyleFrame 	layout/base/nsLayoutUtils.cpp:419
1 	xul.dll 	nsCSSFrameConstructor::ReplicateFixedFrames 	layout/base/nsCSSFrameConstructor.cpp:8705
2 	xul.dll 	nsPageContentFrame::Reflow 	layout/generic/nsPageContentFrame.cpp:85
3 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:959
4 	xul.dll 	nsPageFrame::Reflow 	layout/generic/nsPageFrame.cpp:137
5 		@0xa7ab0ff
Comment 1 Boris Zbarsky [:bz] 2011-07-29 11:48:35 PDT
So uh....

(gdb) p fixed
$3 = (nsBlockFrame *) 0x107aac6d8
(gdb) p fixed->GetContent()
$4 = (nsXMLElement *) 0x145b0e8e0
(gdb) p fixed->GetContent()->GetPrimaryFrame()
$5 = (Cannot access memory at address 0x0
Comment 2 Boris Zbarsky [:bz] 2011-07-29 11:52:56 PDT
So we're replicating the tfoot, and we create a new generated content _node_ as part of the process.  But the "skip primary frame set" bit is on, of course, so we don't give it a primary frame.
Comment 3 Boris Zbarsky [:bz] 2011-07-29 12:08:12 PDT
Created attachment 549438 [details] [diff] [review]
Comment 5 Marco Bonardo [::mak] 2011-08-02 03:19:45 PDT

Note You need to log in before you can comment on or make changes to this bug.