Closed Bug 696640 Opened 8 years ago Closed 7 years ago

crash [@nsFrameList::RemoveFrame(nsIFrame*)] on printing /print preview

Categories

(Core :: Layout: Tables, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla20

People

(Reporter: bernd_mozilla, Assigned: mats)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(3 files)

I thought that the signature is now gone due to the fixes for bug 642088 and bug 675490 but the crash stats still show the signature with the nsTableFrame::PushChildren for ff9 

In order to fix this I would need a URL /testcase that shows the problem, I can minimize myself but I need a starting point but I can't see the urls at crash stats.
Crash reports are available at:
https://crash-stats.mozilla.com/report/list?signature=nsFrameList%3A%3ARemoveFrame%28nsIFrame*%29
https://crash-stats.mozilla.com/report/list?signature=nsFrameList%3A%3ARemoveFrame
Severity: normal → critical
Crash Signature: [@ nsFrameList::RemoveFrame(nsIFrame*)] [@ nsFrameList::RemoveFrame]
Keywords: crash
The referred crash stats are just what I wrote in comment 0 nor urls give me an reproducible url and the reminder is probably easy. 

No URL with a crash => no work
Keywords: needURLs
Here are the top URLs for the nsFrameList..RemoveFrame.nsIFrame..signature for November 16. It looks from the URLs as if people are trying to complete a transaction when this crash occurs.

28 https://www.bonprix.de/
     14 http://pixel.fetchback.com/timeout.html
     12 https://www.bonprix.de/confirmation.htm?siteArea=lastCheck&sourcePageClick=-1&pageType=checkout&lastcheckTest=false
      7 \N
      4 about:blank
      3 http://www.harborfreight.com/hftcheckout/cart/
      3 https://www.southwest.com/reservations/book-reservations.html
      3 https://www.bonprix.at/
      3 file:///C:/Documents%20and%20Settings/Gurukulam/My%20Documents/Downloads/%E0%A4%AD%E0%A4%BE%E0%A4%B0%E0%A4%A4%20%E0%A4%95%E0%A5%87%20%E0%A4%B0%E0%A4%BE%E0%A4%9C%E0%A5%8D%E0%A4%AF%20-%20%E0%A4%B5%E0%A4%BF%E0%A4%95%E0%A4%BF%E0%A4%AA%E0%A5%80%E0%A4%A1%E0%A4%
      2 http://www.tauschticket.de/alles/
      2 http://www.scheideanstalt.de/informationen/aktuelle-ankaufskurse/ankaufspreis-goldmuenzen/
      2 http://www.harborfreight.com/checkout/cart/
      2 http://www.adobe.com/de/products/acrobat/matrix.html
      2 https://www.websteronline.com/bank/com.websterbank.servlets.DS
      2 https://www.nccpa.net/PA/CMEHistory.aspx
      2 2 https://www.cowardshoe.com/
      2 https://www.bonprix.ru/
      2 http://en.wikipedia.org/wiki/Cow
      2 http://de.wikipedia.org/wiki/RMS_Titanic
      2 http://de.wikipedia.org/wiki/Lebenserwartung
      1 javascript:false;

I can get some more URLs from a different day and from the other signature if that will help.
Marcia, are those URL's for the nightly?
Marcia, I got what I asked for 

https://crash-stats.mozilla.com/report/index/d0226dc1-a6c9-49fe-b4e4-c97c62111118

###!!! ASSERTION: Broken frame linkage: 'prevSibling && prevSibling->GetNextSibl
ing() == aFrame', file d:/moz_src/src/layout/generic/nsFrameList.cpp, line 128
###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aN
extSibling', file d:\moz_src\src\layout\generic\nsIFrame.h, line 1085
Keywords: needURLs, qawanted
Attached file reduced testcase
crashes on print preview for A4 with 90% scaling, adjust the spacer height to make it work (crash) on different geometries
from the reflow log it looks like
> the reminder is probably easy.

was overly optimistic, the combination of the float causes after the first height constrained reflow which caused the creation of a nif on the first rowgroup another reflow of the table frame with exactly the same height. But tables are not able to pull the nif back on a second reflow. This lack of capabilities was the reason to block the splitting done by columns, but the testcase demonstrates that you can cause with the :after property in combination with the float a situation which is similiar.

On the second round we split the first row again and have two nif and the get the circle with frame references  which asserts efore it crashs.
we end with a situation that Boris previously described in https://bugzilla.mozilla.org/show_bug.cgi?id=642088#c5. In that bug as in a couple of others, while this caused the crash, the situation was the result of wrongly reporting needed space and incompleteness before (see bug 642088, bug 695430, bug 675490).

While I hope that I can find a reflow error in the table, as this would be a small change to fix it, we might need the bigger gun and fix what Boris said. I am however not confident what would be the right fix to do this. I suspect that at cell level when we split the cell we should suppress this already. However I am not certain. Any guidance how to deal with this is welcome.

The last resort is getting this pulling of nif's back to the frame done, but this is beyond my capabilities. However we have quite some testcases when we lift the column split ban.
Duplicate of this bug: 806798
Print-previewing http://www.yourtv.com.au/guide/tonight crashes Nightly.
Duplicate of this bug: 817592
OS: Windows XP → All
Hardware: x86 → All
Duplicate of this bug: 817598
Keywords: testcase
regression window
Good:
http://hg.mozilla.org/mozilla-central/rev/a80414164888
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091002 Minefield/3.7a1pre ID:20091002064014
Crash:
http://hg.mozilla.org/mozilla-central/rev/0a7dd88dbe67
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091003 Minefield/3.7a1pre ID:20091003030914
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a80414164888&tochange=0a7dd88dbe67
Blocks: 512336
Keywords: regression
Assignee: nobody → bugs
Mats, want to have a look?
Attached patch fix+testsSplinter Review
https://tbpl.mozilla.org/?tree=Try&rev=ec90b42dd2ee
Assignee: bugs → matspal
Attachment #692688 - Flags: review?(roc)
Blocks: 686421
https://hg.mozilla.org/mozilla-central/rev/1ac4491232e5
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.