95420 - [TABLE PRINT]Crashes when attempting to print this page. - N610 & Trunk [@ nsLineLayout::ReflowFrame][@ 0x00000000 - nsFrameList::DestroyFrames]

Status: VERIFIED DUPLICATE of bug 92215

(Core :: Printing: Output, defect, P1)

Description

[adolphe_youssef]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.3) Gecko/20010801
BuildID:    2001080110

After going to this URL and clicking Print icon, Win 2k Pro "Print" applet
appears.  After slecting OK, Mozilla crashes.

This is a repeatable error.
Also, page is not rendered correctly (as per IE 5.50.4522.1800 and Netscape
4.08.0.2).

Dr. Watson log and capture of web page can be provided.


Reproducible: Always
Steps to Reproduce:
1. Go to http://www.ptc.com/products/windchill/collaboration/ds_productview.htm
2. Clicking Print icon.
3. After "Print" applet appears, select OK.


Actual Results:  Mozilla crashes.

Expected Results:  Print then return to shown page.

Comment 1

[dcone (gone)]

Think this is yours

Comment 2

[dcone (gone)]

sorry, this should be a plugin bug, Peter Lubczynski's bug

Comment 3

[Martin Poirier]

Coinfirming this Win98Se moz build 2001081504

Crash that I got :

MOZILLA a causé une défaillance de page dans
 le module GKLAYOUT.DLL à 017f:60369c93.
Registres :
EAX=00000000 CS=017f EIP=60369c93 EFLGS=00010206
EBX=0068a414 SS=0187 ESP=0068a21c EBP=0068a378
ECX=0068a384 DS=0187 ESI=00000000 FS=224f
EDX=0068a35c ES=0187 EDI=01c96cd4 GS=0000
Octets à CS : EIP :
ff 50 38 8b 45 0c 8a 40 1c 3c 02 0f 84 f8 01 00 
État de la pile :
01c96cd4 00000008 0068a384 0068aad0 01da4f2c 00000000 0068aca8 01c96dcc 00000002
00000000 00001e6f 40000000 02165040 0068a400 00000001 02164f30 


---------------------------------------------------------------------------

For a more complete stack trace, see talkback report Id # TB34141304Q

Comment 4

[Peter Lubczynski]

Back over to Don.....the description for this bug is incorrect. There are no
applets, embeds, or object tags on this page. There are no plugins at all and
here's the stack from NS 6.1 Talkback:

nsLineLayout::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 1031]
nsBlockFrame::ReflowInlineFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3460]
nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3344]
nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3269]
nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3215]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2337]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 771]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 879]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1244]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableRowGroupFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 378]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1047]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2951]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1865]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 970]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1514]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 771]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 879]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1244]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableRowGroupFrame::SplitRowGroup
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 943]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1076]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2951]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1865]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 970]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1514]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2136]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsPageFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPageFrame.cpp, line 186]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747]
nsSimplePageSequenceFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsSimplePageSequence.cpp, line
344]

Comment 5

[dcone (gone)]

based on stacktrace looks like a table reflow bug, I am sure this is a 
duplicate, not sure of the bug number. I put table print in summary so I can 
better triage these in the future.  I will go thru the Karnaze bugs soon and try 
and get the duplicates and crashers that have to with table printing duped and 
sorted.

Comment 6

[karnaze (gone)]

Reassigning to attinasi based on stack.

Comment 7

[Marc Attinasi]

Confirmed on Win2K and Mac - updating platform and priority fields and accepting.

Comment 8

[sujay]

*** Bug 95058 has been marked as a duplicate of this bug. ***

Comment 9

[sujay]

*** Bug 96023 has been marked as a duplicate of this bug. ***

Comment 10

[sujay]

*** Bug 96872 has been marked as a duplicate of this bug. ***

Comment 11

[Keyser Sose]

*** Bug 97102 has been marked as a duplicate of this bug. ***

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The two stack traces on this bug (the one in this bug and the one in bug 97102,
marked as a duplicate) are both showing up prominently in talkback.  Are they
really the same?

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It's worth noting that all the crashes that have complete stacks go through the
following code:

ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 538]
PresShell::ResizeReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2809]
DocumentViewerImpl::ReflowPrintObject
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 2918]
DocumentViewerImpl::ReflowDocList
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 2696]
DocumentViewerImpl::SetupToPrintContent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 3214]
PR_AtomicIncrement [../../../../pr/src/misc/pratom.c, line 302]
nsDocShell::AddRef [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp,
line 239]
nsWebShell::AddRef [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 231]
nsWebShell::QueryInterface
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 258]
nsQueryInterface::operator()
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 37]
nsCOMPtr_base::assign_from_helper
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 66]
DocumentViewerImpl::Print
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 4529] 

That stack seems quite weird, but also shows that they're all happening in the
extra reflow printing does to make session history happy.  Were these happening
before that reflow was changed from a style change reflow to a resize reflow? 
And would they still happen if we changed it back to a style change and added
DrainOverflowLines to the style change case?

Comment 14

[dcone (gone)]

I just tested these suggestions.. witht he following results
Both the ResizeReflow and the StyleChangedReflow crash.  
Without any reflows it prints just fine.. but any content that is changed will 
be blank.

The reflow is there so the history can be pushed into the current content (not 
sure if thats the correct terminology).  The EndObservingDocument() used to 
cause this, but that changed so the relow was needed to push this content into 
the current document/framemodel.  

Comment 15

[Keyser Sose]

*** Bug 95879 has been marked as a duplicate of this bug. ***

Comment 16

[Jay Patel [:jay]]

Adding N610 and Trunk to summary for tracking.

Comment 17

[Marc Attinasi]

Kin, can you help out by investigating this crasher? thanks (bounce back as
necessary).

Comment 18

[kinmoz]

Investigating.

Comment 19

[kinmoz]

Attachment: Test Case

Comment 20

[kinmoz]

Attachment: Stack that shows how image frame gets deleted.

Comment 21

[kinmoz]

I just attatched a smaller test case that reproduces the crash using images in 
the mozilla tree, and a file containing a stack trace that shows how the image 
frame that is causing the crash, is getting deleted out from underneath it's 
placeholder frame.

I haven't exactly figured out why this is happening specifically in the print 
case, but thought I'd give an update anyways.

Comment 22

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

If this has something to do with placeholders, see bug 79866.

Comment 23

[kinmoz]

Attachment: Small Test Case

Comment 24

[kinmoz]

I just attatched a small test case which is basically the following, minus 
whitespace to make the content model/frame tree a little easier:

<html><body>
<table border><tr><td>
  <p style="margin-top: 1500px;">Paragraph</p>
  <img src="res/samples/rock_gra.gif" align="right">
</td></tr></table>
</body></html>

To see the crash, the y position of the floated image has to exceed the height 
of the 1st printed page.

Comment 25

[karnaze (gone)]

*** This bug has been marked as a duplicate of 92215 ***

Comment 26

[sujay]

verified.