User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 When I try open a print preview page, then press Cltr-R, Mozilla will crash when there is a flash e.g. http://www.macromedia.com Reproducible: Always Steps to Reproduce: 1. 2. 3.

Reproduced on 2003102504 on WinXp. (Talkback ID TB24842251G is from 1024 nightly.) It seems that one must have Flash installed for the crash to occur. I have Shockwave Flash 7.0 r14. Caillon, could you get the stack, please?

Probably bug 195721

I was able to reproduce this bug, too. Build ID: 2004010208 Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040102 Windows 98 SE Shockwave Flash plugin (NPSWF32.dll, version 7.0 r19) Detailed error message from Windows follows... MOZILLA caused an invalid page fault in module GKLAYOUT.DLL at 017f:0125c3bc. Registers: EAX=00000000 CS=017f EIP=0125c3bc EFLGS=00010246 EBX=00000000 SS=0187 ESP=0066f830 EBP=0066f864 ECX=11411c50 DS=0187 ESI=11411c50 FS=2737 EDX=0066f844 ES=0187 EDI=01e48f70 GS=0000 Bytes at CS:EIP: 39 48 28 75 10 8b 10 56 8d 74 24 04 56 ff 71 08 Stack dump: 11411c50 0125c406 11411c50 11411c50 0125c38d 1140b070 0125c5cf 00000001 0112d7d4 11411c50 114067b0 01e48f70 00000000 0066f88c 01136d89 01e48f70

Reproduced on Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7a) Gecko/20040113 Firebird/0.8.0+ (stipe) on Win2k. Using latest version of flash able to reproduce it easily website was anandtech.com that i tried it on

Confirming

Crash with Win2k on a few days (well, ok, 1-2 weeks) old debug build and Flash 6.0: nsFrame::Destroy(nsFrame * const 0x04252230, nsIPresContext * 0x042e2e20) line 640 + 11 bytes nsSplittableFrame::Destroy(nsSplittableFrame * const 0x04252230, nsIPresContext * 0x042e2e20) line 72 nsContainerFrame::Destroy(nsContainerFrame * const 0x04252230, nsIPresContext * 0x042e2e20) line 141 + 13 bytes nsBoxFrame::Destroy(nsBoxFrame * const 0x04252230, nsIPresContext * 0x042e2e20) line 1065 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x042e2e20) line 130 nsContainerFrame::Destroy(nsContainerFrame * const 0x04252120, nsIPresContext * 0x042e2e20) line 137 nsBoxFrame::Destroy(nsBoxFrame * const 0x04252120, nsIPresContext * 0x042e2e20) line 1065 + 13 bytes nsGfxScrollFrame::Destroy(nsGfxScrollFrame * const 0x04252120, nsIPresContext * 0x042e2e20) line 431 nsFrameList::DestroyFrames(nsIPresContext * 0x042e2e20) line 130 nsContainerFrame::Destroy(nsContainerFrame * const 0x04251d20, nsIPresContext * 0x042e2e20) line 137 ViewportFrame::Destroy(ViewportFrame * const 0x04251d20, nsIPresContext * 0x042e2e20) line 68 FrameManager::Destroy(FrameManager * const 0x0428ac88) line 485 PresShell::Destroy(PresShell * const 0x042042e0) line 1832 PresShell::~PresShell() line 1594 PresShell::`scalar deleting destructor'() + 15 bytes PresShell::Release(PresShell * const 0x042042e0) line 1541 + 219 bytes nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 477 nsPrintObject::~nsPrintObject() line 78 + 89 bytes nsPrintObject::`scalar deleting destructor'(unsigned int 0x00000001) + 15 bytes nsPrintData::~nsPrintData() line 144 + 31 bytes nsPrintData::`scalar deleting destructor'(unsigned int 0x00000001) + 15 bytes nsPrintEngine::Destroy() line 299 + 31 bytes DocumentViewerImpl::Destroy(DocumentViewerImpl * const 0x04303a38) line 1095 DocumentViewerImpl::Show(DocumentViewerImpl * const 0x050f88e0) line 1363 PresShell::UnsuppressAndInvalidate() line 4841 PresShell::UnsuppressPainting(PresShell * const 0x053f5be8) line 4886 PresShell::sPaintSuppressionCallback(nsITimer * 0x05572010, void * 0x053f5be8) line 2875 nsTimerImpl::Fire() line 382 + 17 bytes handleTimerEvent(TimerEventType * 0x0553ef90) line 449 PL_HandleEvent(PLEvent * 0x0553ef90) line 671 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x018dc618) line 606 + 9 bytes _md_EventReceiverProc(HWND__ * 0x00120300, unsigned int 0x0000c109, unsigned int 0x00000000, long 0x018dc618) line 1412 + 9 bytes USER32! 77e2a2b8() USER32! 77e045b1() USER32! 77e0a752() nsAppShellService::Run(nsAppShellService * const 0x019740f0) line 484 main1(int 0x00000001, char * * 0x00262638, nsISupports * 0x018c0a40) line 1291 + 32 bytes main(int 0x00000001, char * * 0x00262638) line 1678 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 77e9847c() To my untrained exes this stack looks different from the possible dupes, but... view is 0x0436bff8 there, but all its members are 0xdddddddd. Not sure if that means anything. Before, there was the assertion nsPresShell.cpp lne 1589: Someone did not call nsIPresShell::destroy: "not reached"

I see this too in a Firefox debug build I just finished. My stack looks similar to Andreas'.

WFM: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050702 Firefox/1.0+ Pleae reopen if you can reproduce with a trunk build