Overview Description: We crash printing this complex page. I'm working on a minimized testcase. Steps to Reproduce: 1) Go to http://www.damowmow.com/mozilla/css_ianh.html 2) Try to print. Actual Results: Crash. Expected Results: Well, NOT crashing might be good. Reproducibility: 100% Build Date & Platform Bug Found: New trunk debug build on win98se 2000092908-MN6 (branch build) on win98se Additional Information: cc'ing Ian so he sees how useful his page was :) Stack Trace: nsTableRowGroupFrame::InitRepeatedFrame(nsIPresContext * 0x01861670, nsTableRowGroupFrame * 0x037652ac) line 148 + 3 bytes nsCSSFrameConstructor::CreateContinuingTableFrame(nsIPresShell * 0x018650e0, nsIPresContext * 0x01861670, nsIFrame * 0x03765244, nsIFrame * 0x0381262c, nsIContent * 0x04473528, nsIStyleContext * 0x04418b40, nsIFrame * * 0x007aba50) line 10722 nsCSSFrameConstructor::CreateContinuingFrame(nsCSSFrameConstructor * const 0x01867ab0, nsIPresShell * 0x018650e0, nsIPresContext * 0x01861670, nsIFrame * 0x03765244, nsIFrame * 0x0381262c, nsIFrame * * 0x007abb5c) line 10819 + 36 bytes nsCSSFrameConstructor::CreateContinuingOuterTableFrame(nsIPresShell * 0x018650e0, nsIPresContext * 0x01861670, nsIFrame * 0x037651f0, nsIFrame * 0x03764d44, nsIContent * 0x04473528, nsIStyleContext * 0x04418600, nsIFrame * * 0x007abbc4) line 10618 nsCSSFrameConstructor::CreateContinuingFrame(nsCSSFrameConstructor * const 0x01867ab0, nsIPresShell * 0x018650e0, nsIPresContext * 0x01861670, nsIFrame * 0x037651f0, nsIFrame * 0x03764d44, nsIFrame * * 0x007abc20) line 10815 + 36 bytes StyleSetImpl::CreateContinuingFrame(StyleSetImpl * const 0x01867b70, nsIPresContext * 0x01861670, nsIFrame * 0x037651f0, nsIFrame * 0x03764d44, nsIFrame * * 0x007abc20) line 1242 + 43 bytes nsHTMLContainerFrame::CreateNextInFlow(nsIPresContext * 0x01861670, nsIFrame * 0x03764d44, nsIFrame * 0x037651f0, nsIFrame * & 0x00000000) line 138 nsBlockFrame::CreateContinuationFor(nsBlockReflowState & {...}, nsLineBox * 0x03810388, nsIFrame * 0x037651f0, int & 0) line 4523 + 24 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x03810388, int * 0x007ac020) line 3937 + 42 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x03810388, int * 0x007ac020, int 0) line 3138 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2945 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x03764d44, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1746 + 15 bytes nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason eReflowReason_Initial, nsIFrame * 0x03764d44, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 561 + 36 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x03764d44, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 331 + 50 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x03810450, int * 0x007acb58) line 3873 + 56 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x03810450, int * 0x007acb58, int 0) line 3138 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2945 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x03764cbc, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1746 + 15 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03764cbc, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsPageFrame::Reflow(nsPageFrame * const 0x03764c84, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 129 nsContainerFrame::ReflowChild(nsIFrame * 0x03764c84, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 100, int 100, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsSimplePageSequenceFrame::Reflow(nsSimplePageSequenceFrame * const 0x03764c48, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 248 nsContainerFrame::ReflowChild(nsIFrame * 0x03764c48, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes ViewportFrame::Reflow(ViewportFrame * const 0x03764c0c, nsIPresContext * 0x01861670, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 546 PresShell::InitialReflow(PresShell * const 0x018650e0, int 11520, int 15120) line 1919 DocumentViewerImpl::Print(DocumentViewerImpl * const 0x0438da38, int 0, _iobuf * 0x00000000, nsIPrintListener * 0x00000000) line 1650 nsBrowserInstance::Print(nsBrowserInstance * const 0x03fb0070) line 1478 + 29 bytes XPTC_InvokeByIndex(nsISupports * 0x03fb0070, unsigned int 33, unsigned int 0, nsXPTCVariant * 0x007ad950) line 139 nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x027c58d0, nsXPCWrappedNative * 0x03fb16c0, const XPCNativeMemberDescriptor * 0x03fb1c04, nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 0, long * 0x037c098c, long * 0x007adb04) line 913 + 43 bytes WrappedNative_CallMethod(JSContext * 0x027c58d0, JSObject * 0x00f83f30, unsigned int 0, long * 0x037c098c, long * 0x007adb04) line 228 + 34 bytes js_Invoke(JSContext * 0x027c58d0, unsigned int 0, unsigned int 0) line 820 + 23 bytes js_Interpret(JSContext * 0x027c58d0, long * 0x007ae638) line 2621 + 15 bytes js_Invoke(JSContext * 0x027c58d0, unsigned int 1, unsigned int 2) line 837 + 13 bytes js_InternalInvoke(JSContext * 0x027c58d0, JSObject * 0x00f83150, long 58290368, unsigned int 0, unsigned int 1, long * 0x007ae7d0, long * 0x007ae760) line 909 + 20 bytes JS_CallFunctionValue(JSContext * 0x027c58d0, JSObject * 0x00f83150, long 58290368, unsigned int 1, long * 0x007ae7d0, long * 0x007ae760) line 3193 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x027c5a80, void * 0x00f83150, void * 0x037970c0, unsigned int 1, void * 0x007ae7d0, int * 0x007ae7cc, int 0) line 907 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x043f67d4) line 154 + 64 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x03ec5fa0, nsIDOMEvent * 0x043f67d4, nsIDOMEventTarget * 0x03ec4748, unsigned int 8, unsigned int 7) line 788 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x031306e0, nsEvent * 0x007af034, nsIDOMEvent * * 0x007aefcc, nsIDOMEventTarget * 0x03ec4748, unsigned int 7, nsEventStatus * 0x007af078) line 1670 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x03ec4740, nsIPresContext * 0x031306e0, nsEvent * 0x007af034, nsIDOMEvent * * 0x007aefcc, unsigned int 1, nsEventStatus * 0x007af078) line 3321 PresShell::HandleDOMEventWithTarget(PresShell * const 0x03133990, nsIContent * 0x03ec4740, nsEvent * 0x007af034, nsEventStatus * 0x007af078) line 4302 + 39 bytes nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x031306e0, nsGUIEvent * 0x007af200) line 138 nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x03756624, nsIPresContext * 0x031306e0, nsGUIEvent * 0x007af200, nsEventStatus * 0x007af520) line 99 PresShell::HandleEventInternal(nsEvent * 0x007af200, nsIView * 0x00000000, unsigned int 1, nsEventStatus * 0x007af520) line 4270 + 38 bytes PresShell::HandleEventWithTarget(PresShell * const 0x03133990, nsEvent * 0x007af200, nsIFrame * 0x03756624, nsIContent * 0x03ec4740, unsigned int 1, nsEventStatus * 0x007af520) line 4236 + 22 bytes nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x03e31830, nsIPresContext * 0x031306e0, nsMouseEvent * 0x007af630, nsEventStatus * 0x007af520) line 1854 + 61 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x03e31838, nsIPresContext * 0x031306e0, nsEvent * 0x007af630, nsIFrame * 0x03756624, nsEventStatus * 0x007af520, nsIView * 0x03130050) line 935 + 28 bytes PresShell::HandleEventInternal(nsEvent * 0x007af630, nsIView * 0x03130050, unsigned int 1, nsEventStatus * 0x007af520) line 4275 + 43 bytes PresShell::HandleEvent(PresShell * const 0x03133994, nsIView * 0x03130050, nsGUIEvent * 0x007af630, nsEventStatus * 0x007af520, int 1, int & 1) line 4190 + 25 bytes nsView::HandleEvent(nsView * const 0x03130050, nsGUIEvent * 0x007af630, unsigned int 28, nsEventStatus * 0x007af520, int 1, int & 1) line 379 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x03130230, nsGUIEvent * 0x007af630, nsEventStatus * 0x007af520) line 1439 HandleEvent(nsGUIEvent * 0x007af630) line 68 nsWindow::DispatchEvent(nsWindow * const 0x03133ee4, nsGUIEvent * 0x007af630, nsEventStatus & nsEventStatus_eIgnore) line 681 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x007af630) line 702 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3890 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4100 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3343264, long * 0x007af9ac) line 2960 + 24 bytes nsWindow::WindowProc(HWND__ * 0x00000fb8, unsigned int 514, unsigned int 0, long 3343264) line 950 + 27 bytes KERNEL32! bff7363b() KERNEL32! bff94407() 007a8a32()

The line causing the problem is: int rowIndex = ((nsTableRowFrame*)originalRowFrame)->GetRowIndex(); originalRowFrame seems to be null. nominating for rtm since this is in the branch, and suggesting we relnote for beta3 (will come up with a good description of the problem once i can minimize it to a testcase)

There is a similar bug 53969, with a crash in nsTableRowGroupFrame.

Adding rtm+.

Waterson, this smells like 53969 because the test case doesn't fail on a 9/18 build and the conditions I'm seeing in the table code don't seem right. After you fix 53969, see if this is fixed or related and if not, give it back to me. The way I have been analyzing printing bugs within Viewer is to change the one line (#if 1) in DocumentViewerImpl::Init to create a print preview context instead of a galley context. This allows Viewer to operate in paganation mode. It is important when doing this not to have documents which will generate incremental reflows because tables cannot handle them in this mode (and printing should never cause them anyway).

We need a patch, and reviews to eval risk before we can double plus. Marking rtm need info.

karnaze: this is a different bug, unfortunately. I'm gonna kick it backatcha. Lemme know if you want me to look at it again or are overloaded...

Changing to rtm+.

rtm++

*** Bug 55434 has been marked as a duplicate of this bug. ***

Fixed.

Using 10/6 build on Win98, no crash on printing either testcase. Verifying fixed.