286316 - crash when viewing source of alt image text

Status: RESOLVED DUPLICATE of bug 252970

(Toolkit :: View Source, defect)

Description

[Ivan Ičin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050315 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050315 Firefox/1.0+

See steps below

Reproducible: Always

Steps to Reproduce:
1. Open the testcase I've uploaded
2. Select the alt text of image that appears
3. Select command View Selections source from context menu

Actual Results:  
Firefox crashes

Expected Results:  
I should get source with img tag selected

Crash Talkback ID: TB4370789H

Comment 1

[Ivan Ičin]

Attachment: testcase for the bug

Comment 2

[Matthias Versen [:Matti]]

dupe of bug 286314 ?

Comment 3

[timeless]

Incident ID: 4370789
Stack Signature	nsFontMetricsWin::ResolveForwards d017b94a
Product ID	FirefoxTrunk
Build ID	2005031506
Trigger Time	2005-03-15 14:37:26.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (000e164d)
URL visited	
User Comments	Selecting alt text of image and chosing View source crashes Firefox
Since Last Crash	3487 sec
Total Uptime	3487 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/gfx/src/windows/nsFontMetricsWin.cpp,
line 3872
Stack Trace 	
nsFontMetricsWin::ResolveForwards 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/gfx/src/windows/nsFontMetricsWin.cpp,
line 3872]
nsRenderingContextWin::GetWidth 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/gfx/src/windows/nsRenderingContextWin.cpp,
line 1509]
nsTextFrame::GetPointFromOffset 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsTextFrame.cpp,
line 3940]
nsTypedSelection::GetPointFromOffset 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp,
line 6736]
nsTypedSelection::GetCachedFrameOffset 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp,
line 5087]
nsTypedSelection::GetSelectionRegionRectAndScrollableView 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp,
line 6864]
nsTypedSelection::ScrollIntoView 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp,
line 7221]
nsSelection::ScrollSelectionIntoView 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp,
line 2703]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1293]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1545]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1642]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2046]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2025]
nsXULElement::HandleChromeEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2731]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 897]
DocumentViewerImpl::LoadComplete 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsDocumentViewer.cpp,
line 987]
nsDocShell::EndPageLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 4574]
nsWebShell::EndPageLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsWebShell.cpp,
line 662]
nsDocShell::OnStateChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 4500]
nsDocLoader::FireOnStateChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 1194]
nsDocLoader::doStopDocumentLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 832]
nsDocLoader::OnStopRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 653]
nsLoadGroup::RemoveRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 732]
PresShell::RemoveDummyLayoutRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6678]
DummyLayoutRequestEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6578]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsDocShell::ConvertDocShellLoadInfoToLoadType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 484]
0xebffd9d7


*** This bug has been marked as a duplicate of 252970 ***