303818 - [@ nsCopySupport::HTMLCopy]

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[timeless]

spun off from bug 273657 comment 2

Incident ID: 8166575
Stack Signature	nsCopySupport::HTMLCopy() ac103fe5
Product ID	FirefoxTrunk
Build ID	2005071205
Trigger Time	2005-08-07 13:17:22.0
Platform	LinuxIntel
Operating System	Linux 2.4.27-2-k7
Module	firefox-bin + (002d9da6)
URL visited	
User Comments	
Since Last Crash	2 sec
Total Uptime	2 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.
/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsCopySupport.cpp,
line 848
Stack Trace 	
nsCopySupport::HTMLCopy() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsCopySupport.cpp,
line 848]
nsAutoCopyListener::NotifySelectionChanged() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp,
line 842]
nsTypedSelection::NotifySelectionListeners() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp,
line 842]
nsSelection::SetMouseDownState() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp,
line 2663]
nsFrame::HandleRelease() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp,
line 848]
nsFrame::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp,
line 991]
PresShell::HandleEventInternal() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6410]
PresShell::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6192]
nsViewManager::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 848]
nsViewManager::DispatchEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 2230]
HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsView.cpp,
line 251]
nsCommonWidget::DispatchEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 219]
nsWindow::OnButtonReleaseEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 1565]
button_release_event_cb() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 3686]
libgtk-x11-2.0.so.0 + 0x12299e (0x4030099e)
libgobject-2.0.so.0 + 0x8736 (0x405c1736)
libgobject-2.0.so.0 + 0x19dcf (0x405d2dcf)
libgobject-2.0.so.0 + 0x18c8c (0x405d1c8c)
libgobject-2.0.so.0 + 0x19126 (0x405d2126)
libgtk-x11-2.0.so.0 + 0x211d87 (0x403efd87)
libgtk-x11-2.0.so.0 + 0x1214b2 (0x402ff4b2)
libgtk-x11-2.0.so.0 + 0x120306 (0x402fe306)
libgdk-x11-2.0.so.0 + 0x3f825 (0x404fb825)
libglib-2.0.so.0 + 0x24582 (0x40615582)
libglib-2.0.so.0 + 0x255f8 (0x406165f8)
libglib-2.0.so.0 + 0x25930 (0x40616930)
libglib-2.0.so.0 + 0x25ed3 (0x40616ed3)
libgtk-x11-2.0.so.0 + 0x11fbb3 (0x402fdbb3)
nsAppShell::Run() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 141]
nsAppStartup::Run() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
XRE_main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 2213]
main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 62]
libc.so.6 + 0x15e36 (0x40a21e36)

Comment 1

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 2

[Mats Palmgren (inactive)]

Attachment: stack

Comment 3

[[e-mail]]

Presumably the test case as provided is Linux specific, but you should be able
to duplicate the crash on other platforms by pressing Ctrl+C.

Comment 4

[Stefan [:stefanh]]

Fwiw, I just crashed with a recent SeaMonkey trunk (mac) doing Cmd+C... TB8841320Y.

Comment 5

[Mats Palmgren (inactive)]

*** Bug 306913 has been marked as a duplicate of this bug. ***

Comment 6

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Comment 7

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1 (diff -uw)

"if (!shortcut.IsEmpty())" was always true in the original code because of the
unconditional "shortcut.Append(PRUnichar('\n'))"  -- I'm assuming
"if (!spec.IsEmpty())" is what was meant.

Comment 8

[Mats Palmgren (inactive)]

Checked in to trunk at 2005-09-10 04:39 PDT

-> FIXED

Comment 9

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20050910 Firefox/1.6a1
ID:2005091014

Verified fixed.

Comment 10

[Harri Pitkänen]

The testcase in this bug still causes Firefox Beta 2 (Mozilla/5.0 (X11; U; 
Linux i686; en-US; rv:1.8b5) Gecko/20051006) to crash. 

Comment 11

[Adam Guthrie]

Harri, could you provide a talkback ID for the crash?
http://kb.mozillazine.org/Talkback

Comment 12

[Harri Pitkänen]

The talkback ID for the crash in the testcase is TB10333746. 

Comment 13

[Mats Palmgren (inactive)]

(In reply to comment #10)
> The testcase in this bug still causes Firefox Beta 2 to crash. 

This hasn't been checked in on the branch so that is expected.
It's a rare edge case crash without security implications.

Comment 14

[(not currently active) Ted Mielczarek]

*** Bug 322687 has been marked as a duplicate of this bug. ***

Comment 15

[Ryan Flint [:rflint] (ping via IRC for reviews)]

*** Bug 334061 has been marked as a duplicate of this bug. ***

Comment 16

[Mats Palmgren (inactive)]

*** Bug 328184 has been marked as a duplicate of this bug. ***

Comment 17

[Mats Palmgren (inactive)]

Comment on attachment 194810 [details] [diff] [review]
Patch rev. 1 (diff -uw)

bug 328184 comment 4 indicates it's more common than I thought.

Comment 18

[Daniel Veditz [:dveditz]]

Comment on attachment 194810 [details] [diff] [review]
Patch rev. 1 (diff -uw)

approved for 1.8.0 branch, a=dveditz for drivers

Comment 19

[Mats Palmgren (inactive)]

Checked in on MOZILLA_1_8_BRANCH and MOZILLA_1_8_0_BRANCH

Comment 20

[Tracy Walker [:tracy]]

verified with:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.5) Gecko/20060620 Firefox/1.5.0.5