306913 - crash [@ nsDOMAttribute::nsDOMAttribute] when holding ctrl and clicking a radio button twice [@ nsCopySupport::HTMLCopy]

Status: VERIFIED DUPLICATE of bug 303818

(Core :: DOM: Core & HTML, defect)

Description

[Adam Guthrie]

This crash can be reproduced by clicking the radio button label, or the button
itself while holding down control. You have to click it twice, though. This does
not occur when there's no label associated with the button.

Incident ID: 8982741
Stack Signature	nsDOMAttribute::nsDOMAttribute() df571372
Product ID	FirefoxTrunk
Build ID	2005082205
Trigger Time	2005-09-02 17:32:15.0
Platform	LinuxIntel
Operating System	Linux 2.6.12-1.1447_FC4
Module	firefox-bin + (002dd73a)
URL visited	
User Comments	
Since Last Crash	0 sec
Total Uptime	49 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.
/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsDOMAttribute.cpp,
line 99
Stack Trace 	
nsDOMAttribute::nsDOMAttribute() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsDOMAttribute.cpp,
line 99]
nsSimplePageSequenceFrame::GetNumPages() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp,
line 537]
nsSimplePageSequenceFrame::Reflow() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSimplePageSequence.cpp,
line 422]
nsSelection::SelectRowOrColumn() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp,
line 202]
nsFrame::GetNextPrevLineFromeBlockFrame() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp,
line 3292]
nsFrame::HandleRelease() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp,
line 1835]
non-virtual thunk to PresShell::BeginUpdate()
WalkFramesThroughPlaceholders() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 7192]
nsViewManager::AddToDisplayList() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 66]
nsViewManager::GetViewManagerArray() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 3364]
nsViewManager::~nsViewManager() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 550]
Shutdown() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/build/nsLayoutModule.cpp,
line 376]
nsWindow::NativeResize() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 2606]
NS_GetCurrentToolkit() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsToolkit.cpp,
line 127]
libgtk-x11-2.0.so.0 + 0x10b352 (0x00b22352)
libgobject-2.0.so.0 + 0x8bc8 (0x00258bc8)
libgobject-2.0.so.0 + 0x185be (0x002685be)
libgobject-2.0.so.0 + 0x19c55 (0x00269c55)
libgobject-2.0.so.0 + 0x1a249 (0x0026a249)
libgtk-x11-2.0.so.0 + 0x1e6ac3 (0x00bfdac3)
libgtk-x11-2.0.so.0 + 0x109ab7 (0x00b20ab7)
libgtk-x11-2.0.so.0 + 0x109ef4 (0x00b20ef4)
libgdk-x11-2.0.so.0 + 0x3bd6e (0x001edd6e)
libglib-2.0.so.0 + 0x2507e (0x0099c07e)
libglib-2.0.so.0 + 0x28096 (0x0099f096)
libglib-2.0.so.0 + 0x28383 (0x0099f383)
libgtk-x11-2.0.so.0 + 0x1091b5 (0x00b201b5)
nsBaseWidget::DrawScaledRect() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/xpwidgets/nsBaseWidget.cpp,
line 833]
non-virtual thunk to nsDownloadsDataSource::Flush()
XRE_main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 850]
nsXULAppInfo::GetXPCOMABI() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 382]
libc.so.6 + 0x1549f (0x00e5b49f)

Comment 1

[Adam Guthrie]

Attachment: testcase

Comment 2

[Mats Palmgren (inactive)]

Attachment: stack

Comment 3

[Mats Palmgren (inactive)]

*** This bug has been marked as a duplicate of 303818 ***