312782 - crash when loading FCKeditor (javascript enabled) [@ ConvertUnicharToUCS4]

Status: RESOLVED DUPLICATE of bug 300122

(Core Graveyard :: GFX: Gtk, defect)

Description

[Thomas Waldmann]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1

Talkback ID: TB10776730K

Firefox crashes while loading that page, which uses FCKeditor 2.1.1 (see
http://fckeditor.net/). If you switch off JS, it doesn't crash. It also didn't
crash with previous FCKeditor versions.

Happens on Debian Linux and Mac OS X, same for FF 1.0.7 and 1.5b2.

Doesn't happen for Mozilla 1.7.8 on Debian.


Reproducible: Always

Steps to Reproduce:
1. load http://moinmoin.wikiwikiweb.de/WikiSandBox?action=edit&editor=gui
2. wait a few seconds until some of the JS code is loaded/executed
3. BANG!

Actual Results:  
browser window closed, browser terminated, talkback stuff starts

Expected Results:  
Execute the FCKeditor WYSIWYG html editor.

TB10776730K

Comment 1

[Adam Guthrie]

*** This bug has been marked as a duplicate of 300122 ***

Comment 2

[Adam Guthrie]

Incident ID: 10776730
Stack Signature	ConvertUnicharToUCS4() f326c1ed
Product ID	Firefox15
Build ID	2005100604
Trigger Time	2005-10-17 13:01:53.0
Platform	LinuxIntel
Operating System	Linux 2.6.6-tw1
Module	firefox-bin + (0016659e)
URL visited	http://moinmoin.wikiwikiweb.de/WikiSandBox?action=edit&editor=gui
User Comments	
Since Last Crash	38 sec
Total Uptime	38 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.
/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/gfx/src/gtk/nsFontMetricsXft.cpp,
line 2381
Stack Trace 	
ConvertUnicharToUCS4() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/gfx/src/gtk/nsFontMetricsXft.cpp,
line 2381]
nsFontMetricsXft::EnumerateGlyphs(unsigned short const*, unsigned, unsigned
(nsFontMetricsXft::*)() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/gfx/src/gtk/nsFontMetricsXft.cpp,
line 1468]
nsFontMetricsXft::RawGetWidth() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/gfx/src/gtk/nsFontMetricsXft.cpp,
line 1236]
nsFontMetricsXft::GetWidth() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/gfx/src/gtk/nsFontMetricsXft.cpp,
line 328]
nsRenderingContextGTK::GetWidth() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp,
line 1251]
nsTextFrame::GetPointFromOffset() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsTextFrame.cpp,
line 4218]
nsTypedSelection::GetPointFromOffset() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp,
line 842]
nsTypedSelection::GetCachedFrameOffset() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp,
line 5090]
nsCaret::GetCaretRectAndInvert() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCaret.cpp,
line 134]
nsCaret::DrawAtPositionWithHint(nsIDOMNode*, int, nsIFrameSelection::HINT)() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCaret.cpp,
line 326]
nsCaret::DrawCaret() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCaret.cpp,
line 297]
nsCaret::StartBlinking() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCaret.cpp,
line 483]
nsCaret::SetCaretVisible() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCaret.cpp,
line 245]
PresShell::SetCaretEnabled() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 848]
nsTextEditorFocusListener::Focus() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp,
line 848]
DispatchToInterface(nsIDOMEvent*, nsIDOMEventListener*, unsigned
(nsIDOMEventListener::*)() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 141]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1777]
nsDocument::HandleDOMEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsDocument.cpp,
line 4003]
nsEventStateManager::PreHandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 830]
PresShell::HandleEventInternal() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6361]
PresShell::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6202]
nsViewManager::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 848]
nsViewManager::DispatchEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 2246]
HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsView.cpp,
line 251]
nsCommonWidget::DispatchEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 219]
nsCommonWidget::DispatchGotFocusEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 166]
nsWindow::SetFocus() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 728]
nsGlobalWindow::Focus() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 848]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2138]
XPC_WN_CallMethod() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1402]
js_Invoke() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1163]
js_Interpret() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 3487]
js_Invoke() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1261]
JS_CallFunctionValue() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsapi.c,
line 4184]
nsJSContext::CallEventHandler() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1408]
nsJSEventListener::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 185]
nsEventListenerManager::HandleEventSubType() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1685]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1784]
nsGenericElement::HandleDOMEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2169]
nsHTMLScriptElement::ScriptEvaluated() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/html/content/src/nsHTMLScriptElement.cpp,
line 842]
nsScriptLoadRequest::FireScriptEvaluated() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 848]
nsScriptLoader::FireScriptEvaluated() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 699]
nsScriptLoader::ProcessRequest() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 117]
nsScriptLoader::OnStreamComplete() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 1024]
nsStreamLoader::OnStopRequest() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp,
line 712]
nsHttpChannel::OnStopRequest() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 1149]
nsInputStreamPump::OnStateStop() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 1149]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 343]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/plevent.c,
line 689]
PL_ProcessPendingEvents() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/plevent.c,
line 623]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/nsEventQueue.cpp,
line 423]
event_processor_callback() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x49dbf (0x405fddbf)
libglib-2.0.so.0 + 0x24582 (0x405d8582)
libglib-2.0.so.0 + 0x255f8 (0x405d95f8)
libglib-2.0.so.0 + 0x25930 (0x405d9930)
libglib-2.0.so.0 + 0x25ed3 (0x405d9ed3)
libgtk-x11-2.0.so.0 + 0x11fbb3 (0x402bebb3)
nsAppShell::Run() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 141]
nsAppStartup::Run() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 151]
XRE_main() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 2311]
main() 
[/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 62]
libc.so.6 + 0x15974 (0x409e2974)