User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.8) Gecko/20051222 Firefox/1.5 Build Identifier: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.8) Gecko/20051222 Firefox/1.5 The problem occurs when editing a textbox (such as the one in which I am entering text right now). Using ctrl+shift+[up/down arrow] selects text in the box without using the mouse. However, if the three are pressed simultaneously, this results in a non-recoverable crash. Reproducible: Sometimes Steps to Reproduce: 1. Start up firefox --debug 2. Set GDB to "handle SIGPIPE nostop" and "handle SIGTRAP nostop", then "run" 3. Navigate to http://bsdlogical.com/wiki/index.php?title=Advanced_Spanish&action=edit (used for testing purposes), and click Edit. 4. Click on the very first character a few lines below the top. 5. Press ctrl+shift+up at the exact same time. 6. It may be necessary to do this a few times, or to switch quickly between up and down. Actual Results: GDB returned: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1 (LWP 100146)] 0x2823e9a1 in XPTC_InvokeByIndex (that=0x8c30ce0, methodIndex=3, paramCount=0, params=0xbfbfbc90) at xptcinvoke_unixish_x86.cpp:162 162 } Typing "continue" in the debugger returned: GDB at this point: Program received signal SIGSEGV, Segmentation fault. [Switching to LWP 100146] 0x2889f512 in signalcontext () from /lib/libc.so.5 (gdb) When I first saw this problem, Firefox was not in debug mode, and created a core dump. The signalcontext() result matches the last line of that core file: Loaded symbols for /libexec/ld-elf.so.1 #0 0x2889f512 in signalcontext () from /lib/libc.so.5 (gdb) But that's only the final part. I couldn't receive any significant backtrace information from the core file. Expected Results: The text should have been selected, with no side effects. I was using the default theme on Firefox, with no additional options. I run FreeBSD 5.4-STABLE, last built several months ago. FreeBSD krypton.bsdlogical.com 5.4-STABLE FreeBSD 5.4-STABLE #2: Mon Jul 18 11:41:51 EDT 2005 email@example.com:/usr/src/sys/i386/compile/KRYPTON i386 I ran this test on my laptop, where I switch between using the built-in keyboard and an external PS/2 keyboard, connected through a Y USB splitter (with a chip that emulates a USB keyboard and mouse port, the latter of which I don't use). On FreeBSD, the keyboard is identified as a "Cypress" keyboard: ukbd0: Cypress Cypress PS/2 Keyboard - PS/2 Mouse, rev 1.01/0.01, addr 3, iclass 3/1 kbd1 at ukbd0 ums1: Cypress Cypress PS/2 Keyboard - PS/2 Mouse, rev 1.01/0.01, addr 3, iclass 3/1 ums1: 3 buttons and Z dir. However, I could only replicate the problem with that keyboard. I have been having problems with the USB keyboard earlier, such as endless repetition of keys even after I have released them. Sometimes it gets stuck using high CPU time, and doesn't let go. Under Windows, the keyboard works more or less okay, but under FreeBSD, there are problems. This may be the reason, but I'm not sure. In any case, it would be nice for others to try to replicate this problem, especially those who use an external USB keyboard.
Created attachment 207833 [details] Truncated output of debugging session. Full output is just more of the same, as I repeated the tests quite a few times.
A talkback ID would be nice here. Also see http://www.mozilla.org/unix/debugging-faq.html for some tips on how to use gdb.
I have encountered this symptom at least 5 times composing an email at gmail. Gmail automatically saves so it does not affect my email, but the consequence of crashing the whole browser is horrible. I have submitted @ least one talkback from firstname.lastname@example.org On Ubuntu Breezy with FF 22.214.171.124 (official) sometimes I can get FF to crash by holding down Shift+Ctrl+Up/Down arrow in gmail and other text areas. Mostly gmail though, and I have to up/down quite a bit, and it does not happen frequently, and always when I have done copy/pasting and authoring previously *ENV: Firefox 126.96.36.199 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:188.8.131.52) Gecko/20060124 Firefox/184.108.40.206 Old bug 241989 may be the same issue.
(In reply to comment #3) > talkback from email@example.com Jay Patel found the talkback for me. Here is the top of the stack, I will attach the incident after. Stack Trace nsCopySupport::HTMLCopy() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/content/base/src/nsCopySupport.cpp, line 848] nsAutoCopyListener::NotifySelectionChanged() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp, line 842] nsTypedSelection::NotifySelectionListeners() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp, line 842] nsTypedSelection::Extend() [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp, line 251]
Looks like a dupe. Fixed on trunk. *** This bug has been marked as a duplicate of 303818 ***