324929 - Print Preview crashes with opacity set on list [@ nsFontPSXft::FindFont ][@ nsFontPS::FindFont ]

Status: RESOLVED WORKSFORME

(Core Graveyard :: GFX: Gtk, defect)

Description

[Eric Marsch]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

I was doing the litmus Basic Functional Tests (BFTs) and went to Menu Bar. On the Second test in there it asks you to check all of the options under the File menu. I opened up print preview and it was fine, but when I pressed page down, the browser crashed. When I tried doing it with the first test open, it worked fine. When I tried it with the third test open, Firefox crashed right away.

It happened with the 1.5.0.1 RC and with the latest Trunk available from the Software Update feature on Linux.

Reproducible: Always

Steps to Reproduce:
1. Go the the litmus test page (litmus.mozilla.org)
2. Select Firefox as the product and Linux as the OS/Platform
3. Go to the Basic Functional Tests (BFTs)
4. Select the Menu Bar subgroup
5. Click Submit
6. Click on "2: Main Menu: File items »" to go to the File Items test
7. Click on the File menu and go down to and click on Print Preview
8. Press the page down key
Actual Results:  
Firefox Crashed

Expected Results:  
Firefox to scroll down the page

Comment 1

[Steve England [:stevee]]

Did you submit any talkback crash data? If so, what TalkbackIDs were they?

Comment 2

[Tracy Walker [:tracy]]

confirmed-
several crash reports at:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=print+preview&vendor=MozillaOrg&product=Firefox15&platform=LinuxIntel&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 3

[timeless]

Incident ID: 14450101 
Stack Signature nsFontPSXft::FindFont() 00e6c64a 
Product ID Firefox15 
Build ID 2006012415 
Trigger Time 2006-01-26 10:20:56.0 
Platform LinuxIntel 
Operating System Linux 2.6.12-1.1372_FC3 
Module firefox-bin + (0015308f) 
URL visited litmus.mozilla.org 
User Comments crash in print preview  
Since Last Crash 0 sec 
Total Uptime 0 sec 
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11) 
Source File, Line No. /builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/gfx/src/ps/nsFontMetricsPS.cpp, line 61 
Stack Trace  

nsFontPSXft::FindFont()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/gfx/src/ps/nsFontMetricsPS.cpp, line 61]
nsFontPS::FindFont()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/gfx/src/ps/nsFontMetricsPS.cpp, line 488]
nsRenderingContextPS::DrawString()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/gfx/src/ps/nsRenderingContextPS.cpp, line 214]
nsRenderingContextPS::DrawString()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/gfx/src/ps/nsRenderingContextPS.cpp, line 1247]
nsBulletFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBulletFrame.cpp, line 375]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsBlockFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6445]
nsHTMLContainerFrame::PaintDecorationsAndChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6259]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsBlockFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6362]
nsHTMLContainerFrame::PaintDecorationsAndChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6259]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsBlockFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6362]
nsHTMLContainerFrame::PaintDecorationsAndChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6259]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsBlockFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6362]
nsHTMLContainerFrame::PaintDecorationsAndChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6259]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsContainerFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 693]
nsTableCellFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/tables/nsTableCellFrame.cpp, line 440]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsContainerFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 693]
nsTableRowFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/tables/nsTableRowFrame.cpp, line 59]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsContainerFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 693]
nsTableRowGroupFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 59]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsContainerFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 693]
nsTableFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1357]
nsTableFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 59]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsTableOuterFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 693]
nsContainerFrame::PaintChild()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 329]
nsBlockFrame::PaintChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6362]
nsHTMLContainerFrame::PaintDecorationsAndChildren()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6259]
PresShell::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 5817]
nsView::Paint()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsView.cpp, line 848]
nsViewManager::RenderDisplayListElement()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 1460]
nsViewManager::RenderViews()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 1375]
nsViewManager::Refresh()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 930]
nsViewManager::DispatchEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 842]
HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/view/src/nsView.cpp, line 251]
nsCommonWidget::DispatchEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219]
nsWindow::OnExposeEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 842]
expose_event_cb()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 3625]
libgtk-x11-2.0.so.0 + 0x10d677 (0x07b69677)
libgobject-2.0.so.0 + 0x9347 (0x008a2347)
libgobject-2.0.so.0 + 0x1fae1 (0x008b8ae1)
libgobject-2.0.so.0 + 0x20913 (0x008b9913)
libgobject-2.0.so.0 + 0x20f5a (0x008b9f5a)
libgtk-x11-2.0.so.0 + 0x2012d5 (0x07c5d2d5)
libgtk-x11-2.0.so.0 + 0x10be0b (0x07b67e0b)
libgdk-x11-2.0.so.0 + 0x2b7bf (0x0012c7bf)
libgdk-x11-2.0.so.0 + 0x2b858 (0x0012c858)
libgdk-x11-2.0.so.0 + 0x2b8d7 (0x0012c8d7)
libglib-2.0.so.0 + 0x26b5a (0x00842b5a)
libglib-2.0.so.0 + 0x237bb (0x0083f7bb)
libglib-2.0.so.0 + 0x25242 (0x00841242)
libglib-2.0.so.0 + 0x254ef (0x008414ef)
libgtk-x11-2.0.so.0 + 0x10af97 (0x07b66f97)
nsAppShell::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2315]
main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x14e23 (0x005b5e23)

Comment 4

[Chris Cooper [:coop] (he/him)]

I've created a simplified testcase. The HTML is dead simple, but there's some funky JS in there. See URL.

Comment 5

[Andrew Schultz]

Attachment: minimal testcase

crashes linux seamonkey trunk 2006013001

Comment 6

[Andrew Schultz]

(gdb) frame 7
#7  0x009af458 in nsFontPS::FindFont (aChar=49, aFont=@0x9b6701c, aFontMetrics=0x9b67018)
    at /build/andrew/moz-debug/mozilla/gfx/src/ps/nsFontMetricsPS.cpp:494
494       if (aFontMetrics->GetFontsPS()->Count() > 0) {
(gdb) p aFontMetrics->mFontsPS
$3 = (nsVoidArray *) 0x0

Comment 7

[Andrew Schultz]

Attachment: null check

The callers seem to check the return value (and assert) and this fixes the attached testcase.

Comment 8

[timeless]

Attachment: consistent null check

Comment 9

[Kenneth Herron]

(In reply to comment #8)
> Created an attachment (id=210325) [edit]
> consistent null check

I'm not sure this patch gets to the real problem. Here's a stack trace from just before the crash:

#0  nsRenderingContextPS::DrawString (this=0x8fa6b58, aString=@0xbfe1fa90,
    aX=1875, aY=1755, aFontID=-1, aSpacing=0x0)
    at /extra/kherron/moz3/sm/../mozilla/gfx/src/ps/nsRenderingContextPS.cpp:1246
#1  0xb64b54f5 in nsBulletFrame::PaintBullet (this=0x90513d8,
    aRenderingContext=@0x8fa6b58, aPt=@0xbfe1fad8)
    at /extra/kherron/moz3/sm/../mozilla/layout/generic/nsBulletFrame.cpp:405
#2  0xb64b553d in nsDisplayBullet::Paint (this=0x8ff8378, aBuilder=0xbfe1fcd8,
    aCtx=0x8fa6b58, aDirtyRect=@0xbfe1fb5c)
    at /extra/kherron/moz3/sm/../mozilla/layout/generic/nsBulletFrame.cpp:200
#3  0xb646ccc4 in nsDisplayList::Paint (this=0x8ff838c, aBuilder=0xbfe1fcd8,
    aCtx=0x8fa6b58, aDirtyRect=@0xbfe1fb5c)
    at /extra/kherron/moz3/sm/../mozilla/layout/base/nsDisplayList.cpp:161
#4  0xb646d8a4 in nsDisplayWrapList::Paint (this=0x8ff8384,
    aBuilder=0xbfe1fcd8, aCtx=0x8fa6b58, aDirtyRect=@0xbfe1fb5c)
    at /extra/kherron/moz3/sm/../mozilla/layout/base/nsDisplayList.cpp:516
#5  0xb646e1f3 in nsDisplayOpacity::Paint (this=0x8ff8384,
    aBuilder=0xbfe1fcd8, aCtx=0x8ff7bb0, aDirtyRect=@0xbfe1fbdc)
    at /extra/kherron/moz3/sm/../mozilla/layout/base/nsDisplayList.cpp:628
#6  0xb646ccc4 in nsDisplayList::Paint (this=0x8ff83b8, aBuilder=0xbfe1fcd8,
    aCtx=0x8ff7bb0, aDirtyRect=@0xbfe1fbdc)
    at /extra/kherron/moz3/sm/../mozilla/layout/base/nsDisplayList.cpp:161

Notice the |aCtx| arg changes from frame 5 to the lower-level frames. |nsDisplayOpacity::Paint| is switching rendering contexts from the print preview rendering context to the PS rendering context. For a non-opacity version of the testcase, these calls are going to a GTK rendering context.

Also, here's a dump of the nsFontMetricsPS object at issue:

$14 = {<nsIFontMetrics> = {<nsISupports> = {_vptr.nsISupports = 0xb61b13e8},
    mFont = {name = {<nsSubstring> = {<nsAString_internal> = {
            mVTable = 0xb7ee68e8, mData = 0x88b25a8, mLength = 5,
            mFlags = 5}, <No data fields>}, <No data fields>}, style = 0,
      systemFont = 0, variant = 0 '\0', familyNameQuirks = 0 '\0',
      weight = 400, decorations = 0 '\0', size = 210, sizeAdjust = 0}},
  mRefCnt = {mValue = 3}, _mOwningThread = {mThread = 0x8084550},
  mLangGroup = {mRawPtr = 0x8a7dc30}, mDeviceContext = 0x887b9cc,
  mHeight = 1073741832, mAscent = 1, mDescent = 1, mLeading = 0,
  mEmHeight = 0, mEmAscent = 0, mEmDescent = 0, mMaxHeight = 0,
  mMaxAscent = 0, mMaxDescent = 0, mMaxAdvance = 142084176,
  mXHeight = 137157888, mSuperscriptOffset = 143112912,
  mSubscriptOffset = 1096810497, mStrikeoutSize = -1209112088,
  mStrikeoutOffset = 143112732, mUnderlineSize = 0, mUnderlineOffset = 65553,
  mSpaceWidth = 63, mAveCharWidth = 143112732, mFontsPS = 0x0,
  mFontsAlreadyLoaded = 0x0, mFontPSState = 0}

This isn't a properly initialized nsFontMetricsPS object. mFontsPS should point to an nsVoidArray* and the metrics fields (mStrikeoutOffset etc.) are full of nonsense values. This could be a font metrics object from a different device context, or it may not have been initialized. Either way, the mFontsPS value, which is what this patch is checking, may be 0 only by accident.

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Hmm. Presumably 
http://lxr.mozilla.org/seamonkey/source/layout/base/nsDisplayList.cpp#620
is doing something weird ... it should probably just be failing in Print Preview, but somehow it's returning a PS rendering context?

Comment 11

[timeless]

kherron: ok, so the patch won't fix the bug :(. i think we still want its changes, could i get a review?

Comment 12

[Kenneth Herron]

Comment on attachment 210325 [details] [diff] [review]
consistent null check

This is okay, provided you add an assertion or debug warning when |GetFontsPS| returns null. That really isn't supposed to happen.

Comment 13

[timeless]

Comment on attachment 210325 [details] [diff] [review]
consistent null check

mozilla/gfx/src/ps/nsFontMetricsPS.h 	1.32
mozilla/gfx/src/ps/nsFontMetricsPS.cpp 	1.58

Comment 14

[timeless]

Comment on attachment 210325 [details] [diff] [review]
consistent null check

mozilla/gfx/src/ps/nsFontMetricsPS.cpp 	1.59

Comment 15

[Leon Sha]

Comment on attachment 210325 [details] [diff] [review]
consistent null check

This is a crash bug. I would like to see it in firefox 2.0.

Comment 16

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 210325 [details] [diff] [review]
consistent null check

a=shaver for branch.

Comment 17

[Leon Sha]

> This isn't a properly initialized nsFontMetricsPS object. mFontsPS should point
> to an nsVoidArray* and the metrics fields (mStrikeoutOffset etc.) are full of
> nonsense values. This could be a font metrics object from a different device
> context, or it may not have been initialized. Either way, the mFontsPS value,
> which is what this patch is checking, may be 0 only by accident.
> 

Is there a bug filed for this realy problem.
I have tried this patch on mozilla_1_8 branch.
This patch didn't fix the crash.
mFontsPS is not 0 here, it is just a meanless value.
This invalid pointer cause the crash.

Comment 18

[timeless]

Comment on attachment 210325 [details] [diff] [review]
consistent null check

MOZILLA_1_8_0_BRANCH:
mozilla/gfx/src/ps/nsFontMetricsPS.cpp 	1.57.16.1
mozilla/gfx/src/ps/nsFontMetricsPS.cpp 	1.57.16.2

if there's more work to be done, then this bug isn't fixed and should continue to track crashes here.

Comment 19

[Leon Sha]

Attachment: patch

Comment 20

[Adam Guthrie]

*** Bug 319201 has been marked as a duplicate of this bug. ***

Comment 21

[Leon Sha]

Comment on attachment 222009 [details] [diff] [review]
patch

There is no responce from KH for a long time. Roc can help to review this?

Comment 22

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Can you email him? he was on IRC today.

Comment 23

[Adam Guthrie]

*** Bug 356442 has been marked as a duplicate of this bug. ***

Comment 25

[Robert O'Callahan (:roc) (email my personal email if necessary)]

nsRenderingContextPS is no longer used on trunk. SetAltDevice is gone too. Is there still a branch crash that needs to be fixed? If so, and this patch fixes it, mark this bug as branch-only and then request review from me again.

Comment 26

[Jesse Ruderman]

WFM using Firefox trunk on Ubuntu 9.10.