382778 - Crash [@ nsEditor::InsertNode] with execCommand insertorderedlist and selection in text node

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase makes Firefox (Mac trunk debug) crash [@ nsEditor::InsertNode] dereferencing the bogus address 0x5590c3d1.

Comment 1

[Jesse Ruderman]

Are any of you interested in fixing this sg:critical bug? :)

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Doesn't peterv own editor now? :)

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Linux trunk crashes too, OS -> All

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Peterv has the patch already

Comment 5

[Peter Van der Beken [:peterv]]

Attachment: v1

This fixes the crash and similar lurking crashes.

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: Additional fix v1

After fixing the crash the testcase still throws an exception. This is a small aditional fix for that: when getting an array of nodes from the selection's ranges we should not have duplicates in the array.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 268122 [details] [diff] [review]
Additional fix v1


>+    else {
>+      nsCOMArray<nsIDOMNode> nodes;
>+      nsUniqueFunctor functor(outArrayOfNodes);
>+      res = iter.AppendList(functor, nodes);
>+      if (NS_FAILED(res)) return res;
>+      if (!outArrayOfNodes.AppendObjects(nodes))
>+        return NS_ERROR_OUT_OF_MEMORY;
>+    }

Some comment here might be useful.

Comment 8

[Daniel Veditz [:dveditz]]

This doesn't crash me in FF2 windows. Is this a Mac only or trunk-only issue?

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

This blocks some blocking1.8.1.5+ bugs.

Comment 10

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 268120 [details] [diff] [review]
v1

>@@ -2693,13 +2684,10 @@ NS_IMETHODIMP nsEditor::InsertTextIntoTe
>     {
>       DeleteNode(mIMETextNode);
>       mIMETextNode = nsnull;
>-      ((IMETextTxn*)txn)->MarkFixed();  // mark the ime txn "fixed"
>+      ((IMETextTxn*)txn.get())->MarkFixed();  // mark the ime txn "fixed"

Please change this to NS_STATIC_CAST

sr=me

Comment 11

[Daniel Veditz [:dveditz]]

Will the patch in this bug work for the branch as well, or do you need another patch to get approval?

Comment 12

[Peter Van der Beken [:peterv]]

Attachment: v1 (Ported to branch)

This is just attachment 268120 [details] [diff] [review] with some fixes to make it compile on branches.

Comment 13

[Daniel Veditz [:dveditz]]

has this landed on trunk yet? If not please land so QA can verify the fix.

Comment 14

[Peter Van der Beken [:peterv]]

Hrmpf, apparently I forgot to mark this fixed when I landed it last week.

Comment 15

[Daniel Veditz [:dveditz]]

Comment on attachment 271687 [details] [diff] [review]
v1 (Ported to branch)

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers.

This has to land within ~36 hrs or we have to pull the plug on getting it this release.

Comment 16

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.5 using the testcase with :

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.5pre) Gecko/2007071103 BonEcho/2.0.0.5pre on Mac OSX

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.5pre) Gecko/2007071103 BonEcho/2.0.0.5pre on Linux Fedora F7

and Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/2007071103 BonEcho/2.0.0.5pre

no crash on Testcase - adding verified keyword.

I want to mention that using this testcase cause on all plattform this error message in the error console :
Error: uncaught exception: [Exception... "Component returned failure code: 0x80004001 (NS_ERROR_NOT_IMPLEMENTED) [nsIDOM3Document.adoptNode]"  nsresult: "0x80004001 (NS_ERROR_NOT_IMPLEMENTED)"  location: "JS frame :: https://bugzilla.mozilla.org/attachment.cgi?id=266879 :: init2 :: line 26"  data: no]

Comment 17

[Peter Van der Beken [:peterv]]

Attachment: branch testcase

Ah, yes, adoptNode isn't implemented on the branch. Here's a testcase for the branch.

Comment 18

[Carsten Book [:Tomcat]]

the 2nd testcase works fine on windows but crash the mac and linux build.

On Linux talkback doesn`t catch the crash. But the Mac Crash Reporting comes up:

Date/Time:      2007-07-11 18:19:49.403 +0200
OS Version:     10.4.10 (Build 8R2232)
Report Version: 4

Command: firefox-bin
Path:    /Volumes/BonEcho/BonEcho.app/Contents/MacOS/firefox-bin
Parent:  launchd [1]

Version: 2.0.0.5pre (2.0.0.5pre)

PID:    235
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   org.mozilla.firefox                 0x006a6950 nsNodeInfo::GetQualifiedName(nsAString_internal&) const + 132
1   org.mozilla.firefox                0x004c6c21 nsGenericHTMLElement::GetNodeName(nsAString_internal&) + 29
2   org.mozilla.firefox                 0x003bf541 nsHTMLEditor::RemoveListenerAndDeleteRef(nsAString_internal const&, nsIDOMEventListener*, int, nsIDOMElement*, nsIContent*, nsIPresShell*) + 1447
3   org.mozilla.firefox                0x000d27a4 nsHTMLEditor::EndUpdateViewBatch() + 102
4   org.mozilla.firefox                0x003cdc39 nsEditor::RemoveEventListeners() + 1605
5   org.mozilla.firefox                0x000de22a nsHTMLEditor::~nsHTMLEditor [in-charge]() + 10176
6   org.mozilla.firefox                 0x0052989f nsListCommand::ToggleState(nsIEditor*, char const*) + 397
7   org.mozilla.firefox                0x00528cc3 nsAbsolutePositioningCommand::ToggleState(nsIEditor*, char const*) + 775
8   org.mozilla.firefox                 0x00208811 nsControllerCommandTable::~nsControllerCommandTable [in-charge]() + 465
9   org.mozilla.firefox                0x0020669e nsBaseCommandController::~nsBaseCommandController [in-charge]() + 1116
10  org.mozilla.firefox                0x001f8ac1 nsCommandManager::GetControllerForCommand(char const*, nsIDOMWindow*, nsIController**) + 585
11  org.mozilla.firefox                0x00142f59 nsHTMLDocument::OpenCommon(nsACString_internal const&, int) + 3587
12  libxpcom_core.dylib                0x00e5a8d9 XPTC_InvokeByIndex + 81
13  org.mozilla.firefox                0x0037045b XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 743
14  org.mozilla.firefox                0x003626fb XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, long*) + 261
15  libmozjs.dylib                     0x00c556d7 js_Invoke + 858
16  libmozjs.dylib                     0x00c47e61 js_Interpret + 4632
17  libmozjs.dylib                     0x00c55e7e js_Invoke + 2817
18  libmozjs.dylib                     0x00c5655e js_InternalInvoke + 146
19  libmozjs.dylib                     0x00c1b3b1 JS_CallFunctionValue + 62
20  org.mozilla.firefox                0x004fff6a nsJSContext::CallEventHandler(JSObject*, JSObject*, unsigned, long*, long*) + 430
21  org.mozilla.firefox                0x0040a537 nsGlobalWindow::RunTimeout(nsTimeout*) + 1475
22  org.mozilla.firefox                0x0040a5b6 nsGlobalWindow::TimerCallback(nsITimer*, void*) + 32
23  libxpcom_core.dylib                0x00e47781 nsTimerImpl::Fire() + 187
24  libxpcom_core.dylib                0x00e47f53 handleTimerEvent(TimerEventType*) + 107
25  libxpcom_core.dylib                0x00e44551 PL_HandleEvent + 21
26  libxpcom_core.dylib                0x00e4480a PL_ProcessPendingEvents + 103
27  com.apple.CoreFoundation           0x9082cf92 CFRunLoopRunSpecific + 1213
28  com.apple.CoreFoundation           0x9082cace CFRunLoopRunInMode + 61
29  com.apple.HIToolbox                0x92ddc8d8 RunCurrentEventLoopInMode + 285
30  com.apple.HIToolbox                0x92ddbfe2 ReceiveNextEventCommon + 385
31  com.apple.HIToolbox                0x92e24a74 _AcquireNextEvent + 58
32  com.apple.HIToolbox                0x92e248bc RunApplicationEventLoop + 150
33  org.mozilla.firefox                0x0023520f nsAppShell::~nsAppShell [in-charge deleting]() + 133
34  org.mozilla.firefox                0x002c0d9a nsAppStartup::DestroyExitEvent(PLEvent*) + 148
35  org.mozilla.firefox                0x000066ae XRE_main + 5892
36  org.mozilla.firefox                0x000032b8 main + 32
37  org.mozilla.firefox                0x0000323e start + 270
38  org.mozilla.firefox                0x00003159 start + 41

Thread 1:
0   libSystem.B.dylib                  0x9001a1cc select + 12
1   libnspr4.dylib                      0x00ed99bc PR_Poll + 134
2   org.mozilla.firefox                0x0033c5af nsSocketTransportService::Poll(unsigned*) + 99
3   org.mozilla.firefox                0x0033cc00 nsSocketTransportService::ServiceEventQ() + 606
4   libxpcom_core.dylib                0x00e46fe3 nsThread::Main(void*) + 41
5   libnspr4.dylib                     0x00edaffd PR_Select + 813
6   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 2:
0   libSystem.B.dylib                  0x90047dd7 semaphore_timedwait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6694 PR_Lock + 246
2   libnspr4.dylib                     0x00ed69eb PR_WaitCondVar + 75
3   libxpcom_core.dylib                0x00e492fc TimerThread::Shutdown() + 284
4   libxpcom_core.dylib                0x00e46fe3 nsThread::Main(void*) + 41
5   libnspr4.dylib                     0x00edaffd PR_Select + 813
6   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 3:
0   libSystem.B.dylib                  0x900248c7 semaphore_wait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6a75 PR_WaitCondVar + 213
2   org.mozilla.firefox                0x0034f8b0 nsSSLThread::Run() + 162
3   libnspr4.dylib                     0x00edaffd PR_Select + 813
4   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 4:
0   libSystem.B.dylib                  0x900248c7 semaphore_wait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6a75 PR_WaitCondVar + 213
2   org.mozilla.firefox                0x0034c4e5 nsCertVerificationThread::Run() + 239
3   libnspr4.dylib                     0x00edaffd PR_Select + 813
4   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 5:
0   libSystem.B.dylib                  0x900248c7 semaphore_wait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6a75 PR_WaitCondVar + 213
2   org.mozilla.firefox                0x005240d0 mozStorageService::FinishAsyncIO() + 284
3   org.mozilla.firefox                0x008636a2 nsPluginNativeWindow::~nsPluginNativeWindow [in-charge deleting]() + 424
4   libxpcom_core.dylib                0x00e46fe3 nsThread::Main(void*) + 41
5   libnspr4.dylib                     0x00edaffd PR_Select + 813
6   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 6:
0   libSystem.B.dylib                  0x900248c7 semaphore_wait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6a75 PR_WaitCondVar + 213
2   libnspr4.dylib                     0x00ed6cd5 PR_Wait + 53
3   libxpcom_core.dylib                0x00e4466e PL_WaitForEvent + 62
4   libxpcom_core.dylib                0x00e45939 nsEventQueueImpl::CheckForDeactivation() + 149
5   org.mozilla.firefox                0x002e678d nsUrlClassifierDBServiceWorker::~nsUrlClassifierDBServiceWorker [in-charge]() + 345
6   libnspr4.dylib                     0x00edaffd PR_Select + 813
7   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 7:
0   libSystem.B.dylib                  0x90009cd7 mach_msg_trap + 7
1   ...romedia.Flash Player.plugin     0x1a7ee52d Flash_EnforceLocalSecurity + 360501
2   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 8:
0   libSystem.B.dylib                  0x90047dd7 semaphore_timedwait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6694 PR_Lock + 246
2   libnspr4.dylib                     0x00ed69eb PR_WaitCondVar + 75
3   org.mozilla.firefox                0x0059bd5a nsHostResolver::GetHostToLookup(nsHostRecord**) + 212
4   org.mozilla.firefox                0x0059c507 nsHostResolver::ThreadFunc(void*) + 123
5   libnspr4.dylib                     0x00edaffd PR_Select + 813
6   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 9:
0   libSystem.B.dylib                  0x90047dd7 semaphore_timedwait_signal_trap + 7
1   libnspr4.dylib                     0x00ed6694 PR_Lock + 246
2   libnspr4.dylib                     0x00ed69eb PR_WaitCondVar + 75
3   org.mozilla.firefox                0x00301921 nsIOThreadPool::ThreadFunc(void*) + 145
4   libnspr4.dylib                     0x00edaffd PR_Select + 813
5   libSystem.B.dylib                  0x90024227 _pthread_body + 84

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x00000000  ebx: 0xbfffdf28  ecx: 0xbfffe024  edx: 0x00010000
  edi: 0x1917e110  esi: 0xbfffe024  ebp: 0xbfffdfd8  esp: 0xbfffdf10
   ss: 0x0000001f  efl: 0x00010213  eip: 0x006a6950   cs: 0x00000017
   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037

Binary Images Description:
    0x1000 -   0x98afff org.mozilla.firefox 2.0.0.5pre    /Volumes/BonEcho/BonEcho.app/Contents/MacOS/firefox-bin
  0xc16000 -   0xca7fff libmozjs.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libmozjs.dylib
  0xcc2000 -   0xcc2fff libxpcom.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libxpcom.dylib
  0xcc6000 -   0xccbfff libplds4.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libplds4.dylib
  0xcd0000 -   0xcd6fff libplc4.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libplc4.dylib
  0xcdc000 -   0xcebfff libxpcom_compat.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libxpcom_compat.dylib
  0xe05000 -   0xe75fff libxpcom_core.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libxpcom_core.dylib
  0xec0000 -   0xee5fff libnspr4.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libnspr4.dylib
  0xef6000 -   0xf0ffff libsmime3.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libsmime3.dylib
  0xf1b000 -   0xf3bfff libssl3.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libssl3.dylib
  0xf45000 -   0xf9bfff libnss3.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libnss3.dylib
 0x1808000 -  0x184efff libsoftokn3.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libsoftokn3.dylib
 0x1a42000 -  0x1a4cfff libjsd.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/components/libjsd.dylib
 0x1a51000 -  0x1a59fff libmyspell.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/components/libmyspell.dylib
 0x1a5d000 -  0x1a67fff libspellchecker.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/components/libspellchecker.dylib
 0x1a6c000 -  0x1a9cfff libxpinstall.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/components/libxpinstall.dylib
 0x1ac1000 -  0x1ac2fff com.apple.textencoding.unicode 2.1    /System/Library/TextEncodings/Unicode Encodings.bundle/Contents/MacOS/Unicode Encodings
0x149d5000 - 0x149d8fff com.netscape.DefaultPlugin Default Plug-in version 1.0 (1.0)    /Volumes/BonEcho/BonEcho.app/Contents/MacOS/plugins/Default Plugin.plugin/Contents/MacOS/Default Plugin
0x14b05000 - 0x14b62fff libfreebl3.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libfreebl3.dylib
0x14c23000 - 0x14c54fff libnssckbi.dylib     /Volumes/BonEcho/BonEcho.app/Contents/MacOS/libnssckbi.dylib
0x14c67000 - 0x14c97fff com.netscape.MRJPlugin MRJ Plugin version 1.0-JEP-0.9.6.2 (1.0-JEP-0.9.6.2)    /Volumes/BonEcho/BonEcho.app/Contents/MacOS/plugins/MRJPlugin.plugin/Contents/MacOS/MRJPlugin
0x14cb0000 - 0x14cf2fff JavaEmbeddingPlugin Java Embedding Plugin version 0.9.6.2 (0.9.6.2)    /Volumes/BonEcho/BonEcho.app/Contents/MacOS/plugins/JavaEmbeddingPlugin.bundle/Contents/MacOS/JavaEmbeddingPlugin
0x1a405000 - 0x1a928fff com.macromedia.Flash Player.plugin 9.0.28 (1.0.4f22)    /Library/Internet Plug-Ins/Flash Player.plugin/Contents/MacOS/Flash Player
0x8fe00000 - 0x8fe4afff dyld 46.12    /usr/lib/dyld
0x90000000 - 0x90171fff libSystem.B.dylib     /usr/lib/libSystem.B.dylib
0x901c1000 - 0x901c3fff libmathCommon.A.dylib     /usr/lib/system/libmathCommon.A.dylib
0x901c5000 - 0x90202fff com.apple.CoreText 1.1.2 (???)    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x90229000 - 0x902fffff ATS     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x9031f000 - 0x90774fff com.apple.CoreGraphics 1.258.75 (???)    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x9080b000 - 0x908d3fff com.apple.CoreFoundation 6.4.7 (368.28)    /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90911000 - 0x90911fff com.apple.CoreServices 10.4 (???)    /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x90913000 - 0x90a07fff libicucore.A.dylib     /usr/lib/libicucore.A.dylib
0x90a57000 - 0x90ad6fff libobjc.A.dylib     /usr/lib/libobjc.A.dylib
0x90aff000 - 0x90b63fff libstdc++.6.dylib     /usr/lib/libstdc++.6.dylib
0x90bd2000 - 0x90bd9fff libgcc_s.1.dylib     /usr/lib/libgcc_s.1.dylib
0x90bde000 - 0x90c51fff com.apple.framework.IOKit 1.4.8 (???)    /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90c66000 - 0x90c78fff libauto.dylib     /usr/lib/libauto.dylib
0x90c7e000 - 0x90f24fff com.apple.CoreServices.CarbonCore 682.26    /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x90f67000 - 0x90fcffff com.apple.CoreServices.OSServices 4.1    /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x91007000 - 0x91045fff com.apple.CFNetwork 129.20    /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x91058000 - 0x91068fff com.apple.WebServices 1.1.3 (1.1.0)    /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/WebServicesCore.framework/Versions/A/WebServicesCore
0x91073000 - 0x910f1fff com.apple.SearchKit 1.0.5    /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x91126000 - 0x91144fff com.apple.Metadata 10.4.4 (121.36)    /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x91150000 - 0x9115efff libz.1.dylib     /usr/lib/libz.1.dylib
0x91161000 - 0x91300fff com.apple.security 4.5.2 (29774)    /System/Library/Frameworks/Security.framework/Versions/A/Security
0x913fe000 - 0x91406fff com.apple.DiskArbitration 2.1.1    /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x9140d000 - 0x91414fff libbsm.dylib     /usr/lib/libbsm.dylib
0x91418000 - 0x9143efff com.apple.SystemConfiguration 1.8.6    /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x91450000 - 0x914c6fff com.apple.audio.CoreAudio 3.0.4    /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x91517000 - 0x91517fff com.apple.ApplicationServices 10.4 (???)    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x91519000 - 0x91544fff com.apple.AE 314 (313)    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x91557000 - 0x9162bfff com.apple.ColorSync 4.4.9    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x91666000 - 0x916d9fff com.apple.print.framework.PrintCore 4.6 (177.13 )    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x91707000 - 0x917b0fff com.apple.QD 3.10.24 (???)    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x917d6000 - 0x91821fff com.apple.HIServices 1.5.2 (???)    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x91840000 - 0x91856fff com.apple.LangAnalysis 1.6.3    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x91862000 - 0x9187cfff com.apple.FindByContent 1.5    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/FindByContent.framework/Versions/A/FindByContent
0x91886000 - 0x918c3fff com.apple.LaunchServices 182    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x918d7000 - 0x918e3fff com.apple.speech.synthesis.framework 3.5    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x918ea000 - 0x9192afff com.apple.ImageIO.framework 1.5.5    /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x9193d000 - 0x919effff libcrypto.0.9.7.dylib     /usr/lib/libcrypto.0.9.7.dylib
0x91a35000 - 0x91a4bfff libcups.2.dylib     /usr/lib/libcups.2.dylib
0x91a50000 - 0x91a6efff libJPEG.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x91a73000 - 0x91ad2fff libJP2.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
0x91ae4000 - 0x91ae8fff libGIF.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x91aea000 - 0x91b70fff libRaw.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRaw.dylib
0x91b74000 - 0x91bb1fff libTIFF.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x91bb7000 - 0x91bd1fff libPng.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x91bd6000 - 0x91bd8fff libRadiance.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x91bda000 - 0x91cb8fff libxml2.2.dylib     /usr/lib/libxml2.2.dylib
0x91cd5000 - 0x91cd5fff com.apple.Accelerate 1.3.1 (Accelerate 1.3.1)    /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x91cd7000 - 0x91d65fff com.apple.vImage 2.5    /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x91d6c000 - 0x91d6cfff com.apple.Accelerate.vecLib 3.3.1 (vecLib 3.3.1)    /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x91d6e000 - 0x91dc7fff libvMisc.dylib     /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x91dd0000 - 0x91df4fff libvDSP.dylib     /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x91dfc000 - 0x92205fff libBLAS.dylib     /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x9223f000 - 0x925f3fff libLAPACK.dylib     /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x92620000 - 0x9270dfff libiconv.2.dylib     /usr/lib/libiconv.2.dylib
0x9270f000 - 0x9278cfff com.apple.DesktopServices 1.3.6    /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x927cd000 - 0x929fdfff com.apple.Foundation 6.4.8 (567.29)    /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x92b17000 - 0x92b2efff libGL.dylib     /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x92b39000 - 0x92b91fff libGLU.dylib     /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x92ba5000 - 0x92ba5fff com.apple.Carbon 10.4 (???)    /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x92ba7000 - 0x92bb7fff com.apple.ImageCapture 3.0.4    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x92bc6000 - 0x92bcefff com.apple.speech.recognition.framework 3.6    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x92bd4000 - 0x92bd9fff com.apple.securityhi 2.0.1 (24742)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x92bdf000 - 0x92c70fff com.apple.ink.framework 101.2.1 (71)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x92c84000 - 0x92c87fff com.apple.help 1.0.3 (32.1)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x92c8a000 - 0x92ca8fff com.apple.openscripting 1.2.5 (???)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x92cba000 - 0x92cc0fff com.apple.print.framework.Print 5.2 (192.4)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x92cc6000 - 0x92d29fff com.apple.htmlrendering 66.1 (1.1.3)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x92d4d000 - 0x92d8efff com.apple.NavigationServices 3.4.4 (3.4.3)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x92db5000 - 0x92dc2fff com.apple.audio.SoundManager 3.9.1    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x92dc9000 - 0x92dcefff com.apple.CommonPanels 1.2.3 (73)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x92dd3000 - 0x930c8fff com.apple.HIToolbox 1.4.9 (???)    /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x931ce000 - 0x931d9fff com.apple.opengl 1.4.16    /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x93202000 - 0x93206fff com.apple.JavaVM 11.5.0    /System/Library/Frameworks/JavaVM.framework/Versions/A/JavaVM
0x93249000 - 0x93249fff com.apple.Cocoa 6.4 (???)    /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x9324b000 - 0x93901fff com.apple.AppKit 6.4.8 (824.42)    /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x93c82000 - 0x93cfdfff com.apple.CoreData 91 (92.1)    /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x93d36000 - 0x93df0fff com.apple.audio.toolbox.AudioToolbox 1.4.5    /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x93e33000 - 0x93e33fff com.apple.audio.units.AudioUnit 1.4.2    /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x93e35000 - 0x93ff6fff com.apple.QuartzCore 1.4.12    /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x9403c000 - 0x9407dfff libsqlite3.0.dylib     /usr/lib/libsqlite3.0.dylib
0x94085000 - 0x940bffff libGLImage.dylib     /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x940c4000 - 0x940dafff com.apple.CoreVideo 1.4    /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x9426d000 - 0x9427cfff libCGATS.A.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x94283000 - 0x9428efff libCSync.A.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x942da000 - 0x942f4fff libRIP.A.dylib     /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x942fa000 - 0x945f9fff com.apple.QuickTime 7.1.6    /System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime
0x96ec7000 - 0x96edbfff com.apple.audio.CoreAudioKit 1.0.1    /System/Library/Frameworks/CoreAudioKit.framework/Versions/A/CoreAudioKit

Comment 19

[Peter Van der Beken [:peterv]]

I can't reproduce that crash on a current OS X branch build.

Comment 20

[Marcia Knous [:marcia]]

Attachment: Crash report using the second testcase.

I crash when I try to run the second testcase. I can repro 100% of the time on the latest 2.0.0.5pre.

Comment 21

[Peter Van der Beken [:peterv]]

I'll try an optimized build tomorrow, but my debug build doesn't crash at all.

Comment 22

[Peter Van der Beken [:peterv]]

Can't reproduce the crash in my own build. Yesterday's nightly does crash for me but I don't think it had the fix: the build started at 2007/07/11 03:01 and my checkin was at 2007-07-11 03:13. Let's try again with today's nightly.

Comment 23

[Peter Van der Beken [:peterv]]

Doesn't crash for me in the latest 2.0.0.5pre nightlies. Marcia/Carsten, can you confirm?

Comment 24

[Carsten Book [:Tomcat]]

hi Peter, no crash on 2005 RC1 candidate builds on Mac and Linux and Vista Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.5) Gecko/2007071216 Firefox/2.0.0.5

so i can confirm this bug as verified fixed for 1.8.1.5

Comment 25

[juan becerra [:juanb]]

I was not able to reproduce the crash on Tbird 15012 or Tbird 15013 in XP.

Comment 26

[Carsten Book [:Tomcat]]

verified fixed using 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre

No crash on testcase - adding verified keyword

Comment 27

[Jesse Ruderman]

Crashtest checked in.