488579 - Crash [@ nsTypedSelection::RemoveRange] with ctrl double click in table then ctrl single click

Status: RESOLVED DUPLICATE of bug 488417

(Core :: DOM: Selection, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, to reproduce the crash:
- Double-click on the text, while holding the ctrl key.
- Then single click on the text, while holding the ctrl key.

This is probably a recent regression. I noticed this in the topcrashers for current trunk build.

http://crash-stats.mozilla.com/report/index/e544e612-919e-47bd-af96-10d452090415?p=1
0  	xul.dll  	nsTypedSelection::RemoveRange  	 layout/generic/nsSelection.cpp:5126
1 	xul.dll 	nsFrameSelection::HandleTableSelection 	layout/generic/nsSelection.cpp:2756
2 	xul.dll 	HandleFrameSelection 	layout/generic/nsFrame.cpp:2384
3 	xul.dll 	nsFrame::HandleRelease 	layout/generic/nsFrame.cpp:2461
4 	xul.dll 	nsFrame::HandleEvent 	layout/generic/nsFrame.cpp:1707
5 	xul.dll 	nsPresShellEventCB::HandleEvent 	layout/base/nsPresShell.cpp:1384
6 	xul.dll 	xul.dll@0x3c0cd8 

The testcase also has some privileged code that it would make crash automatically if you would grant the privileges, btw.

Comment 1

[Martijn Wargers (dead)]

This seems to have regressed somewhere between 2009-04-01 and 2009-04-12. I don't have trunk builds between those dates, atm.