56382 - Copy and paste from java console crashes Mozilla

Status: VERIFIED DUPLICATE of bug 63563

(MailNews Core :: Composition, defect, P1)

Description

[Matthew Beermann]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; m18) Gecko/20001010
BuildID:    2000101014

Mozilla crashes if I attempt to copy text from the the Sun Java 2 Plugin's console.

Reproducible: Always
Steps to Reproduce:
1. Open a message composition window.
2. Attempt to open the Volano Chat applet.
3. Open the Java Plugin's console and highlight the stack trace from the null
pointer exception.
4. Press Copy.
5. Go to your message composition window and paste.

Actual Results:  Mozilla crashes.

Expected Results:  The text from the console should have been pasted.

Comment 1

[buster]

Reproducable on WinNT 4 buildID 2000101608.
cc-ing some editor and clipboard folks.  I don't know if or how the java console
makes any difference, but other paste operations work fine.

Here's the stack trace:

_free_dbg_lk() line 1033 + 60 bytes
_free_dbg() line 970 + 13 bytes
free() line 926 + 11 bytes
PR_Free() line 66 + 10 bytes
nsMemoryImpl::Free() line 324 + 10 bytes
nsMemory::Free() line 526
nsClipboard::GetDataFromDataObject() line 645 + 9 bytes
nsClipboard::GetNativeClipboardData() line 834 + 17 bytes
nsBaseClipboard::GetData() line 113 + 20 bytes
nsHTMLEditor::Paste() line 5755 + 45 bytes
nsHTMLEditorLog::Paste() line 357 + 13 bytes
nsPasteCommand::DoCommand() line 166 + 40 bytes
nsControllerCommandManager::DoCommand() line 189 + 31 bytes
nsEditorController::DoCommand() line 201
nsXBLPrototypeHandler::ExecuteHandler() line 249
DoKey() line 93
nsXBLKeyHandler::KeyPress() line 108 + 34 bytes
nsEventListenerManager::HandleEvent() line 1118 + 23 bytes
nsGenericElement::HandleDOMEvent() line 1405
nsHTMLInputElement::HandleDOMEvent() line 897 + 31 bytes
PresShell::HandleEventInternal() line 4379 + 47 bytes
PresShell::HandleEvent() line 4314 + 25 bytes
nsView::HandleEvent() line 379
nsView::HandleEvent() line 352
nsView::HandleEvent() line 352
nsViewManager2::DispatchEvent() line 1439
HandleEvent() line 68
nsWindow::DispatchEvent() line 681 + 10 bytes
nsWindow::DispatchWindowEvent() line 702
nsWindow::DispatchKeyEvent() line 2284 + 15 bytes
nsWindow::OnChar() line 2408
nsWindow::ProcessMessage() line 2841 + 33 bytes
nsWindow::WindowProc() line 950 + 27 bytes
USER32! 77e71820()
str_substr() line 1778 + 41 bytes

The data pointer being freed in nsClipboard::GetDataFromDataObject() looks
legit.  Looking at memory at that location, I see the string of text I copied
from the java console.

Comment 2

[Akkana Peck]

Adding jst and jfrancis, maybe they know of recent changes in this code.

Comment 3

[Jean-Francois Ducarroz]

Looks like an editor problem. Reassign to them

Comment 4

[rubydoo123]

assign to kin to see if he can narrow down the culprit

Comment 5

[rubydoo123]

incident # 23970414

 Call Stack:    (Signature = KERNEL32.DLL + 0xa179 (0xbff7a179) bac9353a)
   KERNEL32.DLL + 0xa179 (0xbff7a179)

that's it for the stack trace 

Comment 6

[rubydoo123]

kin took a look at this one and believes it should be handled by trudelle's 
team, reassigning

Comment 7

[Peter Trudelle]

->pinkerton

Comment 8

[Mike Pinkerton (not reading bugmail)]

dupe

*** This bug has been marked as a duplicate of 63563 ***

Comment 9

[laurel]

Marking verified as a duplicate.