Load attachment 142223 [details] from bug 213408. Steps to reproduce when using/in attachment 142223 [details]: 1- a) select/highlight "ab" b) then drag selected text into textarea; only an "a" will appear. The caret won't be visible. c) Click into the textarea: the blinking caret will appear just on the right side of the "a". d) Then press the Enter key: crash! 2- a) select/highlight "ab" b) right-click and choose copy, c) click into textarea, d) right-click and choose paste; you'll see only "a" e) now, click outside the textarea (the blinking caret in the textarea will disappear); f) then click again somewhere in the textarea (the blinking caret in the textarea will appear on the right side of the "a"; g) now just press the enter key : crash! 3- a) select/highlight "ab", b) right-click and choose copy, c) click into textarea, d) right-click and choose paste; (you'll see only "a"); e) now, select/highlight the "a" in the textarea, f) press the del key: crash! Reproducible: always There are several other variations of these steps. TB2370784X TB2371171W TB2371179Z TB2371189Y TB2371294W TB2371335X should all have been received Mozilla 1.8a6 build 2004120405 under XP Pro SV1 SP2 here.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a6) Gecko/20041203 Yeah happened to me too, but only when i selected ab and cd too. I selected ab/cd copied them into the textarea. Only ab and c appeared, d didn't appear. I pressed delete on c, crash occurred. TB2376058E

Seems to me, that there is a problem with character count when copying. When vieved &shy is at the end of the line, so if you select AB you select only two chars, but there are 3. Than there are pasted only two chars but, as they are in the cody: only A and &shy.

Incident ID: 2371335 Stack Signature nsFontMetricsWin::ResolveForwards ac4f9a3a Product ID MozillaTrunk Build ID 2004120405 Trigger Time 2004-12-05 09:26:14.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module gkgfxwin.dll + (0000a1f5) URL visited User Comments Since Last Crash 27 sec Total Uptime 31121 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3958 Stack Trace nsFontMetricsWin::ResolveForwards [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3958] nsRenderingContextWin::GetWidth [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 1482] nsTextFrame::GetPointFromOffset [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsTextFrame.cpp, line 3773] nsTypedSelection::GetPointFromOffset [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsSelection.cpp, line 6754] nsTypedSelection::GetCachedFrameOffset [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsSelection.cpp, line 5104] nsCaret::GetCaretRectAndInvert [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 987] nsCaret::DrawCaret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 906] nsCaret::StartBlinking [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 499] nsCaret::SetCaretVisible [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 242] PresShell::SetCaretEnabled [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 3050] PresShellViewEventListener::RestoreCaretVisibility [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 7128] PresShellViewEventListener::DidRefreshRegion [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 7187] nsViewManager::Refresh [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 975] nsViewManager::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1940] HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1078] nsWindow::DispatchWindowEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1100] nsWindow::OnPaint [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5093] nsWindow::ProcessMessage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 3863] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1356] USER32.dll + 0x8709 (0x77d48709) USER32.dll + 0x87eb (0x77d487eb) USER32.dll + 0xb368 (0x77d4b368) USER32.dll + 0xb3b4 (0x77d4b3b4) ntdll.dll + 0xeae3 (0x7c90eae3) nsWindow::Update [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 2700] nsViewManager::UpdateWidgetsForView [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 3064] nsViewManager::ForceUpdate [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 3448] nsViewManager::Composite [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1631] nsViewManager::EnableRefresh [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 3294] nsViewManager::EndUpdateViewBatch [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 3347] nsEditor::EndUpdateViewBatch [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/base/nsEditor.cpp, line 4393] nsEditor::EndPlaceHolderTransaction [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/base/nsEditor.cpp, line 799] nsPlaintextEditor::DeleteSelection [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 885] nsTextEditorKeyListener::KeyPress [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp, line 203] DispatchToInterface [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 129] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1601] nsGenericElement::HandleDOMEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2000] nsHTMLTextAreaElement::HandleDOMEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp, line 599] PresShell::HandleEventInternal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 5944] PresShell::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 5804] nsViewManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2354] nsViewManager::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2131] HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1078] nsWindow::DispatchWindowEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1095] nsWindow::DispatchKeyEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 3004] nsWindow::OnKeyDown [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 3129] nsWindow::ProcessMessage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 3975] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1356] USER32.dll + 0x8709 (0x77d48709) USER32.dll + 0x87eb (0x77d487eb) USER32.dll + 0x89a5 (0x77d489a5) USER32.dll + 0x89e8 (0x77d489e8) nsAppShell::Run [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp, line 159] nsAppStartup::Run [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 216] main1 [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1330] main [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1801] WinMain [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1827] WinMainCRTStartup() kernel32.dll + 0x16d4f (0x7c816d4f) *** This bug has been marked as a duplicate of 252970 ***

Incident ID: 2376058 Stack Signature nsFontMetricsGTK::GetWidth() 3839c9db Product ID MozillaTrunk Build ID 2004120305 Trigger Time 2004-12-05 13:55:42.0 Platform LinuxIntel Operating System Linux 2.4.20-20.8custom Module libgfx_gtk.so + (0003a343) URL visited https://bugzilla.mozilla.org/attachment.cgi?id=142223&action=view User Comments Selected ab and cd, copied it into the textarea, tried to delete c. -->crash Since Last Crash 7 sec Total Uptime 7 sec Trigger Reason SIGSEGV: Segmentation Fault: (signal 11) Source File, Line No. /builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp, line 3684 Stack Trace nsFontMetricsGTK::GetWidth() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp, line 3684] nsRenderingContextGTK::GetWidth() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp, line 1251] nsTextFrame::GetPointFromOffset() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/html/base/src/nsTextFrame.cpp, line 1444] nsTypedSelection::GetPointFromOffset() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/content/base/src/nsSelection.cpp, line 6737] nsTypedSelection::GetCachedFrameOffset() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/content/base/src/nsSelection.cpp, line 5104] nsCaret::GetCaretRectAndInvert() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 134] nsCaret::DrawCaret() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 905] nsCaret::StartBlinking() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 500] nsCaret::SetCaretVisible() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/base/src/nsCaret.cpp, line 246] PresShell::SetCaretEnabled() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 848] PresShellViewEventListener::RestoreCaretVisibility() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 848] PresShellViewEventListener::DidRefreshRegion() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 7165] nsViewManager::Refresh() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 970] nsViewManager::DispatchEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 842] HandleEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWidget::DispatchEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1520] nsWidget::DispatchWindowEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1410] nsWindow::DoPaint() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWindow.cpp, line 842] nsWindow::Update() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWindow.cpp, line 903] nsViewManager::UpdateWidgetsForView() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 332] nsViewManager::UpdateWidgetsForView() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 245] nsViewManager::ForceUpdate() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 3448] nsViewManager::Composite() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 432] nsViewManager::EnableRefresh() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 3293] nsViewManager::EndUpdateViewBatch() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 3346] nsEditor::EndUpdateViewBatch() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/editor/libeditor/base/nsEditor.cpp, line 4387] nsEditor::EndPlaceHolderTransaction() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/editor/libeditor/base/nsEditor.cpp, line 799] nsPlaintextEditor::DeleteSelection() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 65] nsTextEditorKeyListener::KeyPress() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp, line 243] DispatchToInterface(nsIDOMEvent*, nsIDOMEventListener*, unsigned (nsIDOMEventListener::*)() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 128] nsEventListenerManager::HandleEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1600] nsGenericElement::HandleDOMEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2000] nsHTMLTextAreaElement::HandleDOMEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp, line 599] PresShell::HandleEventInternal() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 848] PresShell::HandleEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 5771] nsViewManager::HandleEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 2354] nsViewManager::DispatchEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsViewManager.cpp, line 2127] HandleEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWidget::DispatchEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1520] nsWidget::DispatchWindowEvent() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1410] nsWidget::OnKey() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 101] handle_key_press_event() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsGtkEventHandler.cpp, line 597] dispatch_superwin_event() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsGtkEventHandler.cpp, line 900] handle_gdk_event() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsGtkEventHandler.cpp, line 790] libgdk-1.2.so.0 + 0x17d6f (0x4035fd6f) libglib-1.2.so.0 + 0x119ae (0x403929ae) libglib-1.2.so.0 + 0x11e89 (0x40392e89) libglib-1.2.so.0 + 0x12124 (0x40393124) libgtk-1.2.so.0 + 0x942e3 (0x402ae2e3) nsAppShell::Run() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/widget/src/gtk/nsAppShell.cpp, line 304] nsAppStartup::Run() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 216] main1() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1297] main() [/builds/tinderbox/SeaMonkey-Release/Linux_2.4.2-2_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1801] libc.so.6 + 0x1562d (0x404d062d)

For the record, I suspect this is actually the same issue later reported as bug 319914 - which is not a duplicate of bug 252970 (and was only fixed much later by bug 321487). Since I can't reproduce this crash on Mac (even in old builds), I can't positively verify this.