User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050315 Firefox/1.0+ Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050315 Firefox/1.0+ See steps below Reproducible: Always Steps to Reproduce: 1. Open the testcase I've uploaded 2. Select the alt text of image that appears 3. Select command View Selections source from context menu Actual Results: Firefox crashes Expected Results: I should get source with img tag selected Crash Talkback ID: TB4370789H

dupe of bug 286314 ?

Incident ID: 4370789 Stack Signature nsFontMetricsWin::ResolveForwards d017b94a Product ID FirefoxTrunk Build ID 2005031506 Trigger Time 2005-03-15 14:37:26.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module firefox.exe + (000e164d) URL visited User Comments Selecting alt text of image and chosing View source crashes Firefox Since Last Crash 3487 sec Total Uptime 3487 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3872 Stack Trace nsFontMetricsWin::ResolveForwards [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3872] nsRenderingContextWin::GetWidth [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 1509] nsTextFrame::GetPointFromOffset [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 3940] nsTypedSelection::GetPointFromOffset [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp, line 6736] nsTypedSelection::GetCachedFrameOffset [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp, line 5087] nsTypedSelection::GetSelectionRegionRectAndScrollableView [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp, line 6864] nsTypedSelection::ScrollIntoView [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp, line 7221] nsSelection::ScrollSelectionIntoView [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsSelection.cpp, line 2703] XPCWrappedNative::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2065] XPC_WN_CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1287] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1293] js_Interpret [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313] nsXPCWrappedJSClass::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1339] nsXPCWrappedJS::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 450] SharedStub [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147] nsEventListenerManager::HandleEventSubType [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1545] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1642] nsXULElement::HandleDOMEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2046] nsXULElement::HandleDOMEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2025] nsXULElement::HandleChromeEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2731] nsGlobalWindow::HandleDOMEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 897] DocumentViewerImpl::LoadComplete [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 987] nsDocShell::EndPageLoad [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp, line 4574] nsWebShell::EndPageLoad [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsWebShell.cpp, line 662] nsDocShell::OnStateChange [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp, line 4500] nsDocLoader::FireOnStateChange [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp, line 1194] nsDocLoader::doStopDocumentLoad [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp, line 832] nsDocLoader::OnStopRequest [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp, line 653] nsLoadGroup::RemoveRequest [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 732] PresShell::RemoveDummyLayoutRequest [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6678] DummyLayoutRequestEvent::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6578] shdocvw.dll + 0x150c24 (0x778b0c24) nsDocShell::ConvertDocShellLoadInfoToLoadType [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp, line 484] 0xebffd9d7 *** This bug has been marked as a duplicate of 252970 ***