spun off from bug 273657 comment 2 Incident ID: 8166575 Stack Signature nsCopySupport::HTMLCopy() ac103fe5 Product ID FirefoxTrunk Build ID 2005071205 Trigger Time 2005-08-07 13:17:22.0 Platform LinuxIntel Operating System Linux 2.4.27-2-k7 Module firefox-bin + (002d9da6) URL visited User Comments Since Last Crash 2 sec Total Uptime 2 sec Trigger Reason SIGSEGV: Segmentation Fault: (signal 11) Source File, Line No. /builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsCopySupport.cpp, line 848 Stack Trace nsCopySupport::HTMLCopy() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsCopySupport.cpp, line 848] nsAutoCopyListener::NotifySelectionChanged() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp, line 842] nsTypedSelection::NotifySelectionListeners() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp, line 842] nsSelection::SetMouseDownState() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsSelection.cpp, line 2663] nsFrame::HandleRelease() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp, line 848] nsFrame::HandleEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/generic/nsFrame.cpp, line 991] PresShell::HandleEventInternal() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 6410] PresShell::HandleEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 6192] nsViewManager::HandleEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 848] nsViewManager::DispatchEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 2230] HandleEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsView.cpp, line 251] nsCommonWidget::DispatchEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219] nsWindow::OnButtonReleaseEvent() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1565] button_release_event_cb() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 3686] libgtk-x11-2.0.so.0 + 0x12299e (0x4030099e) libgobject-2.0.so.0 + 0x8736 (0x405c1736) libgobject-2.0.so.0 + 0x19dcf (0x405d2dcf) libgobject-2.0.so.0 + 0x18c8c (0x405d1c8c) libgobject-2.0.so.0 + 0x19126 (0x405d2126) libgtk-x11-2.0.so.0 + 0x211d87 (0x403efd87) libgtk-x11-2.0.so.0 + 0x1214b2 (0x402ff4b2) libgtk-x11-2.0.so.0 + 0x120306 (0x402fe306) libgdk-x11-2.0.so.0 + 0x3f825 (0x404fb825) libglib-2.0.so.0 + 0x24582 (0x40615582) libglib-2.0.so.0 + 0x255f8 (0x406165f8) libglib-2.0.so.0 + 0x25930 (0x40616930) libglib-2.0.so.0 + 0x25ed3 (0x40616ed3) libgtk-x11-2.0.so.0 + 0x11fbb3 (0x402fdbb3) nsAppShell::Run() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141] nsAppStartup::Run() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 146] XRE_main() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2213] main() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62] libc.so.6 + 0x15e36 (0x40a21e36)

Presumably the test case as provided is Linux specific, but you should be able to duplicate the crash on other platforms by pressing Ctrl+C.

Fwiw, I just crashed with a recent SeaMonkey trunk (mac) doing Cmd+C... TB8841320Y.

*** Bug 306913 has been marked as a duplicate of this bug. ***

"if (!shortcut.IsEmpty())" was always true in the original code because of the unconditional "shortcut.Append(PRUnichar('\n'))" -- I'm assuming "if (!spec.IsEmpty())" is what was meant.

Checked in to trunk at 2005-09-10 04:39 PDT -> FIXED

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20050910 Firefox/1.6a1 ID:2005091014 Verified fixed.

The testcase in this bug still causes Firefox Beta 2 (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5) Gecko/20051006) to crash.

Harri, could you provide a talkback ID for the crash? http://kb.mozillazine.org/Talkback

The talkback ID for the crash in the testcase is TB10333746.

(In reply to comment #10) > The testcase in this bug still causes Firefox Beta 2 to crash. This hasn't been checked in on the branch so that is expected. It's a rare edge case crash without security implications.

*** Bug 322687 has been marked as a duplicate of this bug. ***

*** Bug 334061 has been marked as a duplicate of this bug. ***

*** Bug 328184 has been marked as a duplicate of this bug. ***

Comment on attachment 194810 [details] [diff] [review] Patch rev. 1 (diff -uw) bug 328184 comment 4 indicates it's more common than I thought.

Comment on attachment 194810 [details] [diff] [review] Patch rev. 1 (diff -uw) approved for 1.8.0 branch, a=dveditz for drivers

Checked in on MOZILLA_1_8_BRANCH and MOZILLA_1_8_0_BRANCH

verified with: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.5) Gecko/20060620 Firefox/1.5.0.5