I see sometimes crashes in CountCharInReadable() when called with a nsDependentSubstring. This patch solves my problem: Index: nsReadableUtils.cpp =================================================================== RCS file: /cvsroot/mozilla/string/src/nsReadableUtils.cpp,v retrieving revision 1.22 diff -u -r1.22 nsReadableUtils.cpp --- nsReadableUtils.cpp 2001/06/19 22:38:34 1.22 +++ nsReadableUtils.cpp 2001/07/29 03:09:33 @@ -832,6 +832,7 @@ aStr.BeginReading(begin); aStr.EndReading(end); + end.normalize_forward(); while (begin != end) { if (*begin == aChar) { @@ -853,6 +854,7 @@ aStr.BeginReading(begin); aStr.EndReading(end); + end.normalize_forward(); while (begin != end) { if (*begin == aChar) { I do not know if the real problem is somewhere else or if there should be a begin.normalize_forward() too, but I haven't seen a crash since I applied this patch.

I'm not sure if I should use nsDependentSubstring at all. I encountered similar problems everywhere I use it and the comments say "NOT FOR USE BY HUMANS (mostly)". So I don't use it any longer. Maybe this bug is invalid.

giving up ancient string bugs to the new string owner. jag, you'll want to sort through these and see which ones still apply and go with or against the direction in which you intend strings evolve

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and <http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss bugs are of critical or possibly higher severity. Only changing open bugs to minimize unnecessary spam. Keywords to trigger this would be crash, topcrash, topcrash+, zt4newcrash, dataloss.

Benjamin, can you determine whether this bug is valid?

This bug was filed prior to the string rewrite of mozilla 1.6/1.7, so it's very unlikely to be useful.