Pressing left-cursor key in a wiki page in edit mode crashes firefox

[Matthias Klose]

To reproduce:

http://udu.wiki.ubuntu.com/UbuntuDownUnder/BreezyGoals
login, go into edit mode, go to the line with OpenOffice2, press the left cursor key

[Matthias Klose (doko)]

(gdb) cont
Continuing.
[New Thread -1271596112 (LWP 31199)]
[New Thread -1292555344 (LWP 31200)]
[New Thread -1284162640 (LWP 31201)]
[Thread -1271596112 (LWP 31199) exited]
[Thread -1292555344 (LWP 31200) exited]
[Thread -1284162640 (LWP 31201) exited]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1219651360 (LWP 31031)]
0xb7649928 in free () from /lib/tls/i686/cmov/libc.so.6
(gdb) bt
#0 0xb7649928 in free () from /lib/tls/i686/cmov/libc.so.6
#1 0xb77d3131 in operator delete () from /usr/lib/libstdc++.so.6
#2 0xb77d318c in operator delete[] () from /usr/lib/libstdc++.so.6
#3 0xb6f21e6a in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#4 0xb6f24a08 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#5 0xb7058463 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#6 0xb7058945 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#7 0xb6f450ab in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#8 0xb4c88f87 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libeditor.so
#9 0xb73b7d6a in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libembedcomponents.so
#10 0xb73b4b0a in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libembedcomponents.so
#11 0xb6f471dc in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#12 0xb73dc2de in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libwidget_gtk2.so
#13 0xb7bf6789 in _gtk_marshal_VOID__ENUM_INT_BOOLEAN ()
   from /usr/lib/libgtk-x11-2.0.so.0
#14 0xb79baca5 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#15 0xb79caae6 in g_signal_stop_emission () from /usr/lib/libgobject-2.0.so.0
#16 0xb79cba69 in g_signal_emitv () from /usr/lib/libgobject-2.0.so.0
#17 0xb7b36405 in gtk_bin_get_child () from /usr/lib/libgtk-x11-2.0.so.0
#18 0xb7b373d9 in gtk_binding_set_by_class () from /usr/lib/libgtk-x11-2.0.so.0
#19 0xb7b37649 in gtk_binding_set_by_class () from /usr/lib/libgtk-x11-2.0.so.0
#20 0xb7b3772b in gtk_bindings_activate () from /usr/lib/libgtk-x11-2.0.so.0
#21 0xb73dc680 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libwidget_gtk2.so
#22 0xb6f47f12 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#23 0xb7082b40 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#24 0xb70362a7 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#25 0xb70f7da7 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#26 0xb6f150ec in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#27 0xb6f19f8a in NSGetModule ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#28 0xb71b18fc in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#29 0xb71b1f49 in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#30 0xb71a8c3e in NSGetModule ()
   from /usr/lib/mozilla-firefox/components/libgklayout.so
#31 0xb73d2a78 in NSGetModule ()
   from /usr/lib/...

[Rouslan Solomakhin (solomarv)]

Thanks for taking the time to report this bug. Unfortunately, it is impossible
to fix this without some additional information. Please, specify your version of
Ubuntu and Firefox.

[Matthias Klose (doko)]

current breezy, 1.0.6 on i386

[Ian Jackson (ijackson)]

I can't reproduce this bug with the firefox in current breezy. Also, the
instructions in the report correspond to no-longer-existing data on the UDU wiki.

Please reopen this report, or file another, if the problem recurs.

Thanks.

[Ian Jackson (ijackson)]

This seems suspiciously similar to 10257, which I have just reproduced.

[Ian Jackson (ijackson)]

This bug has been marked as a duplicate of bug 16554.