Comment 12 for bug 918678

The crash is also here on linux amd64, FF 8.0, trying to switch to th-locale!

#0 0x00007ffff579902f in AffixMgr::parse_file (this=0x7fffe6183000, affpath=<value optimized out>, key=<value optimized out>)
    at /usr/src/debug/mozilla/extensions/spellcheck/hunspell/src/affixmgr.cpp:807
#1 0x00007ffff57994b1 in AffixMgr::AffixMgr (this=0x7fffe6183000, affpath=<value optimized out>, ptr=<value optimized out>, md=<value optimized out>,
    key=<value optimized out>) at /usr/src/debug/mozilla/extensions/spellcheck/hunspell/src/affixmgr.cpp:167
#2 0x00007ffff579c6a2 in Hunspell::Hunspell (this=0x7fffd0e25790, affpath=0x7fffd1bbeab8 "/usr/lib64/firefox/dictionaries/th-TH.aff", dpath=
    0x7fffffff9560 "/usr/lib64/firefox/dictionaries/th-TH.dic", key=0x0) at /usr/src/debug/mozilla/extensions/spellcheck/hunspell/src/hunspell.cpp:84
#3 0x00007ffff578cdf7 in mozHunspell::SetDictionary (this=0x7fffd2211020, aDictionary=<value optimized out>)
    at /usr/src/debug/mozilla/extensions/spellcheck/hunspell/src/mozHunspell.cpp:196
#4 0x00007ffff586040a in NS_InvokeByIndex_P (that=<value optimized out>, methodIndex=<value optimized out>, paramCount=1, params=<value optimized out>)
    at /usr/src/debug/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:195
#5 0x00007ffff5512e26 in Invoke (ccx=<value optimized out>, mode=<value optimized out>)
    at /usr/src/debug/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:3119
#6 Call (ccx=<value optimized out>, mode=<value optimized out>) at /usr/src/debug/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2373
#7 XPCWrappedNative::CallMethod (ccx=<value optimized out>, mode=<value optimized out>)
    at /usr/src/debug/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2337
#8 0x00007ffff5516676 in XPC_WN_GetterSetter (cx=0x7fffe19b5400, argc=1, vp=0x7fffe6ffe258)
    at /usr/src/debug/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1641
#9 0x00007ffff5a502ba in CallJSNative (cx=0x7fffe19b5400, argsRef=<value optimized out>, construct=<value optimized out>)
    at /usr/src/debug/mozilla/js/src/jscntxtinlines.h:281
#10 js::Invoke (cx=0x7fffe19b5400, argsRef=<value optimized out>, construct=<value optimized out>) at /usr/src/debug/mozilla/js/src/jsinterp.cpp:657
#11 0x00007ffff5a508f7 in Invoke (cx=0x7fffe19b5400, thisv=..., fval=..., argc=1, argv=<value optimized out>, rval=0x7fffffffa480)
    at /usr/src/debug/mozilla/js/src/jsinterp.h:169
#12 js::ExternalInvoke (cx=0x7fffe19b5400, thisv=..., fval=..., argc=1, argv=<value optimized out>, rval=0x7fffffffa480)
    at /usr/src/debug/mozilla/js/src/jsinterp.cpp:809
#13 0x00007ffff5a50980 in js::ExternalGetOrSet (cx=0x7fffe19b5400, obj=0x7fffd290f768, id=<value optimized out>, fval=..., mode=<value optimized out>, argc=
    1, argv=0x7fffffffa480, rval=0x7fffffffa480) at /usr/src/debug/mozilla/js/src/jsinterp.cpp:849
#14 0x00007ffff5a68108 in set (cx=0x7fffe19b5400, obj=0x7fffd290f768, shape=0x7fffd291abc0, added=false, strict=<value optimized out>, vp=0x7fffffffa480)
    at /usr/src/debug/mozilla/js/src/jsscopeinlines.h:294
#15 js_NativeSet (cx=0x7fffe19b5400, obj=0x7fffd290f768, shape=0x7fffd291abc0, added=false, strict=<value optimized out>, vp=0x7fffffffa480)
    at /usr/src/debug/mozilla/js/src/jsobj.cpp:5232
#16 0x00007ffff5a6a260 in js_SetPropertyHelper (cx=0x7fffe19b5400, obj=0x7fffd290f768, id=<value optimized out>, defineHow=<value optimized out>, vp=
    0x7fffffffa480, strict=0) at /usr/src/debug/mozilla/js/src/jsobj.cpp:5699
#17 0x00007ffff5c60cfd in js::Interpret (cx=0x7fffe19b5400, entryFrame=0x7fffe6ffe090, interpMode=js::JSINTERP_NORMAL)
    at /usr/src/debug/mozilla/js/src/jsinterp.cpp:3823
#18 0x00007ffff5a501d4 in js::Invoke (cx=0x7fffe19b5400, argsRef=<value optimized out>, construct=<value optimized out>)
    at /usr/src/debug/mozilla/js/src/jsinterp.cpp:687
#19 0x00007ffff5a508f7 in Invoke (cx=0x7fffe19b5400, thisv=..., fval=..., argc=1, argv=<value optimized out>, rval=0x7fffffffa7d8)
    at /usr/src/debug/mozilla/js/src/jsinterp.h:169
#20 js::ExternalInvoke (cx=0x7fffe19b5400, thisv=..., fval=..., argc=1, argv=<value optimized out>, rval=0x7fffffffa7d8)
    at /usr/src/debug/mozilla/js/src/jsinterp.cpp:809
#21 0x00007ffff59db961 in JS_CallFunctionValue (cx=0x7fffe19b5400, obj=<value optimized out>, fval=18445618173040569312, argc=<value optimized out>,
    argv=<value optimized out>, rval=<value optimized out>) at /usr/src/debug/mozilla/js/src/jsapi.cpp:5052
#22 0x00007ffff52b4c05 in nsJSContext::CallEventHandler (this=0x7fffe19b1f40, aTarget=<value optimized out>, aScope=<value optimized out>,
    aHandler=<value optimized out>, aargv=0x7fffd0e32a40, arv=0x7fffffffaa00) at /usr/src/debug/mozilla/dom/base/nsJSEnvironment.cpp:1902
#23 0x00007ffff52f1fef in nsJSEventListener::HandleEvent (this=0x7fffdd135a80, aEvent=0x7fffd0e44ba0)
    at /usr/src/debug/mozilla/dom/src/events/nsJSEventListener.cpp:224
#24 0x00007ffff51cfcd5 in nsEventListenerManager::HandleEventSubType (this=0x7fffdd156c00, aListenerStruct=0x7fffdd156c28, aListener=0x7fffdd135a80,
    aDOMEvent=0x7fffd0e44ba0, aCurrentTarget=0x7fffdd156b80, aPhaseFlags=<value optimized out>, aPusher=0x7fffffffadd0)
    at /usr/src/debug/mozilla/content/events/src/nsEventListenerManager.cpp:865
#25 0x00007ffff51cfeae in nsEventListenerManager::HandleEventInternal (this=0x7fffdd156c00, aPresContext=0x7fffdf76b000, aEvent=0x7fffd1b17040, aDOMEvent=
    0x7fffffffadb0, aCurrentTarget=0x7fffdd156b80, aFlags=6, aEventStatus=0x7fffffffadb8, aPusher=0x7fffffffadd0)
    at /usr/src/debug/mozilla/content/events/src/nsEventListenerManager.cpp:919
#26 0x00007ffff51e37ff in nsEventTargetChainItem::HandleEvent (this=0x7fffe3fda9a0, aVisitor=..., aFlags=6, aMayHaveNewListenerManagers=0, aPusher=
   0x7fffffffadd0) at /usr/src/debug/mozilla/content/events/src/nsEventDispatcher.cpp:215
#27 0x00007ffff51e3940 in nsEventTargetChainItem::HandleEventTargetChain (this=0x7fffe3fda4d0, aVisitor=..., aFlags=6, aCallback=0x0,
    aMayHaveNewListenerManagers=0, aPusher=0x7fffffffadd0) at /usr/src/debug/mozilla/content/events/src/nsEventDispatcher.cpp:344
#28 0x00007ffff51e3fed in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, aPresContext=0x7fffe3fda4d0, aEvent=0x7fffd1b17040, aDOMEvent=
    0x7fffd0e44ba0, aEventStatus=0x7fffffffaffc, aCallback=0x0, aTargets=0x0) at /usr/src/debug/mozilla/content/events/src/nsEventDispatcher.cpp:672
#29 0x00007ffff51e4216 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x7fffdd156b80, aEvent=<value optimized out>, aDOMEvent=0x7fffd0e44ba0, aPresContext=
    0x7fffdf76b000, aEventStatus=0x7fffffffaffc) at /usr/src/debug/mozilla/content/events/src/nsEventDispatcher.cpp:735
#30 0x00007ffff5008bee in PresShell::HandleDOMEventWithTarget (this=0x7fffdf75a800, aTargetContent=0x7fffdd156b80, aEvent=0x7fffd0e44ba0,
    aStatus=<value optimized out>) at /usr/src/debug/mozilla/layout/base/nsPresShell.cpp:7163
#31 0x00007ffff513c238 in nsContentUtils::DispatchXULCommand (aTarget=0x7fffdd156b80, aTrusted=<value optimized out>, aSourceEvent=0x0, aShell=
    0x7fffdf75a800, aCtrl=0, aAlt=0, aShift=0, aMeta=0) at /usr/src/debug/mozilla/content/base/src/nsContentUtils.cpp:5174
#32 0x00007ffff510e383 in nsXULMenuCommandEvent::Run (this=0x7fffd0e2b740) at /usr/src/debug/mozilla/layout/xul/base/src/nsXULPopupManager.cpp:2373
#33 0x00007ffff585359b in nsThread::ProcessNextEvent (this=0x7ffff6d1a870, mayWait=0, result=0x7fffffffb18c)
    at /usr/src/debug/mozilla/xpcom/threads/nsThread.cpp:631
#34 0x00007ffff5825ee3 in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=<value optimized out>)
    at /usr/src/debug/obj/xpcom/build/nsThreadUtils.cpp:245
#35 0x00007ffff57ca5da in mozilla::ipc::MessagePump::Run (this=0x7ffff6dc5240, aDelegate=0x7ffff6dd60b0)
    at /usr/src/debug/mozilla/ipc/glue/MessagePump.cpp:110
#36 0x00007ffff58713d9 in RunHandler (this=0x7ffff6dd60b0) at /usr/src/debug/mozilla/ipc/chromium/src/base/message_loop.cc:205
#37 MessageLoop::Run (this=0x7ffff6dd60b0) at /usr/src/debug/mozilla/ipc/chromium/src/base/message_loop.cc:179
#38 0x00007ffff5728c1d in nsBaseAppShell::Run (this=0x7ffff6d2e740) at /usr/src/debug/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:189
#39 0x00007ffff55f873c in nsAppStartup::Run (this=0x7fffe8a710c0) at /usr/src/debug/mozilla/toolkit/components/startup/nsAppStartup.cpp:224
#40 0x00007ffff4e90059 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>)
    at /usr/src/debug/mozilla/toolkit/xre/nsAppRunner.cpp:3544
#41 0x000000000040208d in do_main (argc=<value optimized out>, argv=<value optimized out>) at /usr/src/debug/mozilla/browser/app/nsBrowserApp.cpp:198
#42 main (argc=<value optimized out>, argv=<value optimized out>) at /usr/src/debug/mozilla/browser/app/nsBrowserApp.cpp:281

(gdb) l
802 strcpy(expw, wordchars);
803 free(wordchars);
804 } else *expw = '\0';
805
806 for (int i = 0; i <= 255; i++) {
807 if ( (csconv[i].cupper != csconv[i].clower) &&
808 (! strchr(expw, (char) i))) {
809 *(expw + strlen(expw) + 1) = '\0';
810 *(expw + strlen(expw)) = (char) i;
811 }
(gdb) p wordchars
$1 = 0x0