Comment 11 for bug 372103

Revision history for this message
In , Stransky (stransky) wrote :

Downstream bug https://bugzilla.redhat.com/show_bug.cgi?id=501685

There's a crash at nsClipboard::HasDataMatchingFlavors()

Bactrace:

Thread 1 (Thread 20486):
#0 0x00000033b140ed5b in raise (sig=<value optimized out>) at
../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#1 0x0000003f72873244 in nsProfileLock::FatalSignalHandler (signo=11) at
nsProfileLock.cpp:212
#2 <signal handler called>
#3 strcmp () at ../sysdeps/x86_64/strcmp.S:29
#4 0x0000003f7306c82d in nsClipboard::HasDataMatchingFlavors (this=<value
optimized out>,
    aFlavorList=<value optimized out>, aLength=1, aWhichClipboard=<value
optimized out>, _retval=0x7fff29c80a1c)
    at nsClipboard.cpp:448
#5 0x0000003f72e3d243 in nsHTMLEditor::HavePrivateHTMLFlavor (this=<value
optimized out>, aClipboard=0x0)
    at nsHTMLDataTransfer.cpp:1844
#6 0x0000003f72e3f5ff in nsHTMLEditor::Paste (this=0x7f430705f800,
aSelectionType=0) at nsHTMLDataTransfer.cpp:1869
#7 0x0000003f72d23ee6 in nsTextEditorMouseListener::MouseClick
(this=0x7f430704fd80, aMouseEvent=<value optimized out>)
    at nsEditorEventListeners.cpp:362
#8 0x0000003f72e7fb45 in nsHTMLEditorMouseListener::MouseClick
(this=0x7f430704fd80, aMouseEvent=0x7f43071b9640)
    at nsHTMLEditorMouseListener.cpp:307
[...]

It's here at sClipboard.cpp:448

  for (PRInt32 j = 0; j < n_targets; j++) {
     gchar *atom_name = gdk_atom_name(targets[j]);
>> if (!strcmp(atom_name, aFlavorList[i]))
        *_retval = PR_TRUE;

Looks like gdk_atom_name(targets[j]) returns NULL and we don't catch it.