I opened sample 0 and sample 3 in purify. Here is the line of code: ip[mContentLength] = ip[mContentLength-1]+1; //must set up last one for selection beyond edge Here is (some of) the purify output: [W] UMR: Uninitialized memory read in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) {23 occurrences} Reading 4 bytes from 0x0012e0f8 (4 bytes at 0x0012e0f8 uninitialized) Address 0x0012e0f8 points into a thread's stack Address 0x0012e0f8 is the local variable 'indicies' in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) Thread ID: 0xa1 Error location TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) [nsTextFrame.cpp:814] TextFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTextFrame.cpp:544] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] nsBlockFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4326] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] nsBlockFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4326] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] [W] UMR: Uninitialized memory read in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) {9 occurrences} Reading 4 bytes from 0x0012e1c8 (4 bytes at 0x0012e1c8 uninitialized) Address 0x0012e1c8 points into a thread's stack Address 0x0012e1c8 is 4 bytes past the start of local variable 'indicies' in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) Thread ID: 0xa1 Error location TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) [nsTextFrame.cpp:814] TextFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTextFrame.cpp:544] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] nsBlockFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4326] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] nsBlockFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4326] nsAreaFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsAreaFrame.cpp:223] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] [W] UMR: Uninitialized memory read in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) {12 occurrences} Reading 4 bytes from 0x0012e040 (4 bytes at 0x0012e040 uninitialized) Address 0x0012e040 points into a thread's stack Address 0x0012e040 is 12 bytes past the start of local variable 'indicies' in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) Thread ID: 0xa1 Error location TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) [nsTextFrame.cpp:814] TextFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTextFrame.cpp:544] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] nsHTMLContainerFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsHTMLContainerFrame.cpp:78] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] nsBlockFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4326] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] [W] UMR: Uninitialized memory read in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) {7 occurrences} Reading 4 bytes from 0x0012df7c (4 bytes at 0x0012df7c uninitialized) Address 0x0012df7c points into a thread's stack Address 0x0012df7c is 12 bytes past the start of local variable 'indicies' in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) Thread ID: 0xa1 Error location TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) [nsTextFrame.cpp:814] TextFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTextFrame.cpp:544] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] nsHTMLContainerFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsHTMLContainerFrame.cpp:78] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] nsHTMLContainerFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsHTMLContainerFrame.cpp:78] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] [W] UMR: Uninitialized memory read in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) {12 occurrences} Reading 4 bytes from 0x0012dee4 (4 bytes at 0x0012dee4 uninitialized) Address 0x0012dee4 points into a thread's stack Address 0x0012dee4 is 56 bytes past the start of local variable 'indicies' in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) Thread ID: 0xa1 Error location TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) [nsTextFrame.cpp:814] TextFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTextFrame.cpp:544] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] nsHTMLContainerFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsHTMLContainerFrame.cpp:78] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] nsHTMLContainerFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsHTMLContainerFrame.cpp:78] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] [W] UMR: Uninitialized memory read in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) {9 occurrences} Reading 4 bytes from 0x0012d810 (4 bytes at 0x0012d810 uninitialized) Address 0x0012d810 points into a thread's stack Address 0x0012d810 is 24 bytes past the start of local variable 'indicies' in TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) Thread ID: 0xa1 Error location TextFrame::PaintUnicodeText(nsIPresContext&,nsIRenderingContext&,nsIStyleContext *,TextStyle::TextFrame&,int,int) [nsTextFrame.cpp:814] TextFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTextFrame.cpp:544] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsBlockFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4374] nsBlockFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsBlockFrame.cpp:4326] nsAreaFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsAreaFrame.cpp:223] nsContainerFrame::PaintChild(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsIFrame *,nsFramePaintLayer) [nsContainerFrame.cpp:276] nsContainerFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsContainerFrame.cpp:216] nsTableCellFrame::Paint(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTableCellFrame.cpp:210] nsTableRowFrame::PaintChildren(nsIPresContext&,nsIRenderingContext&,nsRect const&,nsFramePaintLayer) [nsTableRowFrame.cpp:347]

*** This bug has been marked as a duplicate of 3321 ***

Same bug as #3321. Verifying as duplicate.