43366 - When trying backspace japanese characters in mail in crashes

Status: VERIFIED FIXED

(MailNews Core :: Internationalization, defect, P3)

Description

[Alek Jeziorek]

-Open up Netscape mail for build 2000-06-21-08-M17 comm.
-click on the new message button to write a new message 
-send it to yourself
-in the subject or body press shift + space bar and type in: kangi
- then press space bar again then hit back space it crashes

heres the call stack


 Call Stack:    (Signature = nsTextFrame::ComputeTotalWordWidth() 052f5978) 
     
   nsTextFrame::ComputeTotalWordWidth() 
                                             
     
   nsTextFrame::MeasureText() 
                                             
     
   nsTextFrame::Reflow() 
                                             
     
   nsLineLayout::ReflowFrame() 
                                             
     
   nsBlockFrame::ReflowInlineFrame() 
                                             
     
   nsBlockFrame::DoReflowInlineFrames() 
                                             
     
   nsBlockFrame::DoReflowInlineFramesAuto() 
                                             
     
   nsBlockFrame::ReflowInlineFrames() 
                                             
     
   nsBlockFrame::ReflowLine() 
                                             
     
   nsBlockFrame::ReflowDirtyLines() 
                                             
     
   nsBlockFrame::Reflow() 
                                             
     
   nsBoxToBlockAdaptor::Reflow() 
                                             
     
   nsBoxToBlockAdaptor::Layout() 
                                             
     
   nsScrollPortFrame::Layout() 
                                             
     
   nsContainerBox::LayoutChildAt() 
                                             
     
   nsGfxScrollFrameInner::LayoutBox() 
                                             
     
   nsGfxScrollFrameInner::Layout() 
                                             
     
   nsGfxScrollFrame::Layout() 
                                             
     
   nsStackLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsSprocketLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsStackLayout::Layout() 
                                             
     
   nsContainerBox::Layout() 
                                             
     
   nsBoxFrame::Layout() 
                                             
     
   nsBoxFrame::Reflow() 
                                             
     
   nsRootBoxFrame::Reflow() 
                                             
     
   nsContainerFrame::ReflowChild() 
                                             
     
   ViewportFrame::Reflow() 
                                             
     
   nsHTMLReflowCommand::Dispatch() 
                                             
     
   PresShell::ProcessReflowCommands() 
                                             
     
   PresShell::FlushPendingNotifications() 
                                             
     
   PresShell::EndReflowBatching() 
                                             
     
   nsEditor::EndUpdateViewBatch() 
                                             
     
   nsEditor::EndPlaceHolderTransaction() 
                                             
     
   nsHTMLEditor::DeleteSelection() 
                                             
     
   nsHTMLEditorLog::DeleteSelection() 
                                             
     
   nsTextEditorKeyListener::KeyPress() 
                                             
     
   nsEventListenerManager::HandleEvent() 
                                             
     
   nsGenericElement::HandleDOMEvent() 
                                             
     
   nsHTMLInputElement::HandleDOMEvent() 
                                             
     
   PresShell::HandleEventInternal() 
                                             
     
   PresShell::HandleEvent() 
                                             
     
   nsView::HandleEvent() 
                                             
     
   nsViewManager2::DispatchEvent() 
                                             
     
   HandleEvent() 
                                             
     
   nsWidget::DispatchEvent() 
                                             
     
   nsWidget::DispatchWindowEvent() 
                                             
     
   nsWidget::OnInput() 
                                             
     
   handle_key_press_event() 
                                             
     
   dispatch_superwin_event() 
                                             
     
   handle_gdk_event() 
                                             
     
   libgdk-1.2.so.0 + 0x1700b (0x4071700b) 
                                             
     
   libglib-1.2.so.0 + 0xfbe6 (0x40741be6) 
                                             
     
   libglib-1.2.so.0 + 0x101a1 (0x407421a1) 
                                             
     
   libglib-1.2.so.0 + 0x10341 (0x40742341) 
                                             
     
   libgtk-1.2.so.0 + 0x8c209 (0x4066c209) 
                                             
     
   nsAppShell::Run() 
                                             
     
   nsAppShellService::Run() 
                                             
     
   main1() 
                                             
     
   main() 
                                             
     
   libc.so.6 + 0x181eb (0x402431eb

Comment 1

[ji]

This crash happens in Red Hat 6.0 En + Japanese packages environment.
It doesn't happen on Japanese Red Hat 6.2 system.

Comment 2

[ji]

Added teruko and myself to Cc.

Comment 3

[nhottanscp]

Is this a regression (from when)?
HTML or Plain text mail? If HTML, only mail or also happen for HTML composer?
IME, editor issue, reassign to shanjian, cc to beppe.

Comment 4

[lchiang]

momoi - needed for dogfood?  If so, should nominate.

Comment 5

[Katsuhiko Momoi]

This seems to be reproducible on Windows build on 6/21/2000.
Not consistently so ffar but enough to make me think that this is
a serious problem.
I am able to reproduce this problem consistenyl on theLinux build
from 6/21 running under RH6.2/Japanese.

Comment 6

[Katsuhiko Momoi]

By the way, I have both Windows and Linux Talkback reports
filed and they are pretty much indential to the one
cited above.

Comment 7

[leger]

Adding crash keyword

Comment 8

[leger]

Putting on [dogfood+] radar.

Comment 9

[nhottanscp]

Momoi san, could you attatch your Talkback reprots to this bug?

Comment 10

[Frank Tang]

I remember I see this in other bug. I do not mark it as dogfood+ because it 
require backspace key. It is a dup of 42316. It is funny that PDT mark that one 
nsbeta2- and mark this one dogfood+

Comment 11

[Erik van der Poel]

Shanjian, do you have a Linux environment for debugging? If not, please assign
this bug to me. Thanks.

Comment 12

[ji]

The crash not only happens in mail composer, it also happens in mail account
setup wizard, like the textfield for user's name on the Identity window.

Comment 13

[Katsuhiko Momoi]

OK. This is the dump I got for a WinNT4 crash with the 6/21/ build.
As I said above, this is nearly identical to the one above.
Crahses on Windows don't occur every time and I have not been 
able to isolate the precise conditions yet. On the Linux build I 
used, it was occurring every time the same procedure as described
the original poster was used.

-------------------------------
Trigger Type:  Program Crash 
Trigger Reason:  Access violation 
Thread ID:   
Call Stack:    (Signature = nsTextFrame::ComputeTotalWordWidth f4e2e932) 
nsTextFrame::ComputeTotalWordWidth 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsTextFrame.cpp, line 4392]
nsTextFrame::MeasureText  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsTextFrame.cpp, line 3951]
nsTextFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsTextFrame.cpp, line 4180]
nsLineLayout::ReflowFrame  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 982]
nsBlockFrame::ReflowInlineFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4421]
nsBlockFrame::DoReflowInlineFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4305]
nsBlockFrame::DoReflowInlineFramesAuto 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4241]
nsBlockFrame::ReflowInlineFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4185]
nsBlockFrame::ReflowLine  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3311]
nsBlockFrame::ReflowDirtyLines 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3000]
nsBlockFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1766]
nsBoxToBlockAdaptor::Reflow 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 
799]
nsBoxToBlockAdaptor::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 
469]
nsScrollPortFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollPortFrame.cpp, line 
361]
nsContainerBox::LayoutChildAt  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 617]
nsGfxScrollFrameInner::LayoutBox 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1017]
nsGfxScrollFrameInner::Layout 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1104]
nsGfxScrollFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1030]
nsStackLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsStackLayout.cpp, line 245]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsSprocketLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 408]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsStackLayout::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsStackLayout.cpp, line 245]
nsContainerBox::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 558]
nsBoxFrame::Layout 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 800]
nsBoxFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 651]
nsRootBoxFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsRootBoxFrame.cpp, line 211]
nsContainerFrame::ReflowChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
716]
ViewportFrame::Reflow 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 546]
nsHTMLReflowCommand::Dispatch 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 
145]
PresShell::ProcessReflowCommands  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3921]
PresShell::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3062]
PresShell::EndReflowBatching 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3088]
nsEditor::EndUpdateViewBatch 
[d:\builds\seamonkey\mozilla\editor\base\nsEditor.cpp, line 5058]
nsEditor::EndPlaceHolderTransaction 
[d:\builds\seamonkey\mozilla\editor\base\nsEditor.cpp, line 1235]
-------------------------------

Comment 14

[Shanjian Li]

I could not reproduce the problem on Windows. On Linux, yes, but 
it is too slow for me to debug the program. (In fact, before the 
program is started, my system complained about running out of 
memory.) Reassign the bug to erik due to its importance.

Comment 15

[Frank Tang]

erik- can you put ETA now ?

Comment 16

[Erik van der Poel]

I cannot get it to crash if I use the steps described at the beginning of this
bug report. It crashes if I use the steps described in bug 42316. I tried to
change the way the widget/src/gtk code calls the XP code, in order to avoid
creating the extra text node that is involved in the crash, but none of the
changes I tried worked. This means that I am no longer sure that I can fix this
by a certain date.

Joe, I'm wondering if it would be easier to change the editor code so that the
extra text node is not created after the original text node is collapsed down to
length zero. See bug 42316 for the exact steps (Shift-Space a i u Ret a i u Ret
Backspace).

Comment 17

[Joe Francis]

i dont think i can try to keep the empty text node around and promise to use it 
for more ime characters.  The reason I cant promise that is that more characters 
may not be coming.  Then if I leave the empty node around, we will still might 
cause the layout crash.  Plus the editor has a policy of trying to not leave 
empty nodes around, and intentionally violating that policy will complicate 
editor logic, hurting maintainability and reliability.  

I think a better approach is to get rid of the text node as soon as it becomes 
empty, and if we do continue to get ime events in the same location, just create 
a new text node.  

This approach will require generalizing some editor ime code to be able to deal 
with the text node possibly not remaining the same over the course of ime entry 
and commit.  

Comment 18

[Frank Tang]

*** Bug 42316 has been marked as a duplicate of this bug. ***

Comment 19

[Erik van der Poel]

Thanks, Joe, for helping us with this one.

Comment 20

[Joe Francis]

fixed; r=kin

Comment 21

[Masaki Katakai]

I've verified the fix on local build for Solaris. Thanks!

Comment 22

[Alek Jeziorek]

no longer see this on the Linux commercial build as of 2000-07-13-08-M17; 
marking verified fixed