623193 - Fennec crash [@ nsEditor::InsertTextIntoTextNodeImpl ]

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Scoobidiver (away)]

It is #42 top crasher in Fennec 4.0b3 for the last week.

Signature	nsEditor::InsertTextIntoTextNodeImpl
UUID	a77caf8a-6283-43b7-a4fa-bd49c2110103
Time 	2011-01-03 18:33:27.897092
Uptime	0
Install Age	291634 seconds (3.4 days) since version was first installed.
Product	Fennec
Version	4.0b3
Build ID	20101221205132
Branch	1.9
OS	Linux
OS Version	0.0.0 Linux 2.6.32.17-gee557fd #15 PREEMPT Fri Nov 26 23:12:08 CST 2010 armv7l
CPU	arm
Crash Reason	SIGSEGV
Crash Address	0x0

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsEditor::InsertTextIntoTextNodeImpl 	editor/libeditor/base/nsEditor.cpp:2523
1 	libxul.so 	nsEditor::InsertTextImpl 	editor/libeditor/base/nsEditor.cpp:2394
2 	libxul.so 	nsTextEditRules::WillInsertText 	editor/libeditor/text/nsTextEditRules.cpp:749
3 	libxul.so 	nsTextEditRules::WillDoAction 	editor/libeditor/text/nsTextEditRules.cpp:298
4 	libxul.so 	nsPlaintextEditor::InsertText 	editor/libeditor/text/nsPlaintextEditor.cpp:830
5 	libxul.so 	nsPlaintextEditor::UpdateIMEComposition 	editor/libeditor/text/nsPlaintextEditor.cpp:990
6 	libxul.so 	nsEditorEventListener::HandleText 	editor/libeditor/base/nsEditorEventListener.cpp:511
7 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:176
8 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:146
9 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:343
10 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:630
11 	libxul.so 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6939
12 	libxul.so 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6686
13 	libxul.so 	nsViewManager::HandleEvent 	view/src/nsViewManager.cpp:1095
14 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1070
15 	libxul.so 	HandleEvent 	nsCOMPtr.h:492
16 	libxul.so 	mozilla::widget::PuppetWidget::DispatchEvent 	widget/src/xpwidgets/PuppetWidget.cpp:306
17 	libxul.so 	mozilla::widget::PuppetWidget::DispatchEvent 	widget/src/xpwidgets/PuppetWidget.cpp:315
18 	libxul.so 	mozilla::dom::TabChild::DispatchWidgetEvent 	dom/ipc/TabChild.cpp:617
19 	libxul.so 	mozilla::dom::TabChild::RecvTextEvent 	nsGUIEventIPC.h:204
20 	libxul.so 	mozilla::dom::PBrowserChild::OnMessageReceived 	PBrowserChild.cpp:1138
21 	libxul.so 	mozilla::dom::PContentChild::OnMessageReceived 	PContentChild.cpp:949
22 	libxul.so 	mozilla::ipc::AsyncChannel::OnDispatchMessage 	ipc/glue/AsyncChannel.cpp:262
23 	libxul.so 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:440
24 	libxul.so 	RunnableMethod<mozilla::ipc::RPCChannel, bool , Tuple0>::Run 	ipc/chromium/src/base/task.h:308
25 	libxul.so 	mozilla::ipc::RPCChannel::DequeueTask::Run 	RPCChannel.h:475
26 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:344
27 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:354
28 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:451
29 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:115
30 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:230
31 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:220
32 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:512
33 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:198
34 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:631
35 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:222
36 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:220
37 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:512
38 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:510
39 	libmozutils.so 	ChildProcessInit 	other-licenses/android/APKOpen.cpp:691
40 	plugin-container 	main 	ipc/app/MozillaRuntimeMainAndroid.cpp:69
41 	libc.so 	libc.so@0xd432 	

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsEditor%3A%3AInsertTextIntoTextNodeImpl

Comment 1

[Makoto Kato [:m_kato]]

mIMETextNode is null.

Since this is only on Android, I think that this may depend on Android IME implementation.

Comment 2

[(no longer active)]

Attachment: Patch (v1)

Comment 3

[(no longer active)]

roc, can you approve this as well, please?

Comment 4

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/016e12c47d29