1121313 - [e10s] Assertion failure: aCompositionEvent->message == (2200), at IMEStateManager.cpp:947

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Makoto Kato [:m_kato]]

- Env
Linux (Debean sid) with ibus + mozc

- Step
1. Browse http://www.google.com
2. Input "あああ" on editbox of content
3. Focus awesome bar

- Result
Content process hits the following assertion.

Assertion failure: aCompositionEvent->message == (2200), at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/dom/events/IMEStateManager.cpp:947
#01: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x26fbdec]
#02: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x241e0be]
#03: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x241c2ec]
#04: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x242a7d2]
#05: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x2266312]
#06: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x226e9a1]
#07: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x226ea22]
#08: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xd4e517]
#09: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xcb6194]
#10: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xcb56f7]
#11: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xcb253b]
#12: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xc951ac]
#13: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xc95566]
#14: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xc956b4]
#15: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xcb8467]
#16: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x992523]
#17: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x9b7c03]
#18: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xcb7f5f]
#19: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xc94ffe]
#20: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x242f00f]
#21: XRE_RunAppShell[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x2cd1ca7]
#22: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xcb85b6]
#23: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0xc94ffe]
#24: XRE_InitChildProcess[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/libxul.so +0x2cd18af]
#25: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/plugin-container +0x547b]
#26: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x21b45]
#27: ???[/home/makoto/Development/hg.mozilla.org/objdir-mc/dist/bin/plugin-container +0x50a7]
#28: ??? (???:???)

Comment 1

[Makoto Kato [:m_kato]]

stack

(gdb) bt
#0  0x00007fe235bf453d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007fe235bf43d4 in __sleep (seconds=0)
    at ../sysdeps/unix/sysv/linux/sleep.c:137
#2  0x00007fe2397e9a90 in ah_crap_handler (signum=11)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/toolkit/xre/nsSigHandlers.cpp:101
#3  0x00007fe2397e9b47 in child_ah_crap_handler (signum=11)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/toolkit/xre/nsSigHandlers.cpp:113
#4  <signal handler called>
#5  mozilla::IMEStateManager::DispatchCompositionEvent (
    aEventTargetNode=<optimized out>, aPresContext=0x7fe21f123000, 
    aCompositionEvent=<optimized out>, aStatus=0x7ffffb415a14, 
    aCallBack=0x7ffffb4155d8, aIsSynthesized=false)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/dom/events/IMEStateManager.cpp:947
#6  0x00007fe2392110a1 in PresShell::HandleEventInternal (this=0x7fe21e3f3800, 
    aEvent=0x7ffffb415b48, aStatus=0x7ffffb415a14)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/layout/base/nsPresShell.cpp:8250
#7  0x00007fe23920fdec in PresShell::HandleEvent (this=0x7fe21e3f3800, 
    aFrame=<optimized out>, aEvent=0x7ffffb415b48, aDontRetargetEvents=false, 
    aEventStatus=0x7ffffb415a14)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/layout/base/nsPresShell.cpp:7848
#8  0x00007fe238f320be in nsViewManager::DispatchEvent (
    this=0x7fe235ee1060 <_IO_2_1_stderr_>, aEvent=0x7ffffb415b48, 
    aView=<optimized out>, aStatus=0x7ffffb415a14)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/view/nsViewManager.cpp:774
#9  0x00007fe238f302ec in nsView::HandleEvent (this=<optimized out>, 
    aEvent=0x7ffffb415b48, aUseAttachedEvents=<optimized out>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/view/nsView.cpp:1097
#10 0x00007fe238f3e7d2 in mozilla::widget::PuppetWidget::DispatchEvent (
    this=0x7fe22a4ada10, event=0x7ffffb415b48, 
    aStatus=@0x7ffffb415b1c: nsEventStatus_eIgnore)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/widget/PuppetWidget.cpp:332
#11 0x00007fe238d7a312 in mozilla::dom::TabChildBase::DispatchWidgetEvent (
    this=0x7fe235ee1060 <_IO_2_1_stderr_>, event=...)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/dom/ipc/TabChild.cpp:641
#12 0x00007fe238d829a1 in mozilla::dom::TabChild::RecvCompositionEvent (
    this=<optimized out>, event=...)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/dom/ipc/TabChild.cpp:2825
#13 0x00007fe238d82a22 in non-virtual thunk to mozilla::dom::TabChild::RecvCompositionEvent(mozilla::WidgetCompositionEvent const&) ()
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/dom/ipc/TabChild.cpp:2827
#14 0x00007fe237862517 in mozilla::dom::PBrowserChild::OnMessageReceived (
    this=0x7fe228085970, __msg=...) at ./PBrowserChild.cpp:2783
#15 0x00007fe2377ca194 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (
    this=0x7fe22bc1c890, aMsg=...)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/glue/MessageChannel.cpp:1218
#16 0x00007fe2377c96f7 in mozilla::ipc::MessageChannel::DispatchMessage (
    this=0x7fe22bc1c890, aMsg=...)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/glue/MessageChannel.cpp:1145
#17 0x00007fe2377c653b in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (
    this=0x7fe22bc1c890)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/glue/MessageChannel.cpp:1129
#18 0x00007fe2377a91ac in MessageLoop::RunTask (this=0x7ffffb416930, 
    task=0x7fe21d551c80)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:361
#19 0x00007fe2377a9566 in MessageLoop::DeferOrRunPendingTask (
    this=0x7fe235ee1060 <_IO_2_1_stderr_>, pending_task=...)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:369
#20 0x00007fe2377a96b4 in MessageLoop::DoWork (this=0x7ffffb416930)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:447
#21 0x00007fe2377cc467 in mozilla::ipc::DoWorkRunnable::Run (
    this=<optimized out>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/glue/MessagePump.cpp:233
#22 0x00007fe2374a6523 in nsThread::ProcessNextEvent (this=0x7fe22bcbd220, 
    aMayWait=<optimized out>, aResult=0x7ffffb4167b7)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/xpcom/threads/nsThread.cpp:855
#23 0x00007fe2374cbc03 in NS_ProcessNextEvent (aThread=<optimized out>, 
    aMayWait=false)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/xpcom/glue/nsThreadUtils.cpp:265
#24 0x00007fe2377cbf5f in mozilla::ipc::MessagePump::Run (this=0x7fe22bc51dd0, 
    aDelegate=0x7ffffb416930)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/glue/MessagePump.cpp:99
#25 0x00007fe2377a8ffe in RunHandler (this=0x7fe235ee1060 <_IO_2_1_stderr_>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:226
#26 MessageLoop::Run (this=0x7fe235ee1060 <_IO_2_1_stderr_>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:200
#27 0x00007fe238f4300f in nsBaseAppShell::Run (this=0x7fe2280026a0)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/widget/nsBaseAppShell.cpp:164
#28 0x00007fe2397e5ca7 in XRE_RunAppShell ()
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/toolkit/xre/nsEmbedFunctions.cpp:738
#29 0x00007fe2377cc5b6 in mozilla::ipc::MessagePumpForChildProcess::Run (
    this=0x7fe22bc51dd0, aDelegate=0x7ffffb416930)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/glue/MessagePump.cpp:272
#30 0x00007fe2377a8ffe in RunHandler (this=0x7fe235ee1060 <_IO_2_1_stderr_>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:226
#31 MessageLoop::Run (this=0x7fe235ee1060 <_IO_2_1_stderr_>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/chromium/src/base/message_loop.cc:200
#32 0x00007fe2397e58af in XRE_InitChildProcess (aArgc=<optimized out>, 
    aArgv=<optimized out>, aGMPLoader=<optimized out>)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/toolkit/xre/nsEmbedFunctions.cpp:575
#33 0x000000000040547b in content_process_main (argc=5, argv=0x7ffffb417e98)
    at /home/makoto/Development/hg.mozilla.org/mozilla-inbound/ipc/app/../contentproc/plugin-container.cpp:211
#34 0x00007fe235b5eb45 in __libc_start_main (
    main=0x4054f8 <main(int, char**)>, argc=6, argv=0x7ffffb417e98, 
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, 
    stack_end=0x7ffffb417e88) at libc-start.c:287
#35 0x00000000004050a7 in _start ()

Comment 2

[Makoto Kato [:m_kato]]

message is 2205 = NS_COMPOSITION_COMMIT.

Comment 3

[Jim Mathies [:jimm]]

Should this block roll out?

Comment 4

[Makoto Kato [:m_kato]]

(In reply to Jim Mathies [:jimm] from comment #3)
> Should this block roll out?

This should be blocker for M6. This assert mean that IME state in Gekco isn't match on IME.

Comment 5

[Makoto Kato [:m_kato]]

Humm, TextComposition's IME state and GTK's GtkIM's status are different since PuppetWidget sends composition event.

I should remove sending composition event from PuppetWidget...

Comment 6

[Makoto Kato [:m_kato]]

Attachment: Part 1. Don't send composition event from PupetWidget

Comment 7

[Makoto Kato [:m_kato]]

Attachment: Part 2. Remove unnecessary commit by IMEBlur

Comment 8

[Makoto Kato [:m_kato]]

Attachment: Don't generate composing on child process if parent doesn't send composing event

Comment 9

[Makoto Kato [:m_kato]]

Comment on attachment 8564916 [details] [diff] [review]
Don't generate composing on child process if parent doesn't send composing event

When no composition event is fired by NotifyIME, this issue occurs.

PuppetWidget should send composition event if parent process generates this event only by NotifyIME.

Comment 10

[Makoto Kato [:m_kato]]

Also, this can reproduce on Windows + IMM32.

Comment 11

[Makoto Kato [:m_kato]]

Comment on attachment 8564916 [details] [diff] [review]
Don't generate composing on child process if parent doesn't send composing event

I talk with Nakano-san, we don't send NS_COMPOSITION_END from widget.  We should use NS_COMPOSITION_COMMIT_AS_IS instead.

Comment 12

[Makoto Kato [:m_kato]]

Attachment: Part 1. Repalce NS_COMPOSITION_CHANGE with NS_COMPOSITION_COMMIT

follow up bug 1077345 for e10s

Comment 13

[Makoto Kato [:m_kato]]

Comment on attachment 8564983 [details] [diff] [review]
Part 1. Repalce NS_COMPOSITION_CHANGE with NS_COMPOSITION_COMMIT

oops, this patch was invalid

Comment 14

[Makoto Kato [:m_kato]]

Attachment: Part 1. Repalce NS_COMPOSITION_CHANGE with NS_COMPOSITION_COMMIT

follow up bug 1077345 for e10s

Comment 15

[Makoto Kato [:m_kato]]

Attachment: Part 2. Don't generate composition event on child process if parent process doesn't send composition event by NotifyIME

Comment 16

[Makoto Kato [:m_kato]]

Comment on attachment 8564989 [details] [diff] [review]
Part 2. Don't generate composition event on child process if parent process doesn't send composition event by NotifyIME

PuppetWidget should send composition event if parent process generates this event only by NotifyIME.

Comment 17

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 8564989 [details] [diff] [review]
Part 2. Don't generate composition event on child process if parent process doesn't send composition event by NotifyIME

Thank you very much!

Comment 18

[Makoto Kato [:m_kato]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/93fb431c3464
https://hg.mozilla.org/integration/mozilla-inbound/rev/456038b0bdb5

Comment 19

[Nigel Babu [:nigelb]]

This has busted mochitests.

https://treeherder.mozilla.org/logviewer.html#?job_id=6664724&repo=mozilla-inbound
https://treeherder.mozilla.org/logviewer.html#?job_id=6664721&repo=mozilla-inbound
https://treeherder.mozilla.org/logviewer.html#?job_id=6664640&repo=mozilla-inbound

Do you want to fix or would you like me to back it out?

Comment 20

[Makoto Kato [:m_kato]]

(In reply to [e-mail] [:nigelb] from comment #19)
> This has busted mochitests.
> 
> https://treeherder.mozilla.org/logviewer.html#?job_id=6664724&repo=mozilla-
> inbound
> https://treeherder.mozilla.org/logviewer.html#?job_id=6664721&repo=mozilla-
> inbound
> https://treeherder.mozilla.org/logviewer.html#?job_id=6664640&repo=mozilla-
> inbound
> 
> Do you want to fix or would you like me to back it out?

please backout.  I will investigate this.

Comment 21

[Nigel Babu [:nigelb]]

Backed out

https://hg.mozilla.org/integration/mozilla-inbound/rev/3cac512f3ec5
https://hg.mozilla.org/integration/mozilla-inbound/rev/9fc9d2e35916

Comment 22

[Makoto Kato [:m_kato]]

Humm, it is unnecessary to call EndIMEComposition on IME blur.  It already handles TextComposition.

When crashing process, IPC error occurs due to destroying window.  it is timing issue, but we should remove EndIMEComsposition call on IME blur.

try:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=056723f95cd5

Comment 23

[Makoto Kato [:m_kato]]

Attachment: Part 2. Don't generate composition event on child process if parent process doesn't send composition event by NotifyIME

Comment 24

[Makoto Kato [:m_kato]]

Comment on attachment 8565318 [details] [diff] [review]
Part 2. Don't generate composition event on child process if parent process doesn't send composition event by NotifyIME

Even if IPC is closing state (it means IPC outputs warning and cannot call it correctly), IPC call will return true.  So I should set noCompositionEvent to true as initialize.

Comment 25

[Makoto Kato [:m_kato]]

Attachment: Part 3. Don't commit composition on IME blur from child process's widget.

When blur, TextComposition will will call NotifyIME if necessary.  So it is unnecessary to commit string on IME blur of widget.

Comment 26

[Makoto Kato [:m_kato]]

try
https://treeherder.mozilla.org/#/jobs?repo=try&revision=066fa3b0acfa

Comment 27

[Makoto Kato [:m_kato]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/4279fc499856
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/b919b63e11ef
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/e726777aad6f

Comment 28

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4279fc499856
https://hg.mozilla.org/mozilla-central/rev/b919b63e11ef
https://hg.mozilla.org/mozilla-central/rev/e726777aad6f