13448 - [PP]Crash typing in HTML compose window

Status: VERIFIED WORKSFORME

(MailNews Core :: Composition, defect, P1)

Description

[esther]

Using 19990909 build on linux, I crash trying to type in HTML compose window

1. Launch Messenger
2. Click New Msg
3. Type in recipient, and subject
4. Click in body and start typing

I crash here.

Comment 1

[(not reading, please use [e-mail] instead)]

I see it too.

Here's the stack trace:

#0  0x42198170 in IMETextTxn::Do (this=0x8aa7470) at IMETextTxn.cpp:82
#1  0x41cd0158 in nsTransactionItem::Do (this=0x8aa74f8) at
nsTransactionItem.cpp:102
#2  0x41cd2729 in nsTransactionManager::BeginTransaction (this=0x8e711c0,
aTransaction=0x8aa7470) at nsTransactionManager.cpp:1038
#3  0x41cd0cc0 in nsTransactionManager::Do (this=0x8e711c0,
aTransaction=0x8aa7470) at nsTransactionManager.cpp:134
#4  0x42132b72 in nsEditor::Do (this=0x8b159a0, aTxn=0x8aa7470) at
nsEditor.cpp:341
#5  0x4213dc84 in nsEditor::SetInputMethodText (this=0x8b159a0,
aStringToInsert=@0xbfffeb04, aTextRangeList=0x8aa73f8) at nsEditor.cpp:2974
#6  0x42135f5d in nsEditor::SetCompositionString (this=0x8b159a0,
aCompositionString=@0xbfffeb04, aTextRangeList=0x8aa73f8, aReply=0xbffff07c) at
nsEditor.cpp:1200
#7  0x4215cf1e in nsTextEditorTextListener::HandleText (this=0x8e9a220,
aTextEvent=0x8aa7220) at nsEditorEventListeners.cpp:1257
#8  0x40d3ee98 in nsEventListenerManager::HandleEvent (this=0x8e712c8,
aPresContext=@0x8a6d908, aEvent=0xbffff044, aDOMEvent=0xbfffecac, aFlags=7,
aEventStatus=@0xbfffefac) at nsEventListenerManager.cpp:742
#9  0x40f32d1b in nsDocument::HandleDOMEvent (this=0x8cb31b0,
aPresContext=@0x8a6d908, aEvent=0xbffff044, aDOMEvent=0xbfffecac, aFlags=1,
aEventStatus=@0xbfffefac) at nsDocument.cpp:2314
#10 0x40dca7dd in nsHTMLHtmlElement::HandleDOMEvent (this=0x8e99bc8,
aPresContext=@0x8a6d908, aEvent=0xbffff044, aDOMEvent=0x0, aFlags=1,
aEventStatus=@0xbfffefac) at nsHTMLHtmlElement.cpp:186
#11 0x40d83820 in PresShell::HandleEvent (this=0x8b155d0, aView=0x8290f10,
aEvent=0xbffff044, aEventStatus=@0xbfffefac) at nsPresShell.cpp:1991
#12 0x41cbcbb3 in nsView::HandleEvent (this=0x8290f10, event=0xbffff044,
aEventFlags=8, aStatus=@0xbfffefac, aHandled=@0xbfffef50) at nsView.cpp:834
#13 0x41cbcb42 in nsView::HandleEvent (this=0x8b15fd8, event=0xbffff044,
aEventFlags=8, aStatus=@0xbfffefac, aHandled=@0xbfffef50) at nsView.cpp:818
#14 0x41cbcb42 in nsView::HandleEvent (this=0x8b160c8, event=0xbffff044,
aEventFlags=8, aStatus=@0xbfffefac, aHandled=@0xbfffef50) at nsView.cpp:818
#15 0x41cbcb42 in nsView::HandleEvent (this=0x8b14e88, event=0xbffff044,
aEventFlags=28, aStatus=@0xbfffefac, aHandled=@0xbfffef50) at nsView.cpp:818
#16 0x41cc5f23 in nsViewManager::DispatchEvent (this=0x8b14cf0,
aEvent=0xbffff044, aStatus=@0xbfffefac) at nsViewManager.cpp:1610
#17 0x41cbacd4 in HandleEvent (aEvent=0xbffff044) at nsView.cpp:66
#18 0x40552980 in nsWidget::DispatchEvent (this=0x8b16200, aEvent=0xbffff044,
aStatus=@0xbffff0bc) at nsWidget.cpp:1120
#19 0x405469c2 in composition_draw (aEvent=0x8b3086c, aWin=0x8b16200,
aDecoder=0x8aa7008, aStatus=0xbffff0bc) at nsGtkEventHandler.cpp:558
#20 0x40546f9c in handle_key_press_event (w=0x8b16338, event=0x8b3086c,
p=0x8b16200) at nsGtkEventHandler.cpp:713
#21 0x406de79d in gtk_marshal_BOOL__POINTER ()
#22 0x406a6037 in gtk_handlers_run ()
#23 0x406a552f in gtk_signal_real_emit ()
#24 0x406a3800 in gtk_signal_emit ()
#25 0x406d65b8 in gtk_widget_event ()
#26 0x406dd384 in gtk_window_key_press_event ()
#27 0x406de79d in gtk_marshal_BOOL__POINTER ()
#28 0x406a5568 in gtk_signal_real_emit ()
#29 0x406a3800 in gtk_signal_emit ()
#30 0x406d65b8 in gtk_widget_event ()
#31 0x4067b126 in gtk_propagate_event ()
#32 0x4067a4da in gtk_main_do_event ()
#33 0x4071dab2 in ?? () from /usr/lib/libgdk-1.2.so.0
#34 0x4074a2c6 in g_main_dispatch ()
#35 0x4074a801 in g_main_iterate ()
#36 0x4074a979 in g_main_run ()
#37 0x40679f3a in gtk_main ()
#38 0x4053dd99 in nsAppShell::Run (this=0x808e808) at nsAppShell.cpp:379
#39 0x403a9661 in nsAppShellService::Run (this=0x808d8d0) at
nsAppShellService.cpp:450
#40 0x804b138 in main1 (argc=2, argv=0xbffffab4) at nsAppRunner.cpp:836
#41 0x804b245 in main (argc=2, argv=0xbffffab4) at nsAppRunner.cpp:859
#42 0x4027ecb3 in ?? () from /lib/libc.so.6

re-assigning to jfrancis, as it is crashing in his code.

Comment 2

[esther]

Changing priority to P1

Comment 3

[Joe Francis]

assuming the stack crawl is correct, this isn't my code.  Kin, tague, can you
sort this out?  If the stack crawl is wrong then assign back to me with updated
info. thanks.

Comment 4

[tague]

i'm going to reassign this pavlov, i'm pretty sure this is related to his
changes in the past two days.

the end of the stack trace shows that you are trying to do an IME insert into
the compose window -- since you don't have IME's installed, is problem.  it
looks like the IME stuff is always getting triggered, which probably means pav's
changes weren't quite correct.

Comment 5

[(not reading, please use [e-mail] instead)]

there is a work around:

if you can get a cursor (by clicking over the "This message sent from Messenger
5.0" text) then you can type.

the crash appears to happen because when select the body of the message, you
don't get a cursor.

Comment 6

[fenella]

Linux (1999-09-09-09 M11)

I get the crash stack trace:

0x4026f574 in __libc_write ()
(gdb) where
#0  0x4026f574 in __libc_write ()
#1  0x401432bc in __DTOR_END__ ()
#2  0x40121f20 in pt_Write ()
#3  0x40113385 in PR_Write ()
#4  0x4079244e in nsSocketTransport::doWriteFromStream ()
#5  0x407922dc in nsSocketTransport::doWrite ()
#6  0x40791ddf in nsSocketTransport::Process ()
#7  0x4079375c in nsSocketTransportService::Run ()
#8  0x400e48d4 in nsThread::Main ()
#9  0x40124f5e in _pt_root ()
#10 0x40137ce9 in pthread_start_thread (arg=0xbf5ffe7c) at manager.c:204

Comment 7

[(not reading, please use [e-mail] instead)]

ignore fenella's last comment.

she accidentally reported a SIGPIPE.

On linux, you need to ignore those, by adding this to you .gdbinit file:
handle SIGPIPE nostop noprint

the stack trace that I reported is valid.

it's crashing because mElement is null and we are trying to dereference it.

jfrancis, I originally assigned it to you because according to:

http://cvs-mirror.mozilla.org/webtools/bonsai/cvsblame.cgi?file=mozilla/editor/base/IMETextTxn.cpp#82

it looks like you were the last to touch the code.

Comment 8

[Joe Francis]

i touched it minorly, but i also had to reformat it (it had mixed spaces and
tabs) and that unfortunately makes it look like I touched lots more than i really
did.

Comment 9

[pmock]

On the linux seamonkey 1999-09-10-09-m11 build, I can now type in the message
body of the html compose window.  It looks like it works for me. :)

Comment 10

[esther]

Using 19990916 on win98 and 19990915 on linux this is not crashing.  Resolve as
worksforme or fixed if it has been fixed and we can verify it.

Comment 11

[lchiang]

No response in the bug.  I'll go ahead and mark worksforme since we can type in
the Linux HTML compose window now.