1801010 - [TSF] Crash in [@ hchangulime.dll | CoCreateInstance]

Status: NEW

(External Software Affecting Firefox :: Other, defect, P3)

Description

[Taegeon Lee]

Crash report: https://crash-stats.mozilla.org/report/index/75fa8ba7-823e-451a-86a7-202cf0221117

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  HCHangulIME.dll  HCHangulIME.dll@0x1dfc  
1  combase.dll  CoCreateInstance  onecore\com\combase\objact\actapi.cxx:250
2  HCHangulIME.dll  HCHangulIME.dll@0x3bd2  
3  msctf.dll  <unknown in msctf.dll>  
4  msctf.dll  CCompartment::InternalSetValue  
5  msctf.dll  CCompartment::SetValue  
6  xul.dll  mozilla::widget::TSFTextStore::SetIMEOpenState  widget/windows/TSFTextStore.cpp:6575
7  xul.dll  mozilla::widget::IMEHandler::SetInputContext  widget/windows/WinIMEHandler.cpp:449
8  xul.dll  nsWindow::SetInputContext  widget/windows/nsWindow.cpp:7807
9  xul.dll  mozilla::IMEStateManager::SetInputContext  dom/events/IMEStateManager.cpp:1581

Comment 1

[Daniel Holbert [:dholbert]]

A few observations:

• There are 11 crashes in the last 6 months; 9 of them have useragent locale = ko. One has jp (and is Thunderbird), one has en-US.
• All of the crashes seem to have IME-related functions as their innermost Mozilla code (and indeed, the dll in the crash signature ends in "IME").
• All of the crashes are on Windows 11

Adjusting the bug to match component from bug 1796044's recent changes to TSFTextStore (the innermost mozilla code that's involved here). (Not saying that bug in particular is related, but it just gives me a hint about where bugs that involve TSFTextStore might belong. :))

masayuki, any thoughts here?

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(away: 6/25-6/28)]

We grab necessary objects correctly at the caller.
https://searchfox.org/mozilla-central/rev/670e2e0999f04dc7734c8c12b2c3d420a1e31f12/widget/windows/TSFTextStore.cpp#6586,6594-6597

Therefore, this must be a bug in HCHanglulIME.dll. It's a DLL of Hancom IME (Korean). The vendor has office product. It could include the IME, but I don't find any documentation about it. So it could be older (no longer supported) product.

In 107 beta period, IME is used 613878 times, Korean IME is used 31045 times (5%) in it, and the IME is used 338 times (1% of the Korean IME use count). So, this is not urgent, but I think that we should stop setting IME open state if somebody post the GUID of the TIP here.

Kagami, do you know something about the IME?

Comment 3

[Kagami Rosylight [:saschanaz] (they/them)]

Yes, their office product indeed includes Hancom IME and it's still being supported. I don't think anyone uses the IME intentionally though, it's just a bundled software that some users accidentally switch to while typing.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(away: 6/25-6/28)]

Thank you. Anyway, we should report the bug of the DLL version 1.0.0.11226 to Hancom.

According to bp-4c1e1151-e944-40bb-98c4-4f2310221117, we cannot avoid this bug in our side since it may occur during a key press.

hsinyi: Is there a team or person to contact the IME developer?

Comment 5

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900) from comment #4)

Thank you. Anyway, we should report the bug of the DLL version 1.0.0.11226 to Hancom.

According to bp-4c1e1151-e944-40bb-98c4-4f2310221117, we cannot avoid this bug in our side since it may occur during a key press.

hsinyi: Is there a team or person to contact the IME developer?

I don't know if we know a contact person from Hancom IME, but I can give it a try to contact them via their "Contact Us" form though.
In the meanwhile, I am moving this issue to the "External Software Affecting Firefox":Other component.

Comment 6

[Hsin-Yi Tsai (she/her) [:hsinyi]]

I submitted a report to Hancom. I will report back if I hear anything from them.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(away: 6/25-6/28)]

(In reply to Hsin-Yi Tsai (she/her) [:hsinyi] from comment #6)

I submitted a report to Hancom. I will report back if I hear anything from them.

Thank you very much!

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:haik, could you have a look please?

For more information, please visit auto_nag documentation.