1997738 - Crash in [@ RaiseFailFastException | FailFastWithHR] with Sogou Pinyin

Status: RESOLVED DUPLICATE of bug 1824143

(External Software Affecting Firefox :: Other, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/1bc1a781-eb45-47af-a72c-7ce960251101

Reason:

ERROR_FAIL_FAST_EXCEPTION

Top 10 frames:

0  KERNELBASE.dll  RaiseFailFastException
1  textinputframework.dll  FailFastWithHR(long, uint64_t, uint64_t)
2  textinputframework.dll  TextInputClient::CheckUpdateLengthWithResult
3  textinputframework.dll  <lambda_a32633f75dc3aa1d9d5db5c1e961db0b>::operator()
4  textinputframework.dll  CQueryTextAsync::RunContinuation(void)
5  textinputframework.dll  CAsyncTaskScheduler::ContinueTask(CTask*)
6  textinputframework.dll  CQueryTextAsync::Then(std::function<long (long, MsgString*)>)
7  textinputframework.dll  TextInputClient::NotifyTextChangedInternal(ClientOwnerRegistration*, int, int...
8  textinputframework.dll  TextInputClient::NotifyTextChanged(unsigned int, int, int, int, int, int, uns...
9  textinputframework.dll  TextInputClient::EditControlTextChanged(unsigned int, int, int, int, unsigned...

These crashes are all happening with the popular Sougou Pinyin IME, several versions are affected as well as several versions of Windows, so this doesn't look like a recent regression caused by either of them, event though the sharp rise in the last few days suggests it may be one.

Comment 1

[Gabriele Svelto [:gsvelto]]

FYI the software should be available here: https://pinyin.sogou.com/index.php

Comment 2

[Greg Stoll :gstoll]

:masayuki, would you mind taking a look at this?

It looks like there is a background level of these, but the Sougou Pinyin IME ones didn't start taking off until 143.0.3, although as Gabriele said above it's a bit hard to say whether this is a regression or not.

Marking as S2 because it's currently the #4 crash in Fx 144.0.2, it's all parent process crashes, and around half happen very soon after startup (my guess is as soon as the user starts typing)

Comment 3

[Greg Stoll :gstoll]

A lot of the comments say just typing in the Baidu search box will cause a crash. I installed Sougou Pinyin IME and tried some stuff (although I don't speak the language so there was a lot of fumbling around :-) ) but wasn't able to get a crash.

Comment 4

[Greg Stoll :gstoll]

I do see a lot of these messages in my dev build, fwiw:

[Parent 21556, Main Thread] WARNING: '!GetUnionTextRects(aEvent.mInput.mOffset, aEvent.mInput.mLength, isRelativeToInsertionPoint, textRect)', file D:/firefox2/widget/ContentCache.cpp:945
[Parent 21556, Main Thread] WARNING: 'queryTextRectEvent.Failed()', file D:/firefox2/widget/windows/TSFTextStore.cpp:2020

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Well, basically, we can do nothing for this kind of bugs because the crash point is in a module of Windows. The exception is, if we send invalid data for some queries before the crash, we could avoid the bug of Windows.

The warnings in comment 4 is caused by reframing of the editable content. Baidu uses a <textarea> and when I type a character, it's moved from center of the page to top of the page. So, this must trigger a reframing of the <textarea>. When <textarea> is reframed, its anonymous editable contents, <div> and its Text node are recreated by the new frame. So, we must sent "all editable text is modified" message to Windows.

According to the log of MOZ_LOG=IMEHandler:4,KeyboardHandler:4, dispatching a keypress for "a" causes a text change notification. Then, a selection change notification and layout change notification are received. Then, keyup for "a" is fired. So, focus move does not occur.

Then, I checked MOZ_LOG=ContentCacheWidgets:4 too. Then, the first text change tnotification is what I've expected. I guess <textarea> is moved after this.

[Child 78252: Main Thread]: I/ContentCacheWidgets 0x149f0ccda28 CacheTextRects(), Succeeded,
mText="'a' (0x0061)" (Length()=1), mTextRectArray=<Nothing>,
mSelection={ mAnchor=1, mFocus=1, mWritingMode=h-ltr, mAnchorCharRects[ePrevCharRect]=(x=264, y=53, w=17, h=33),
mAnchorCharRects[eNextCharRect]=(x=280, y=53, w=1, h=33), mFocusCharRects[ePrevCharRect]=(x=264, y=53, w=17, h=33),
mFocusCharRects[eNextCharRect]=(x=280, y=53, w=1, h=33), mRect=(x=0, y=0, w=0, h=0),
Reversed()=false, StartOffset()=1, EndOffset()=1, IsCollapsed()=true, Length()=0 },
mFirstCharRect=(x=264, y=53, w=17, h=33), mLastCommitStringTextRectArray=<Nothing>

Then, 2 selection change notifications are received:

[Parent 4452: Main Thread]: I/ContentCacheWidgets 0x15b7ed9f960 AssignContent(aNotification=NOTIFY_IME_OF_SELECTION_CHANGE), Succeeded,
mText="'a' (0x0061)" (Length()=1),
mSelection={ mAnchor=1, mFocus=1, mWritingMode=h-ltr, mAnchorCharRects[ePrevCharRect]=(x=264, y=53, w=17, h=33),
mAnchorCharRects[eNextCharRect]=(x=280, y=53, w=1, h=33), mFocusCharRects[ePrevCharRect]=(x=264, y=53, w=17, h=33),
mFocusCharRects[eNextCharRect]=(x=280, y=53, w=1, h=33), mRect=(x=0, y=0, w=0, h=0),
Reversed()=false, StartOffset()=1, EndOffset()=1, IsCollapsed()=true, Length()=0 },
mFirstCharRect=(x=264, y=53, w=17, h=33), mCaret={ mOffset=1, mRect=(x=280, y=53, w=2, h=33) }, mTextRectArray=<Nothing>,
WidgetHasComposition()=false, mHandlingCompositions.Length()=0, mCompositionStart=<Nothing>, mPendingCommitLength=0,
mEditorRect=(x=836, y=456, w=1361, h=51), mLastCommitStringTextRectArray=<Nothing>
[Parent 4452: Main Thread]: I/ContentCacheWidgets 0x15b7ed9f960 AssignContent(aNotification=NOTIFY_IME_OF_POSITION_CHANGE), Succeeded,
mText="'a' (0x0061)" (Length()=1),
mSelection={ mAnchor=1, mFocus=1, mWritingMode=h-ltr, mAnchorCharRects[ePrevCharRect]=(x=264, y=53, w=17, h=33),
mAnchorCharRects[eNextCharRect]=(x=280, y=53, w=1, h=33), mFocusCharRects[ePrevCharRect]=(x=264, y=53, w=17, h=33),
mFocusCharRects[eNextCharRect]=(x=280, y=53, w=1, h=33), mRect=(x=0, y=0, w=0, h=0),
Reversed()=false, StartOffset()=1, EndOffset()=1, IsCollapsed()=true, Length()=0 },
mFirstCharRect=(x=264, y=53, w=17, h=33), mCaret={ mOffset=1, mRect=(x=280, y=53, w=2, h=33) }, mTextRectArray=<Nothing>,
WidgetHasComposition()=false, mHandlingCompositions.Length()=0, mCompositionStart=<Nothing>, mPendingCommitLength=0,
mEditorRect=(x=264, y=46, w=1275, h=50), mLastCommitStringTextRectArray=<Nothing>

So, I don't see any odd situation from typing a static character, "a". I should check the log with typing something with IME.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 20 desktop browser crashes on release

For more information, please visit BugBot documentation.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Oh, must be a dup of bug 1824143.