210641 - Crash using Japanese IME

Status: VERIFIED FIXED

(Core :: Internationalization, defect)

Description

[Tracy Walker [:tracy]]

seen on commercial trunk builds:

windows 2003-06-25-04-trunk
linux 2003-06-25-05-trunk
mac 2003-06-25-03-trunk

-open composer (or any text entry area)
-turn on Japanese IME 
-attempt to type Japanese

Crash! Mac and windows both crash on attempt to type in Japanese.  Linux Crashes
on call to the IME with shift+space.

Comment 1

[kinmoz]

The linux problem has been around a while and is filed as bug 208095 so I don't
think that should be part of the "blocker" status. I believe smontagu is
currently looking into that bug.

Do we have a stack trace for the crash on Mac?

Comment 2

[Tracy Walker [:tracy]]

Japanese IME has been working for me on RH 8.0 up until today.  talkback crash
ID's for all platforms coming up....

Comment 3

[Tracy Walker [:tracy]]

windows TB ID: 21347039
Linux TB ID: 21347136
Mac TB ID: 21347237 (not much there)

from linux crash:

Stack Signature 
_ZN31nsTextEditorCompositionListener22HandleStartCompositionEP11nsIDOMEvent()
c6f07a8e
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2003062505
Trigger Time 2003-06-25 08:30:56
Platform LinuxIntel
Operating System Linux 2.4.18-27.8.0
Module libeditor.so
URL visited
User Comments crash using japanese in composer
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Source File Name
Trigger Line No.
Stack Trace
_ZN31nsTextEditorCompositionListener22HandleStartCompositionEP11nsIDOMEvent()
_ZN22nsEventListenerManager11HandleEventEP14nsIPresContextP7nsEventPP11nsIDOMEventP17nsIDOMEventTargetjP13nsEventStatus()
_ZN10nsDocument14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN16nsGenericElement14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN9PresShell19HandleEventInternalEP7nsEventP7nsIViewjP13nsEventStatus()
_ZN9PresShell11HandleEventEP7nsIViewP10nsGUIEventP13nsEventStatusiRi()
_ZN13nsViewManager11HandleEventEP6nsViewP10nsGUIEventi()
_ZN6nsView11HandleEventEP13nsViewManagerP10nsGUIEventi()
_ZN13nsViewManager13DispatchEventEP10nsGUIEventP13nsEventStatus()
_Z11HandleEventP10nsGUIEvent()
_ZN8nsWidget13DispatchEventEP10nsGUIEventR13nsEventStatus()
_ZN8nsWidget19DispatchWindowEventEP10nsGUIEvent()
_ZN8nsWidget7OnInputER12nsInputEvent()
_ZN8nsWindow15IMEComposeStartEj()
_ZN8nsWindow17ime_preedit_startEv()
_ZN10nsIMEGtkIC20preedit_start_cbprocEP4_XICPcS2_()
ximcp.so.2 + 0x4827 (0x406fe827)
ximcp.so.2 + 0x4545 (0x406fe545)
ximcp.so.2 + 0x18dea (0x40712dea)
ximcp.so.2 + 0x1a001 (0x40714001)
ximcp.so.2 + 0x1a080 (0x40714080)
ximcp.so.2 + 0xaef9 (0x40704ef9)
ximcp.so.2 + 0x504d (0x406ff04d)
ximcp.so.2 + 0x519c (0x406ff19c)
libX11.so.6 + 0x4f845 (0x4034d845)
libgdk-1.2.so.0 + 0x19009 (0x4029f009)
libgdk-1.2.so.0 + 0x19274 (0x4029f274)
libglib-1.2.so.0 + 0x1297e (0x402d497e)
libglib-1.2.so.0 + 0x12e59 (0x402d4e59)
libglib-1.2.so.0 + 0x130f4 (0x402d50f4)
libgtk-1.2.so.0 + 0xa86df (0x401d36df)
_ZN10nsAppShell3RunEv()
_ZN17nsAppShellService3RunEv()
netscape-bin + 0x12dd5 (0x0805add5)
netscape-bin + 0x135ff (0x0805b5ff)
0x420158f7 


from windows crash:

Incident ID 21347039
Stack Signature nsTextEditorCompositionListener::HandleStartComposition 7fc762b5
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2003062504
Trigger Time 2003-06-25 08:27:20
Platform Win32
Operating System Windows NT 5.0 build 2195
Module editor.dll
URL visited
User Comments Crash using japanese IME in composer
Trigger Reason Access violation
Source File Name
c:/builds/seamonkey/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp
Trigger Line No. 946
Stack Trace
nsTextEditorCompositionListener::HandleStartComposition
[c:/builds/seamonkey/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp,
line 946]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1541]
nsDocument::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 3673]
nsGenericElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp, line 2105]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6353]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6284]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2284]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 308]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2069]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 82]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1059]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1076]
nsWindow::HandleStartComposition
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5740]
nsWindow::OnIMEStartComposition
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 6527]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 4312]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1339]
USER32.dll + 0x2a244 (0x77e3a244)
USER32.dll + 0x45e5 (0x77e145e5)
USER32.dll + 0xa792 (0x77e1a792)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 479]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1307]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1673]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1695]
WinMainCRTStartup()
KERNEL32.dll + 0x2847c (0x77ea847c) 

Comment 4

[Jan Carpenter]

Attachment: talkback info on a similar crash.

There is one other crash on today's build mentioning the Japanese IM that
sounds similar to twalkers crashes.  I'm attaching the talkback info.

Comment 5

[kinmoz]

brade says mEditor has a bogus address in it. I suspect something got checked in
with an extra release of the editor? Or perhaps something is freeing the
listener itself without unregistering it?

Comment 6

[kinmoz]

So on IRC smontagu pointed out that glazman added some stuff to
nsHTMLEditor::QueryInterface() and then commented the whole method out ... and
then  brade pointed out that he replaced it with the interface map macros above.

I don't think you can do that because the QI version he commented out, calls
through to the base class when it doesn't match any of the interfaces in the
HTML realm ... the nsEditor.cpp base class is what knows about the IME interfaces.

We should try commenting out the map macros and put back in the QI method.

Comment 7

[kinmoz]

FYI, the QI change was made as part of this checkin. The bug number wasn't
included in the checkin comment so I don't have it handy.

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=glazman%25netscape.com&whotype=match&sortby=Date&hours=2&date=explicit&mindate=06%2F25%2F2003+01%3A00%3A00&maxdate=06%2F25%2F2003+08%3A00%3A00&cvsroot=%2Fcvsroot

Comment 8

[Johnny Stenback (:jst)]

Attachment: Proposed fix.

Comment 9

[Johnny Stenback (:jst)]

Attachment: Better fix.

Comment 10

[Johnny Stenback (:jst)]

s/nsPlainEditor/nsPlainTextEditor/ in that diff.

Comment 11

[Johnny Stenback (:jst)]

Attachment: ignore.

Comment 12

[Johnny Stenback (:jst)]

Attachment: This is 'the one'

Comment 13

[kinmoz]

Comment on attachment 126480 [details] [diff] [review]
This is 'the one'

sr=kin

Comment 14

[kinmoz]

jst's fix checked into the TRUNK:

  mozilla/editor/libeditor/html/nsHTMLEditor.cpp       revision 1.480
  mozilla/editor/libeditor/text/nsPlaintextEditor.cpp  revision 1.71

brade, smontagu, and jst ... thanks for the help.

Comment 15

[Tracy Walker [:tracy]]

verified with commercial trunk builds:

windows 2003-06-25-12-trunk
linux 2003-06-25-12-trunk
mac 2003-06-25-12-trunk