260388 - GLib-CRITICAL **: file gstrfuncs.c: line 1348 (g_strsplit): assertion `string != NULL' failed.

Status: RESOLVED WONTFIX

(Core :: Layout: Text and Fonts, defect)

Description

[Ben Fowler]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a4) Gecko/20040919 Firefox/0.9.1+
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a4) Gecko/20040919 Firefox/0.9.1+

When trying to delete by backspacing in a textarea on a form my own build
of Firefox crashes everytime, with these messages.

GLib-CRITICAL **: file gstrfuncs.c: line 186 (g_strconcat): assertion `string1
!= NULL' failed.
Pangolite:(null): Error opening config file: Bad address

GLib-CRITICAL **: file gstrfuncs.c: line 186 (g_strconcat): assertion `string1
!= NULL' failed.

GLib-CRITICAL **: file gstrfuncs.c: line 1348 (g_strsplit): assertion `string !=
NULL' failed.
Sep 19 18:52:49  /usr/libexec/crashreporterd: crashdump hung! (pid 9990)

Whilst this is probably something that I have caused, the fact is that 
there seems to be one call only to g_strsplit( ), on line 219
of accessible/src/atk/nsAppRootAccessible.cpp, so it might be worth
someone who knows the code taking a look.

Reproducible: Always
Steps to Reproduce:
1. View a page with a form and textarea, e.g.
http://bugzilla.mozilla.org/show_bug.cgi?id=216033
2. Type some text into a textarea including at least one error.
3. Attempt to amend your typing by deleting characters with the backspace key.

Actual Results:  
Crash

Expected Results:  
Removed characters before the cursor and allowed editing

This may be specific to me as I was using a Firefox built from my own tree.

One can woraround by overtyping or usimg Cmd-X (Cut)

Comment 1

[Ben Fowler]

I seem to have fingered the wrong file. I now have a backtrace, and the 
last line executed within Mozilla code is

http://lxr.mozilla.org/seamonkey/source/intl/ctl/src/pangoLite/pango-utils.c#155

and I assume that str has somehow become a null pointer. str is actually
constructed by g_strconcat in 
http://lxr.mozilla.org/seamonkey/source/intl/ctl/src/pangoLite/modules.c#317
and I wonder if that procedure was somehow given a null pointer instead of an 
empty string and if so whether it returned null ...

Would a patch be accepted to verify (police) parameters before calling
string functions from an external library?

I am aware that null-checks are regarded as spackle, and whilst I am
not quite aure what spackle is, I suspect that it is not intrinsically
desirable.

If adding 'spackle' to code means 'papering over the cracks' instead
of a proper fix, healing or repairing then the British equivalent
is Polyfilla, a cellulose, non-cracking plaster; videlicet
http://cgi.peak.org/~jeremy/retort.cgi?British=Polyfilla .

Comment 2

[Ben Fowler]

I can certainly prevent my crash by adding guards along the lines
I suggested. I suspect that there may be a problem with the code
at 
http://lxr.mozilla.org/seamonkey/source/intl/ctl/src/pangoLite/pango-utils.c#683
namely, pangolite_get_sysconf_subdirectory( )
as I now get these (non-deadly) errors:
GLib-CRITICAL **: file gstrfuncs.c: line 186 (g_strconcat): assertion `string1
!= NULL' failed.
Pangolite:(null): Error opening config file: Bad address
My patch code looks really bad, but I will submit a patch if it wanted.

Comment 3

[Jungshik Shin]

Apparently, you built your firefox with CTL enabled on Mac OS X. If my memory
serves me right, it doesn't buy you anything by enabling CTL. 

Anyway, the wall-papering suggested here should be worth consideration, I think. 

Comment 4

[Ben Fowler]

Attachment: Patch for this crash

Yes, I have CTL enabled. I probably copied and pasted the .mozconfig
from somewhere. Firefox does not link properly in the pango directory 
possibly because the link command is missing the incantation required
for creating a dynamic library, such as -lm.

This is my patch which is 'belt and braces' (or suspenders for those
who only wear braces on their teeth) for my crash.

Comment 5

[Ben Fowler]

Attachment: Patch for this crash

Fuller and better patch.

Comment 6

[Simon Montagu :smontagu]

enable-ctl is no longer supported.