298388 - Crash on on FCKeditor in chinese mode [@ nsUnicodeRenderingToolkit::GetTextDimensions ]

Status: RESOLVED WORKSFORME

(Camino Graveyard :: General, defect)

Description

[Olivier Cahagne]

Build ID: Camino 0.9a1 (2005062008) on MacOSX 10.4.1 G4.

Steps to reproduce, reliable 100%:
1. Load URL http://www.fckeditor.net/Demo/Demo02.html?zh-cn
2. Click on Style dropdown menu
3. Select the "Code" with Orange background
4. Camino crashes.

With default english language, it doesn't crash.
Deer Park Alpha 1 doesn't crash on MacOSX, neither on Windows XP.
Didn't find previous bug reports with such a stack.


Thread 0 Crashed:
0   org.mozilla.navigator    	0x00179f70
nsUnicodeRenderingToolkit::GetTextDimensions(unsigned short const*, unsigned,
nsTextDimensions&, int*) + 120
1   org.mozilla.navigator    	0x00179edc
nsUnicodeRenderingToolkit::GetWidth(unsigned short const*, unsigned, int&, int*)
+ 44
2   org.mozilla.navigator    	0x00173c40
nsRenderingContextMac::GetWidth(unsigned short const*, unsigned, int&, int*) + 120
3   org.mozilla.navigator    	0x004cb5f0
nsTextFrame::GetPointFromOffset(nsPresContext*, nsIRenderingContext*, int,
nsPoint*) + 708
4   org.mozilla.navigator    	0x002f2f28
nsTypedSelection::GetPointFromOffset(nsIFrame*, int, nsPoint*) + 340
5   org.mozilla.navigator    	0x002f098c
nsTypedSelection::GetCachedFrameOffset(nsIFrame*, int, nsPoint&) + 164
6   org.mozilla.navigator    	0x002c6a88 nsCaret::GetCaretRectAndInvert() + 708
7   org.mozilla.navigator    	0x002c67b0 nsCaret::DrawCaret() + 408
8   org.mozilla.navigator    	0x002c5a74 nsCaret::StartBlinking() + 32
9   org.mozilla.navigator    	0x002c5318 nsCaret::SetCaretVisible(int) + 32
10  org.mozilla.navigator    	0x002e09bc PresShell::SetCaretEnabled(int) + 64
11  org.mozilla.navigator    	0x00296294
nsTextEditorFocusListener::Focus(nsIDOMEvent*) + 324
12  org.mozilla.navigator    	0x0035f6ec DispatchToInterface(nsIDOMEvent*,
nsIDOMEventListener*, unsigned (nsIDOMEventListener::*)(nsIDOMEvent*), nsID
const&, int*) + 136
13  org.mozilla.navigator    	0x003628a0
nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**,
nsIDOMEventTarget*, unsigned, nsEventStatus*) + 656
14  org.mozilla.navigator    	0x0034be34
nsDocument::HandleDOMEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, unsigned,
nsEventStatus*) + 260
15  org.mozilla.navigator    	0x0043b7d0
nsEventStateManager::PreHandleEvent(nsPresContext*, nsEvent*, nsIFrame*,
nsEventStatus*, nsIView*) + 1772
16  org.mozilla.navigator    	0x002e6bd4
PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, nsEventStatus*) + 404
17  org.mozilla.navigator    	0x002e692c PresShell::HandleEvent(nsIView*,
nsGUIEvent*, nsEventStatus*, int, int&) + 1292
18  org.mozilla.navigator    	0x0039c334 nsViewManager::HandleEvent(nsView*,
nsGUIEvent*, int) + 236
19  org.mozilla.navigator    	0x0039b720
nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) + 3128
20  org.mozilla.navigator    	0x00445d34 HandleEvent(nsGUIEvent*) + 72
21  org.mozilla.navigator    	0x00604320 nsChildView::DispatchEvent(nsGUIEvent*,
nsEventStatus&) + 160
22  org.mozilla.navigator    	0x006043ac
nsChildView::DispatchWindowEvent(nsGUIEvent&) + 32
23  org.mozilla.navigator    	0x00607d9c -[ChildView becomeFirstResponder] + 112
24  com.apple.AppKit         	0x936a7288 -[NSWindow makeFirstResponder:] + 200
25  org.mozilla.navigator    	0x000391e4 -[BrowserWindow makeFirstResponder:] + 88
26  org.mozilla.navigator    	0x00602a14 nsChildView::SetFocus(int) + 60
27  org.mozilla.navigator    	0x003bc070 nsGlobalWindow::Focus() + 436
28  libxpcom_core.dylib      	0x00e6126c _XPTC_InvokeByIndex + 216
29  org.mozilla.navigator    	0x00142fa4
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 2508
30  org.mozilla.navigator    	0x00136f18 XPC_WN_CallMethod(JSContext*,
JSObject*, unsigned, long*, long*) + 220
31  libmozjs.dylib           	0x01954f88 js_Invoke + 1768
32  libmozjs.dylib           	0x0195cedc js_Interpret + 28564
33  libmozjs.dylib           	0x01954fcc js_Invoke + 1836
34  libmozjs.dylib           	0x019551d8 js_InternalInvoke + 184
35  libmozjs.dylib           	0x019308f4 JS_CallFunctionValue + 44
36  org.mozilla.navigator    	0x003ca8ac
nsJSContext::CallEventHandler(JSObject*, JSObject*, unsigned, long*, long*) + 264
37  org.mozilla.navigator    	0x00547834
nsJSEventListener::HandleEvent(nsIDOMEvent*) + 960
38  org.mozilla.navigator    	0x003625bc
nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*,
nsIDOMEventTarget*, unsigned, unsigned) + 572
39  org.mozilla.navigator    	0x003628ec
nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**,
nsIDOMEventTarget*, unsigned, nsEventStatus*) + 732
40  org.mozilla.navigator    	0x003d068c
nsGenericElement::HandleDOMEvent(nsPresContext*, nsEvent*, nsIDOMEvent**,
unsigned, nsEventStatus*) + 1424
41  org.mozilla.navigator    	0x002e6c38
PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, nsEventStatus*) + 504
42  org.mozilla.navigator    	0x002e6a20
PresShell::HandleEventWithTarget(nsEvent*, nsIFrame*, nsIContent*, unsigned,
nsEventStatus*) + 68
43  org.mozilla.navigator    	0x00440138
nsEventStateManager::CheckForAndDispatchClick(nsPresContext*, nsMouseEvent*,
nsEventStatus*) + 460
44  org.mozilla.navigator    	0x0043e6ac
nsEventStateManager::PostHandleEvent(nsPresContext*, nsEvent*, nsIFrame*,
nsEventStatus*, nsIView*) + 1016
45  org.mozilla.navigator    	0x002e6eec
PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, nsEventStatus*) + 1196
46  org.mozilla.navigator    	0x002e692c PresShell::HandleEvent(nsIView*,
nsGUIEvent*, nsEventStatus*, int, int&) + 1292
47  org.mozilla.navigator    	0x0039c560 nsViewManager::HandleEvent(nsView*,
nsGUIEvent*, int) + 792
48  org.mozilla.navigator    	0x0039b720
nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) + 3128
49  org.mozilla.navigator    	0x00445d34 HandleEvent(nsGUIEvent*) + 72
50  org.mozilla.navigator    	0x00604320 nsChildView::DispatchEvent(nsGUIEvent*,
nsEventStatus&) + 160
51  org.mozilla.navigator    	0x006043ac
nsChildView::DispatchWindowEvent(nsGUIEvent&) + 32
52  org.mozilla.navigator    	0x00604458
nsChildView::DispatchMouseEvent(nsMouseEvent&) + 88
53  org.mozilla.navigator    	0x006061a0 -[ChildView mouseUp:] + 332
54  com.apple.AppKit         	0x93658d98 -[NSWindow sendEvent:] + 4728
55  org.mozilla.navigator    	0x00039328 -[BrowserWindow sendEvent:] + 216
56  com.apple.AppKit         	0x93601f5c -[NSApplication sendEvent:] + 4172
57  com.apple.AppKit         	0x935f93f0 -[NSApplication run] + 508
58  com.apple.AppKit         	0x936e9c1c NSApplicationMain + 452
59  org.mozilla.navigator    	0x0000aa54 _start + 380
60  org.mozilla.navigator    	0x0000a8d4 start + 48

Comment 1

[Mike Pinkerton (not reading bugmail)]

-> simon. this is crashing downstream from his recently added responder code.

Comment 2

[Simon Fraser [no longer active]]

Except that I didn't check that in yet ;)

Comment 3

[Olivier Cahagne]

wfm using Camino 0.9a2 on MacOSX 10.4.2 G4.