349727 - random crash due to trashed nsWindow::mIMEData

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I crashed in nsWindow::CancelIMEComposition because the window's mIMEData was trashed.  I'm guessing that this might the problem you mentioned in bug 337036 comment 17, although it could be something else.  I have no idea what I was doing at the time.

I'll attach a bunch of gdb output.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Also, I saw tons of these:

WARNING: NS_ENSURE_TRUE(window) failed: file /builds/trunk/mozilla/content/events/src/nsIMEStateManager.cpp, line 186
WARNING: NS_ENSURE_TRUE(aPresContext->Document()->GetWindow()) failed: file /builds/trunk/mozilla/content/events/src/nsIMEStateManager.cpp, line 174

before the crash, although I don't think they're related.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: gdb output

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Wow, it's strange...

> #5  <signal handler called>
> #6  0x4c361755 in IA__gtk_im_context_reset (context=0x11604f10)
>     at gtkimcontext.c:375
> #7  0x00db4997 in nsWindow::CancelIMEComposition (this=0x11533360)
>     at /builds/trunk/mozilla/widget/src/gtk2/nsWindow.cpp:5193

Looks like the crash occurred in gtk_im_context_reset. Maybe, the context has been destroyed in IMEDestroyContext. But the child still alive?? And the child can access to destroyed mIMEData??

dbaron, does this bug happens in many times? or sometimes? and does this bug happens on exiting application? or closing window?

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #3)
> Maybe, the context has
> been destroyed in IMEDestroyContext.

The context pointer looks like it's just a random number, not something that was previously a valid pointer, given the rest of the contents of the IMEData.

> dbaron, does this bug happens in many times? or sometimes? and does this bug
> happens on exiting application? or closing window?

It only happened once, and I'm not sure what I was doing at the time.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch rv1.0

This patch adds the ref counter in nsIMEData.
This patch release the IME contexts when the owner window is destroying. But the mIMEData is not released in this time if the children still alive.

# I cannot understand the cause of comment 1. What means the log.

Comment 6

[Masaki Katakai]

Comment on attachment 235079 [details] [diff] [review]
Patch rv1.0

Looks OK for me.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

checked-in.