361361 - Infinite loop in mozInlineSpellChecker::SpellCheckRange

Status: RESOLVED DUPLICATE of bug 324521

(Core :: Spelling checker, defect)

Description

[Darryl Miles]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.8.0.7) Gecko/20060929 SeaMonkey/1.0.5
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.8.0.7) Gecko/20060929 SeaMonkey/1.0.5


When using SeaMonkey 1.0.5 and opening a large (1500 lines) plain text email, when pasting into the To: box a emaila address can cause infinite loop.

The exact loops is around line extensions/spellcheck/src/mozInlineSpellChecker.cpp:944 with it never making any progress.  Even if I manually force "end = -1" with the debugger to exit the outer loop, the call to while (NS_SUCCEEDED(mTextServicesDocument->IsDone(&done)) && !done) always resulting in another interation (in around the 10 times I tried to make it make progress).


Is there anyway to completely disable this buggy feature from the mail/news since I am being hit by this too often to make SM 1.0.5 usable for me.



Program received signal SIGINT, Interrupt.
0x00002b6d4dfd5df0 in nsTraceRefcnt::LogAddCOMPtr (aPtr=0x7fff5cc74680, aObject=0x400f740) at nsTraceRefcnt.cpp:115
115       gTraceRefcntObject->LogAddCOMPtr(aPtr, aObject);
(gdb) bt
#0  0x00002b6d4dfd5df0 in nsTraceRefcnt::LogAddCOMPtr (aPtr=0x7fff5cc74680, aObject=0x400f740) at nsTraceRefcnt.cpp:115
#1  0x00002aaaab2e13b0 in nsCOMPtr<nsIContent>::assign_assuming_AddRef (this=0x7fff5cc74680, newPtr=0x400f740) at ../../../../dist/include/xpcom/nsCOMPtr.h:565
#2  0x00002aaaab2e142d in nsCOMPtr<nsIContent>::assign_from_qi (this=0x7fff5cc74680, qi={mRawPtr = 0x400f778}, aIID=@0x2aaaab96b590) at ../../../../dist/include/xpcom/nsCOMPtr.h:1234
#3  0x00002aaaab2e1460 in nsCOMPtr (this=0x7fff5cc74680, qi={mRawPtr = 0x400f778}) at ../../../../dist/include/xpcom/nsCOMPtr.h:645
#4  0x00002aaaab5a57ab in nsContentUtils::GetAncestorsAndOffsets (aNode=0x400f778, aOffset=50, aAncestorNodes=0x117dfb0, aAncestorOffsets=0x117e010) at nsContentUtils.cpp:1097
#5  0x00002aaaab60502b in nsRange::IsIncreasing (aStartN=0x400f778, aStartOffset=50, aEndN=0xa2d7ff8, aEndOffset=0) at nsRange.cpp:746
#6  0x00002aaaab605414 in nsRange::ComparePoints (aParent1=0x400f778, aOffset1=50, aParent2=0xa2d7ff8, aOffset2=0) at nsRange.cpp:134
#7  0x00002aaaab407826 in nsTypedSelection::LookUpSelection (this=0x7f13fc0, aContent=0xa2d7fc0, aContentOffset=0, aContentLength=89, aReturnDetails=0x7fff5cc74928, aType=2,
    aSlowCheck=1) at nsSelection.cpp:4993
#8  0x00002aaaab3fbd93 in nsSelection::LookUpSelection (this=0xd595c20, aContent=0xa2d7fc0, aContentOffset=0, aContentLength=89, aReturnDetails=0x7fff5cc74928, aSlowCheck=1)
    at nsSelection.cpp:2654
#9  0x00002aaaab41ea30 in nsTextFrame::SetSelected (this=0xda65da8, aPresContext=0xffbd8b0, aRange=0xe0b1200, aSelected=0, aSpread=eSpreadDown) at nsTextFrame.cpp:4139
#10 0x00002aaaab40827a in nsTypedSelection::selectFrames (this=0x7f13fc0, aPresContext=0xffbd8b0, aRange=0xe0b1200, aFlags=0) at nsSelection.cpp:4865
#11 0x00002aaaab40a920 in nsTypedSelection::RemoveRange (this=0x7f13fc0, aRange=0xe0b1200) at nsSelection.cpp:5605
#12 0x00002aaab239bf31 in mozInlineSpellChecker::SpellCheckRange (this=0x77722e0, aRange=0xc9b9550, aSpellCheckSelection=0x7f13fc0) at mozInlineSpellChecker.cpp:953
#13 0x00002aaab239d836 in mozInlineSpellChecker::SpellCheckBetweenNodes (this=0x77722e0, aStartNode=0x13b38ed8, aStartOffset=0, aEndNode=0x13b38ed8, aEndOffset=8,
    aSpellCheckSelection=0x0) at mozInlineSpellChecker.cpp:647
#14 0x00002aaab239dd31 in mozInlineSpellChecker::IgnoreWords (this=0x77722e0, aWordsToIgnore=0xfc4cad0, aCount=3) at mozInlineSpellChecker.cpp:460
#15 0x00002b6d4e078c10 in XPTC_InvokeByIndex (that=0x77722e0, methodIndex=14, paramCount=2, params=0x7fff5cc751c0) at xptcinvoke_x86_64_linux.cpp:209
#16 0x00002b6d51ae388d in XPCWrappedNative::CallMethod (ccx=@0x7fff5cc755e0, mode=XPCWrappedNative::CALL_METHOD) at xpcwrappednative.cpp:2156
#17 0x00002b6d51aecdfc in XPC_WN_CallMethod (cx=0x174e6040, obj=0xd6987d0, argc=2, argv=0x17b28a60, vp=0x7fff5cc757d0) at xpcwrappednativejsops.cpp:1445
#18 0x00002b6d4e25b9a2 in js_Invoke (cx=0x174e6040, argc=2, flags=0) at jsinterp.c:1187
#19 0x00002b6d4e2700e4 in js_Interpret (cx=0x174e6040, pc=0x27cb96a ":", result=0x7fff5cc76bc8) at jsinterp.c:3583
#20 0x00002b6d4e25ba2d in js_Invoke (cx=0x174e6040, argc=1, flags=2) at jsinterp.c:1207
#21 0x00002b6d4e25be80 in js_InternalInvoke (cx=0x174e6040, obj=0xf57ccc0, fval=225022800, flags=0, argc=1, argv=0x7fff5cc77160, rval=0x7fff5cc77140) at jsinterp.c:1284
#22 0x00002b6d4e21b67f in JS_CallFunctionValue (cx=0x174e6040, obj=0xf57ccc0, fval=225022800, argc=1, argv=0x7fff5cc77160, rval=0x7fff5cc77140) at jsapi.c:4186
#23 0x00002aaaab77d149 in nsJSContext::CallEventHandler (this=0x13652950, aTarget=0xf57ccc0, aHandler=0xd699350, argc=1, argv=0x7fff5cc77160, rval=0x7fff5cc77140)
    at nsJSEnvironment.cpp:1456
#24 0x00002aaaab7dfdb5 in nsJSEventListener::HandleEvent (this=0x908eae0, aEvent=0x11cbff60) at nsJSEventListener.cpp:186
#25 0x00002aaaab62d6fc in nsEventListenerManager::HandleEventSubType (this=0x13aae710, aListenerStruct=0xc31de20, aDOMEvent=0x11cbff60, aCurrentTarget=0x4533100, aSubType=8,
    aPhaseFlags=2) at nsEventListenerManager.cpp:1687
#26 0x00002aaaab62f693 in nsEventListenerManager::HandleEvent (this=0x13aae710, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aCurrentTarget=0x4533100,
    aFlags=2, aEventStatus=0x7fff5cc78dac) at nsEventListenerManager.cpp:1788
#27 0x00002aaaab72ff82 in nsXULElement::HandleDOMEvent (this=0x77e44c0, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aFlags=2, aEventStatus=0x7fff5cc78dac)
    at nsXULElement.cpp:2152
#28 0x00002aaaab7300d8 in nsXULElement::HandleDOMEvent (this=0xffb1830, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aFlags=2, aEventStatus=0x7fff5cc78dac)
    at nsXULElement.cpp:2172
#29 0x00002aaaab7300d8 in nsXULElement::HandleDOMEvent (this=0x12d8fd40, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aFlags=2, aEventStatus=0x7fff5cc78dac)
    at nsXULElement.cpp:2172
#30 0x00002aaaab7300d8 in nsXULElement::HandleDOMEvent (this=0x13f23a40, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aFlags=2, aEventStatus=0x7fff5cc78dac)
    at nsXULElement.cpp:2172
#31 0x00002aaaab7300d8 in nsXULElement::HandleDOMEvent (this=0x8d628e0, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aFlags=2, aEventStatus=0x7fff5cc78dac)
    at nsXULElement.cpp:2172
#32 0x00002aaaab7300d8 in nsXULElement::HandleDOMEvent (this=0x43cc870, aPresContext=0xfca9220, aEvent=0x7fff5cc78d30, aDOMEvent=0x7fff5cc78a68, aFlags=7, aEventStatus=0x7fff5cc78dac)
    at nsXULElement.cpp:2172
#33 0x00002aaaab353159 in PresShell::HandleDOMEventWithTarget (this=0x86fde30, aTargetContent=0x43cc870, aEvent=0x7fff5cc78d30, aStatus=0x7fff5cc78dac) at nsPresShell.cpp:6519
#34 0x00002aaaab574416 in nsMenuFrame::Execute (this=0x4dd3ac0, aEvent=0x7fff5cc79630) at nsMenuFrame.cpp:1660
#35 0x00002aaaab574a5a in nsMenuFrame::HandleEvent (this=0x4dd3ac0, aPresContext=0xfca9220, aEvent=0x7fff5cc79630, aEventStatus=0x7fff5cc7932c) at nsMenuFrame.cpp:469
#36 0x00002aaaab35e925 in PresShell::HandleEventInternal (this=0x86fde30, aEvent=0x7fff5cc79630, aView=0x8d62fd0, aFlags=1, aStatus=0x7fff5cc7932c) at nsPresShell.cpp:6464
#37 0x00002aaaab35fd7d in PresShell::HandleEvent (this=0x86fde30, aView=0x8d62fd0, aEvent=0x7fff5cc79630, aEventStatus=0x7fff5cc7932c, aForceHandle=0, aHandled=@0x7fff5cc79314)
    at nsPresShell.cpp:6259
#38 0x00002aaaab77319b in nsViewManager::HandleEvent (this=0x99191b0, aView=0xdc549c0, aEvent=0x7fff5cc79630, aCaptured=0) at nsViewManager.cpp:2557
#39 0x00002aaaab774351 in nsViewManager::DispatchEvent (this=0x99191b0, aEvent=0x7fff5cc79630, aStatus=0x7fff5cc795c4) at nsViewManager.cpp:2246
#40 0x00002aaaab762c4f in HandleEvent (aEvent=0x7fff5cc79630) at nsView.cpp:171
#41 0x00002aaaac3f1e84 in nsCommonWidget::DispatchEvent (this=0x131d4bf0, aEvent=0x7fff5cc79630, aStatus=@0x7fff5cc79688) at nsCommonWidget.cpp:219
#42 0x00002aaaac3e0a2f in nsWindow::OnButtonReleaseEvent (this=0x131d4bf0, aWidget=0xdc54b70, aEvent=0x8c2780) at nsWindow.cpp:1600
#43 0x00002aaaac3e381e in button_release_event_cb (widget=0xdc54b70, event=0x8c2780) at nsWindow.cpp:3734
#44 0x0000003ece803e62 in gtk_marshal_VOID__UINT_STRING () from /usr/lib64/libgtk-x11-2.0.so.0
#45 0x0000003ecc60a27c in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#46 0x0000003ecc6172ea in g_signal_stop_emission () from /usr/lib64/libgobject-2.0.so.0
#47 0x0000003ecc61854b in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#48 0x0000003ecc618bc2 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#49 0x0000003ece8c84a8 in gtk_widget_activate () from /usr/lib64/libgtk-x11-2.0.so.0
#50 0x0000003ece8027b5 in gtk_propagate_event () from /usr/lib64/libgtk-x11-2.0.so.0
#51 0x0000003ece802bc4 in gtk_main_do_event () from /usr/lib64/libgtk-x11-2.0.so.0
#52 0x0000003ecf34010d in gdk_screen_get_setting () from /usr/lib64/libgdk-x11-2.0.so.0
#53 0x0000003ecc024a9e in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#54 0x0000003ecc027734 in g_main_context_check () from /usr/lib64/libglib-2.0.so.0
#55 0x0000003ecc027c20 in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
#56 0x0000003ece802145 in gtk_main () from /usr/lib64/libgtk-x11-2.0.so.0
#57 0x00002aaaac3ef4c6 in nsAppShell::Run (this=0x6e0390) at nsAppShell.cpp:139
#58 0x00002aaaac118fb4 in nsAppStartup::Run (this=0x6de290) at nsAppStartup.cpp:207
#59 0x000000000040b620 in main1 (argc=1, argv=0x7fff5cc7a328, nativeApp=0x5e1c80) at nsAppRunner.cpp:1249
#60 0x000000000040ba31 in main (argc=1, argv=0x7fff5cc7a328) at nsAppRunner.cpp:1736
(gdb) 


Reproducible: Sometimes

Steps to Reproduce:
1.Forward a large (~1500 lines) text email
2.Paste a list of email addresses into the To: box, like "[e-mail], [e-mail], [e-mail]" etc...
3.Thats it, this sometimes results in an infinite loop.

Comment 1

[Darryl Miles]

Have tested with SM 1.0.6 as distributed on Mozilla website.  Same problem.

The problem occurs as soon as I modify the message envelope info, liek the "From:" drop down, or any of the To: Cc: etc.. and press return, with one or more emails set.


I have a pretty decent box (3.2GHz) and after leaving it for 10 minutes it does not make any progress.  The loop in mozInlineSpellChecker::SpellCheckRange has the "end" variable set to the same value at the end of every iteration of extensions/spellcheck/src/mozInlineSpellChecker.cpp:944.

I can't find anyway to disable spell checking.  So I'm stuck with emails I can't forward with SeaMonkey.

Please regard this as "Reproducable: Always" dues to this I'm upping the severity.

Comment 2

[Andrew Schultz]

The bug should not exist in SeaMonkey 1.1 (not yet released) or recent 1.1 branch builds:

http://ftp.mozilla.org/pub/mozilla.org/seamonkey/nightly/latest-mozilla1.8/

*** This bug has been marked as a duplicate of 324521 ***