39806 - Crash when I do File->Edit Page

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P3)

Description

[shrirang khanzode]

I see this on Linux build (2000051808)

Install and launch the browser
Select File->Edit Page
Observe that the browser crashes just when composer seems to come up.

Note: This does not happen 100 %. Trying it 4-5 times should show the problem

Comment 1

[rubydoo123]

can you point me to a url -- I would like to see the page(s) you are trying to 
edit

Comment 2

[shrirang khanzode]

I get a crash on www.hotmail.com

Comment 3

[shrirang khanzode]

Stack trace:


 Trigger Reason:  SIGSEGV: Segmentation Fault: (signal 11) 

 Call Stack:    (Signature = libwidget_gtk.so + 0x26459 (0x405c1459) f69fa6a7) 
     
   libwidget_gtk.so + 0x26459 (0x405c1459) 
                                                
     
   libwidget_gtk.so + 0x26451 (0x405c1451) 
                                                
     
   libwidget_gtk.so + 0x2894a (0x405c394a) 
                                                
     
   libjsdom.so + 0x380fe (0x403cf0fe) 
                                                
     
   libeditor.so + 0x72c91 (0x41372c91) 
                                                
     
   libeditor.so + 0x7e0ec (0x4137e0ec) 
                                                
     
   libraptorwebwidget.so + 0xe636 (0x4095a636) 
                                                
     
   liburiloader.so + 0x6c12 (0x40987c12) 
                                                
     
   liburiloader.so + 0x6a0a (0x40987a0a) 
                                                
     
   liburiloader.so + 0x691c (0x4098791c) 
                                                
     
   libnecko.so + 0x392fe (0x408c42fe) 
                                                
     
   libnecko.so + 0x62d12 (0x408edd12) 
                                                
     
   libnecko.so + 0x67a3c (0x408f2a3c) 
                                                
     
   libnecko.so + 0x2a8f2 (0x408b58f2) 
                                                
     
   libnecko.so + 0x2a360 (0x408b5360) 
                                                
     
   libxpcom.so + 0x6ff5b (0x400b0f5b) 
                                                
     
   libxpcom.so + 0x6fe96 (0x400b0e96) 
                                                
     
   libxpcom.so + 0x70b5d (0x400b1b5d) 
                                                
     
   libwidget_gtk.so + 0x1747f (0x405b247f) 
                                                
     
   libwidget_gtk.so + 0x1724d (0x405b224d) 
                                                
     
   libglib-1.2.so.0 + 0xe52a (0x4074a52a) 
                                                
     
   libglib-1.2.so.0 + 0xfbe6 (0x4074bbe6) 
                                                
     
   libglib-1.2.so.0 + 0x101a1 (0x4074c1a1) 
                                                
     
   libglib-1.2.so.0 + 0x10341 (0x4074c341) 
                                                
     
   libgtk-1.2.so.0 + 0x8c209 (0x40676209) 
                                                
     
   libwidget_gtk.so + 0x1795a (0x405b295a) 
                                                
     
   libnsappshell.so + 0x1557e (0x4037d57e) 
                                                
     
   mozilla-bin + 0x52e7 (0x0804d2e7) 
                                                
     
   mozilla-bin + 0x5705 (0x0804d705) 
                                                
     
   libc.so.6 + 0x181eb (0x4023d1eb) 
                                                

Comment 4

[Chris Siebenmann]

 The stack backtrace from a Linux CVS build from today:

(gdb) where
#0  0x405fbebd in nsWidget::IMESetFocusWidget ()
   from /f/scratch/mozilla/build/components/libwidget_gtk.so
#1  0x405fbf53 in nsWidget::IMESetFocusWidget ()
   from /f/scratch/mozilla/build/components/libwidget_gtk.so
#2  0x405fe6ec in nsWindow::SetFocus ()
   from /f/scratch/mozilla/build/components/libwidget_gtk.so
#3  0x403dd942 in GlobalWindowImpl::Focus ()
   from /f/scratch/mozilla/build/libjsdom.so
#4  0x4116d331 in nsEditorShell::PrepareDocumentForEditing ()
   from /f/scratch/mozilla/build/components/libeditor.so
#5  0x41178b6e in nsEditorShell::OnEndDocumentLoad ()
   from /f/scratch/mozilla/build/components/libeditor.so
#6  0x4099e7c8 in nsWebShell::OnEndDocumentLoad ()
   from /f/scratch/mozilla/build/libraptorwebwidget.so
#7  0x409cdd7d in nsDocLoaderImpl::FireOnEndDocumentLoad ()
   from /f/scratch/mozilla/build/components/liburiloader.so
#8  0x409cdb5b in nsDocLoaderImpl::DocLoaderIsEmpty ()
   from /f/scratch/mozilla/build/components/liburiloader.so
#9  0x409cda5f in nsDocLoaderImpl::OnStopRequest ()
   from /f/scratch/mozilla/build/components/liburiloader.so
#10 0x40905087 in nsLoadGroup::RemoveChannel ()
   from /f/scratch/mozilla/build/components/libnecko.so
#11 0x40930032 in nsHTTPChannel::ResponseCompleted ()
---Type <return> to continue, or q <return> to quit---
   from /f/scratch/mozilla/build/components/libnecko.so
#12 0x4093503b in nsHTTPServerListener::OnStopRequest ()
   from /f/scratch/mozilla/build/components/libnecko.so
#13 0x408f5b75 in nsOnStopRequestEvent::HandleEvent ()
   from /f/scratch/mozilla/build/components/libnecko.so
#14 0x408f5588 in nsStreamListenerEvent::HandlePLEvent ()
   from /f/scratch/mozilla/build/components/libnecko.so
#15 0x400b4ba6 in PL_HandleEvent () from /f/scratch/mozilla/build/libxpcom.so
#16 0x400b4ad6 in PL_ProcessPendingEvents ()
   from /f/scratch/mozilla/build/libxpcom.so
#17 0x400b588a in nsEventQueueImpl::ProcessPendingEvents ()
   from /f/scratch/mozilla/build/libxpcom.so
#18 0x405ec4be in event_processor_callback ()
   from /f/scratch/mozilla/build/components/libwidget_gtk.so
#19 0x405ec262 in our_gdk_io_invoke ()
   from /f/scratch/mozilla/build/components/libwidget_gtk.so
#20 0x4077f52a in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#21 0x40780be6 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#22 0x407811a1 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#23 0x40781341 in g_main_run () from /usr/lib/libglib-1.2.so.0
#24 0x406a8209 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#25 0x405ec9ad in nsAppShell::Run ()
   from /f/scratch/mozilla/build/components/libwidget_gtk.so
---Type <return> to continue, or q <return> to quit---
#26 0x4038a9cd in nsAppShellService::Run ()
   from /f/scratch/mozilla/build/components/libnsappshell.so
#27 0x804d357 in main1 ()
#28 0x804d7a6 in main ()
#29 0x402481eb in __libc_start_main (main=0x804d68c <main>, argc=2, 
    argv=0xbfffeb94, init=0x804a904 <_init>, fini=0x8050eb4 <_fini>, 
    rtld_fini=0x4000a610 <_dl_fini>, stack_end=0xbfffeb8c)
    at ../sysdeps/generic/libc-start.c:90

Comment 5

[rubydoo123]

this does not crash on win32 -- Sujay, can you please retest this using todays 
Linux build?

Comment 6

[sujay]

worksforme using 5/19 build...Shrirang, please try again...

Comment 7

[sujay]

ACtually, I see the crash now also...very easy to reproduce...
any web page it happens.using 5/19 build.

Comment 8

[leger]

Adding crash keyword

Comment 9

[sujay]

marking nsbeta2....blocker because you can't edit a page using composer.

still happening in 5/24 build.

Comment 10

[rubydoo123]

assigning this one to kin for the moment.

Comment 11

[rubydoo123]

assigning this to [e-mail] -- using cvs blame, they are the person who 
chedked in that code.

Comment 12

[leger]

Putting on [nsbeta2+][dogfood-] radar.  Does not need a fix ASAP for daily work, 
but we should fix this for beta2.  Isn't the workaround - you can save and then 
edit as a workaround for M16.

shrir or sujay, make sure this gets on the M16 Release Notes.

Comment 13

[Hidetoshi Tajima]

I'll look into the problem anyway, but I've not done any new check-in
around the code the core trace is referring to. I'm wondering if any
other code which has been checked-in recently may cause the conflict to the
codes. My local mozilla build which is two weeks old from the latest but has
the same IMESetFocusWidget codes does not have a problem to edit
www.hotmail.com.

Comment 14

[Masaki Katakai]

I'm seeing this problem on my built here that built
two days ago. It seems that a widget who has an IC
and the parent has mIMEChildWidget is already
destroyed, but try to activate the widget.
We should have checked and reset parent->mIMEChildWidget
at IMEDestroyIC(). I'll attach a patch. Please review.
If OK, Toshi, could you check in for me?

Comment 15

[Masaki Katakai]

Attachment: patch for widget/src/gtk/nsWidget.cpp

Comment 16

[Hidetoshi Tajima]

shrir or sujay, can either of you review the patch Masaki has attached?
Frank, will you please help them review as it it IME related code? I
hope I can hear you from tonight so that I can check in the patch for
tonight build.

Comment 17

[kinmoz]

I just tried the patch on Linux and it seems to fix the problem! The patch looks
good to me too.

Comment 18

[Hidetoshi Tajima]

I checked in the patch.

Comment 19

[sujay]

I can't verify this one because using 6/4 build, I can't even load a web page
from the URL bar...

Shrirang, can you please verify this if Monday/Tuesday build allows loading
a web page?

thanks!

Comment 20

[shrirang khanzode]

verif(2000060508)

Comment 21

[Daniel Veditz [:dveditz]]

Adding keyword to bugs which already show a nsbeta2 triage value in the status 
whiteboard so the queries don't get screwed up.