438772 - crash when using East Asian Input Method [@ CalcCharacterPositionAtoW+0x16 ]

Status: RESOLVED DUPLICATE of bug 424663

(Core :: Widget: Win32, defect)

Description

[Ma]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/Firefox/3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0

i using 2 chinese input methods on my computer, let's call them IM-A and IM-B.

1.use IM-A input some chinese characters
2.shift to IM-B
3.when i press any letter key, then crash: ILLEGAL OPERATION

the matter happened both web page and other input area in firefox.

the crash only happened in firefox 3.0, including b5/rc1/rc2 and maybe previous versions. firefox 2.0 is ok.

IM-A is 精品五笔
IM-B is 智能拼音ABC

Reproducible: Always

Steps to Reproduce:
1.use IM-A input some chinese characters
2.shift to IM-B
3.when i press any letter key, then crash: ILLEGAL OPERATION

IM-A is 精品五笔
IM-B is 智能拼音ABC
Actual Results:  
crash: ILLEGAL OPERATION

Expected Results:  
no crash

contact me if you need.

thanks for you great job.

Comment 1

[Ma]

Attachment: i made 4 pictures to explain it

view the pictures one by one, then you can know the matter.

Comment 2

[timeless]

http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

Comment 3

[Ma]

BuildID:2008061904, firefox 3.0.1pre
is this enough?

0:000> kp
ChildEBP RetAddr  
0012f82c 763053d2 IMM32!CalcCharacterPositionAtoW+0x16
0012f854 763054ef IMM32!InternalGetCompositionStringW+0x4ff
0012f884 6095bf28 IMM32!ImmGetCompositionStringW+0x65
0012f8c4 6077ad36 xul!nsWindow::OnIMEComposition(long aGCS = 447)+0x144 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nswindow.cpp @ 6884]
0012fa8c 60527513 xul!nsWindow::ProcessMessage+0x239516
0012fac8 77d18734 xul!nsWindow::WindowProc(struct HWND__ * hWnd = <Memory access error>, unsigned int msg = <Memory access error>, unsigned int wParam = <Memory access error>, long lParam = <Memory access error>)+0xd3 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nswindow.cpp @ 1200]
0012faf4 77d18816 USER32!InternalCallWinProc+0x28
0012fb5c 77d189cd USER32!UserCallWinProcCheckWow+0x150
0012fbbc 77d18a10 USER32!DispatchMessageWorker+0x306
0012fbcc 6052061e USER32!DispatchMessageW+0xf
0012fc30 600bf2da xul!nsAppShell::ProcessNextNativeEvent(int mayWait = 1624197272)+0xae [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsappshell.cpp @ 148]
0012fc38 60501a4a nspr4!PR_IntervalNow(void)+0x1a [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\nsprpub\pr\src\misc\prinrval.c @ 78]
0012fc58 605006fc xul!nsBaseAppShell::OnProcessNextEvent(class nsIThreadInternal * thr = <Memory access error>, int mayWait = <Memory access error>, unsigned int recursionDepth = <Memory access error>)+0x24a [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\xpwidgets\nsbaseappshell.cpp @ 296]
0012fc88 6051ec8a xul!nsThread::ProcessNextEvent(int mayWait = <Memory access error>, int * result = <Memory access error>)+0x15c [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\threads\nsthread.cpp @ 501]
0012fca0 60642f42 xul!nsBaseAppShell::Run(void)+0x4a [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\xpwidgets\nsbaseappshell.cpp @ 169]
0012fcac 60581a2e xul!nsAppStartup::Run(void)+0x1e [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\toolkit\components\startup\src\nsappstartup.cpp @ 182]
0012fcb4 003200a8 xul!XRE_main(int argc = 0, char ** argv = 0x03cd6810, struct nsXREAppData * aAppData = 0x60c80884)+0xdba [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\toolkit\xre\nsapprunner.cpp @ 3174]
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fcb8 00000000 0x3200a8

Comment 4

[timeless]

does this happen if you switch between Chinese input methods and Japanese or something else? if not, please indicate the actual input methods...

.frame 3
dv

might be helpful, but i suspect we're going to need to find someone who really understands the ms side of this....

Comment 5

[Ma]

IM-A is called 精品五笔, the producer is a person, IM-A is not very popular.
IM-B is called 智能拼音ABC, the producer is microsoft.

so i doubt: 
1.there are some non-normative codes in IM-A
2.some un-robust codes in firefox.

i sent a mail to IM-A last week, but he didn't reply me yet.
it seems that i should abandon IM-A.

thank you for you great work.