529232 - Firefox 3.6b2 Crash [@ nsIMEStateManager::OnTextStateFocus(nsPresContext*, nsIContent*) ]

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[chris hofmann]

A new crash started showing up as the #4 top regression in Firefox beta2 that we haven't seen before.

http://people.mozilla.com/~chofmann/crash-data/new-crashes/new-in-3.6b2-from-35x+36b1.html

we are still trying to validate some of the work in that analysis report but here is what we have so far in this crash.

stack looks like

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	nsIMEStateManager::OnTextStateFocus 	content/events/src/nsIMEStateManager.cpp:503
1 	xul.dll 	xul.dll@0x3f40bd 	
2 	xul.dll 	nsFocusManager::WindowRaised 	dom/base/nsFocusManager.cpp:676
3 	xul.dll 	nsWebShellWindow::HandleEvent 	xpfe/appshell/src/nsWebShellWindow.cpp:416
4 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:2890
5 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:2918
6 	xul.dll 	nsWindow::DispatchFocus 	widget/src/windows/nsWindow.cpp:3388
7 	xul.dll 	nsWindow::ProcessMessage 	widget/src/windows/nsWindow.cpp:4157
8 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:3506
9 	user32.dll 	InternalCallWinProc 	
10 	user32.dll 	UserCallWinProcCheckWow 	
11 	user32.dll 	DispatchClientMessage 	
12 	user32.dll 	__fnDWORD 	
13 	ntdll.dll 	KiUserCallbackDispatcher 	
14 	xul.dll 	nsAttrAndChildArray::~nsAttrAndChildArray 	
15 	user32.dll 	RealDefWindowProcW 	
16 	user32.dll 	DefWindowProcW 	
17 	user32.dll 	InternalCallWinProc 	
18 	user32.dll 	UserCallWinProcCheckWow 	
19 	user32.dll 	CallWindowProcAorW 	
20 	user32.dll 	CallWindowProcW 	
21 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:3512
22 	user32.dll 	InternalCallWinProc 	
23 	user32.dll 	UserCallWinProcCheckWow 	
24 	user32.dll 	DispatchClientMessage 	
25 	user32.dll 	__fnDWORD 	
26 	ntdll.dll 	KiUserCallbackDispatcher 	
27 	xul.dll 	nsAttrAndChildArray::~nsAttrAndChildArray 	
28 	xul.dll 	nsFocusManager::SetFocusInner 	dom/base/nsFocusManager.cpp:1112
29 	xul.dll 	nsFocusManager::SetFocus 	dom/base/nsFocusManager.cpp:411
30 	xul.dll 	nsGlobalWindow::Focus 	dom/base/nsGlobalWindow.cpp:4345
31 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
32 	xul.dll 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2721
33 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740
34 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1360
35 	js3250.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:1423
36 	js3250.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5098
37 	xul.dll 	XPC_NW_FunctionWrapper 	js/src/xpconnect/src/XPCNativeWrapper.cpp:531
38 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1360
39 	js3250.dll 	js_Interpret 	js/src/jsops.cpp:2240
40 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1368
41 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1671
42 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:570
43 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
44 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
45 	xul.dll 	nsPrintProgress::OnStateChange 	embedding/components/printingui/src/win/nsPrintProgress.cpp:251

only user comment I saw so far was in
http://crash-stats.mozilla.com/report/index/137eca5a-746b-4c1f-82a8-f9a562091114

Reselecting a different printer to print a document when the error occored on mozilla firefox. also is there a way to have firefox place an icon on my desktop instead of bookmarking it . Thank you.

other reports listed at
http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.6b2&query_search=signature&query_type=exact&date=&range_value=1&range_unit=weeks&do_query=1&signature=nsIMEStateManager%3A%3AOnTextStateFocus%28nsPresContext*%2C%20nsIContent*%29

source at the top of the stack looks like it was changed last spring during the 3.6 development cycle.

http://hg.mozilla.org/releases/mozilla-1.9.2/annotate/03f9782c86df/content/events/src/nsIMEStateManager.cpp#l503

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch v1.0

nsIViewManager::GetRootWidget sometimes returns null even if the result is NS_OK. Looks like there are no widgets at that time, so, we just return NS_OK at that thime.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

http://hg.mozilla.org/mozilla-central/rev/8eabb8863ad6

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 412796 [details] [diff] [review]
Patch v1.0

Let's land this. Chris said that this is in top crashes. And this patch shouldn't be risky.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

beltzner?

Comment 5

[chris hofmann]

to clearify, this is a top crash produced out of jst's regression finder tools.  didn't appear in 3.5.x but started showing up in 3.6b2.   where these crashes would actually appear in the top crash or long tail lists when millions of users started using 3.6 is a bit difficult to predict right now, but it this is low risk we should take it.

signature seems to appear on windows and linux. changing os

damon might also be able to approve landing

Comment 7

[timeless]

for people's reference, this bug was mislanded with commit message:
Bug 529282 Firefox 3.6b2 Crash [@ nsIMEStateManager::OnTextStateFocus(nsPresContext*, nsIContent*) ] r=roc 

the bug number referenced in that commit message is an infrabug, not remotely interesting, but unfortunately entirely wrong.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Lets get this on 1.9.2 ASAP

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/35d94b56fdb4