Last Comment Bug 663445 - [Java][SwiftKey] StringIndexOutOfBoundsException in String.substring() via GeckoInputConnection.getExtractedText
: [Java][SwiftKey] StringIndexOutOfBoundsException in String.substring() via Ge...
Status: VERIFIED FIXED
: crash, verified-aurora
Product: Fennec Graveyard
Classification: Graveyard
Component: General (show other bugs)
: Firefox 5
: ARM Android
: -- critical (vote)
: Firefox 6
Assigned To: Chris Lord [:cwiiis]
:
:
Mentors:
: 663457 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-10 10:32 PDT by Mark Finkle (:mfinkle) (use needinfo?)
Modified: 2011-09-01 09:44 PDT (History)
8 users (show)
See Also:
QA Whiteboard:
Iteration: ---
Points: ---


Attachments
Validate the values given to String::subSequence (842 bytes, patch)
2011-06-14 07:48 PDT, Chris Lord [:cwiiis]
mwu.code: review+
mark.finkle: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description Mark Finkle (:mfinkle) (use needinfo?) 2011-06-10 10:32:11 PDT
Crash Stacks:
v5.0Jun 9, 2011 2:52:13 PM 8 reports 
--------------------------------------------------------------------------------

java.lang.StringIndexOutOfBoundsException
at java.lang.String.substring(String.java:1579)
at java.lang.String.subSequence(String.java:2086)
at org.mozilla.gecko.GeckoInputConnection.getExtractedText(GeckoInputConnection.java:276)
at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:282)
at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:84)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:143)
at android.app.ActivityThread.main(ActivityThread.java:5073)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:521)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:858)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
at dalvik.system.NativeStart.main(Native Method)

--------------------------------------------------------------------------------

v5.0Jun 7, 2011 8:38:08 PM 5 reports 
--------------------------------------------------------------------------------

java.lang.StringIndexOutOfBoundsException
at java.lang.String.substring(String.java:1579)
at java.lang.String.subSequence(String.java:2086)
at org.mozilla.gecko.GeckoInputConnection.getExtractedText(GeckoInputConnection.java:276)
at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:234)
at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:73)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:143)
at android.app.ActivityThread.main(ActivityThread.java:4701)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:521)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:860)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:618)
at dalvik.system.NativeStart.main(Native Method)

--------------------------------------------------------------------------------

Jun 5, 2011 6:49:02 PM 3reports 
--------------------------------------------------------------------------------

java.lang.StringIndexOutOfBoundsException
at java.lang.String.substring(String.java:1579)
at java.lang.String.subSequence(String.java:2086)
at org.mozilla.gecko.GeckoInputConnection.getExtractedText(GeckoInputConnection.java:276)
at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:282)
at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:84)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:143)
at android.app.ActivityThread.main(ActivityThread.java:5068)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:521)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:858)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
at dalvik.system.NativeStart.main(Native Method)

--------------------------------------------------------------------------------

Jun 4, 2011 11:30:44 PM 2reports 
--------------------------------------------------------------------------------

java.lang.StringIndexOutOfBoundsException
at java.lang.String.substring(String.java:1579)
at java.lang.String.subSequence(String.java:2086)
at org.mozilla.gecko.GeckoInputConnection.getExtractedText(GeckoInputConnection.java:276)
at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:234)
at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:73)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:144)
at android.app.ActivityThread.main(ActivityThread.java:4937)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:521)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:868)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:626)
at dalvik.system.NativeStart.main(Native Method)

--------------------------------------------------------------------------------

May 25, 2011 4:04:04 PM 1reports 
--------------------------------------------------------------------------------

java.lang.StringIndexOutOfBoundsException
at java.lang.String.substring(String.java:1579)
at java.lang.String.subSequence(String.java:2086)
at org.mozilla.gecko.GeckoInputConnection.getExtractedText(GeckoInputConnection.java:276)
at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:244)
at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:77)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:123)
at android.app.ActivityThread.main(ActivityThread.java:4627)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:521)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:858)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
at dalvik.system.NativeStart.main(Native Method)


User Messages:

Jun 2, 2011 4:45:36 PM 5.0 crashed
May 29, 2011 8:19:22 AM 5.0 random force close
May 28, 2011 1:20:03 AM 5.0 cursor hops around and changes text.
May 21, 2011 2:49:22 AM 5.0 repeatedly crashing when I try to enter text into data fields
May 21, 2011 1:51:14 AM 5.0 force close on SwiftKey
May 21, 2011 1:41:35 AM5.0foreclosures on SwiftKey
Comment 1 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-10 13:04:50 PDT
Presumably we can avoid this by taking the subsequence from 0..Math.min(extract.text.length(), mCompositionStart) instead of 0..mCompositionStart as we do currently.
Comment 2 Chris Lord [:cwiiis] 2011-06-14 07:48:07 PDT
Created attachment 539203 [details] [diff] [review]
Validate the values given to String::subSequence

Patch that does as is suggested in comment #1 - I don't see any exceptions using SwiftKey with this patch applied.
Comment 3 Doug Turner (:dougt) 2011-06-16 12:00:06 PDT
*** Bug 663457 has been marked as a duplicate of this bug. ***
Comment 4 Doug Turner (:dougt) 2011-06-16 12:14:46 PDT
http://hg.mozilla.org/mozilla-central/rev/bbc683dcf952
Comment 5 Mark Finkle (:mfinkle) (use needinfo?) 2011-06-16 12:27:27 PDT
Comment on attachment 539203 [details] [diff] [review]
Validate the values given to String::subSequence

Android only fix. It fixes the top Android/Java crasher in Fennec 5. Getting it on Fennec 6 is a great idea.

Let it bake on nightly a few days before pushing
Comment 7 Naoki Hirata :nhirata (please use needinfo instead of cc) 2011-06-23 14:03:12 PDT
Can't seem to repro crash
Comment 8 Aaron Train [:aaronmt] 2011-06-30 10:55:06 PDT
(In reply to comment #4)
> http://hg.mozilla.org/mozilla-central/rev/bbc683dcf952

Verified Fixed
Mozilla/5.0 (Android; Linux armv7l; rv:7.0a1) Gecko/20110630 Firefox/7.0a1 Fennec/7.0a1

(In reply to comment #6)
> http://hg.mozilla.org/releases/mozilla-aurora/rev/9f1c1e3b1e9c

Verified Fixed
Mozilla/5.0 (Android; Linux armv7l; rv:6.0a2) Gecko/20110630 Firefox/6.0a2 Fennec/6.0a2

Note You need to log in before you can comment on or make changes to this bug.