Closed Bug 722039 Opened 8 years ago Closed 4 years ago

Crash in mozInlineSpellChecker::AddRange mainly while typing an email in Lotus Notes iWeb

Categories

(Core :: Spelling checker, defect, critical)

10 Branch
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox10 --- wontfix
firefox-esr10 - wontfix

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, testcase-wanted, Whiteboard: [needs STR])

Crash Data

With this crash signature form, it first appeared in 10.0b6.
It seems the Windows version of bug 699770 that appeared in 9.0a2 on Mac OS X.

Amongst the 6 users that hit it so far, 83% has the Firefox Hotfix extension installed.
None of the users have an additional dictionary.

Signature 	nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext>() | nsWifiListener::`scalar deleting destructor''(unsigned int) More Reports Search
UUID	29b19056-b895-4610-99b2-610792120128
Date Processed	2012-01-28 04:45:08
Uptime	1640
Last Crash	27.6 minutes before submission
Install Age	21.8 hours since version was first installed.
Install Time	2012-01-27 06:54:58
Product	Firefox
Version	10.0
Build ID	20120123235200
Release Channel	beta
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x4
App Notes 	
AdapterVendorID: 8086, AdapterDeviceID: 2a42, AdapterSubsysID: 1484103c, AdapterDriverVersion: 8.15.10.2202
Has dual GPUs. GPU #2: AdapterVendorID2: 8086, AdapterDeviceID2: 2a43, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.15.10.2202D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext> 	obj-firefox/dist/include/nsAutoPtr.h:907
1 	xul.dll 	nsWifiListener::`scalar deleting destructor' 	
2 	xul.dll 	nsTArrayElementTraits<RangeData>::Destruct 	obj-firefox/dist/include/nsTArray.h:359
3 	xul.dll 	nsTArray<RangeData,nsTArrayDefaultAllocator>::DestructRange 	obj-firefox/dist/include/nsTArray.h:1202
4 	xul.dll 	nsTArray<RangeData,nsTArrayDefaultAllocator>::RemoveElementsAt 	obj-firefox/dist/include/nsTArray.h:932
5 	xul.dll 	nsTypedSelection::AddItem 	
6 	xul.dll 	nsTypedSelection::addTableCellRange 	layout/generic/nsSelection.cpp:3159
7 	xul.dll 	nsTypedSelection::AddRange 	layout/generic/nsSelection.cpp:4773
8 	xul.dll 	nsTypedSelection::AddRange 	layout/generic/nsSelection.cpp:4756
9 	xul.dll 	mozInlineSpellChecker::AddRange 	extensions/spellcheck/src/mozInlineSpellChecker.cpp:1629
10 	xul.dll 	mozInlineSpellChecker::DoSpellCheck 	extensions/spellcheck/src/mozInlineSpellChecker.cpp:1427

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsRefPtr%3CnsPresContext%3E%3A%3A~nsRefPtr%3CnsPresContext%3E%28%29%20|%20nsWifiListener%3A%3A%60scalar%20deleting%20destructor%27%27%28unsigned%20int%29
Crash Signature: [@ nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext>() | nsWifiListener::`scalar deleting destructor''(unsigned int)] → [@ nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext>() | nsWifiListener::`scalar deleting destructor''(unsigned int)] [@ nsCOMPtr_base::~nsCOMPtr_base | nsTypedSelection::AddItem]
OS: Windows 7 → All
Hardware: x86 → All
Duplicate of this bug: 722679
Crash Signature: [@ nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext>() | nsWifiListener::`scalar deleting destructor''(unsigned int)] [@ nsCOMPtr_base::~nsCOMPtr_base | nsTypedSelection::AddItem] → [@ nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext>() | nsWifiListener::`scalar deleting destructor''(unsigned int)] [@ nsCOMPtr_base::~nsCOMPtr_base | nsTypedSelection::AddItem] [@ nsRefPtr<nsIDOMEventListener>::~nsRefPtr<nsIDOMEventListener>() | nsCO…
Duplicate of this bug: 723829
https://crash-stats.mozilla.com/report/list?signature=nsCOMPtr_base::~nsCOMPtr_base%28%29%20|%20nsCOMPtr%3CnsISupports%3E::%60scalar%20deleting%20destructor%27%27%28unsigned%20int%29%20|%20nsTArrayElementTraits%3CnsCOMPtr%3CnsIObserver%3E%20%3E::Destruct%28nsCOMPtr%3CnsIObserver%3E*%29 seems to be the manifestation of this in 10.0.2.
Crash Signature: nsCOMPtr<nsIRDFNode>::`scalar deleting destructor''(unsigned int) | nsTArrayElementTraits<nsCOMPtr<nsIDOMBlob> >::Destruct(nsCOMPtr<nsIDOMBlob>*)] → nsCOMPtr<nsIRDFNode>::`scalar deleting destructor''(unsigned int) | nsTArrayElementTraits<nsCOMPtr<nsIDOMBlob> >::Destruct(nsCOMPtr<nsIDOMBlob>*)] [@ nsCOMPtr_base::~nsCOMPtr_base() | nsCOMPtr<nsISupports>::`scalar deleting destructor''(unsigned int) | n…
Duplicate of this bug: 699770
Keywords: testcase-wanted
Whiteboard: [needs STR]
Keywords: qawanted
Many of the comments reference Lotus-Notes (INotes).
Lotus Notes is used by many big enterprises.
Summary: Crash in mozInlineSpellChecker::AddRange → Crash in mozInlineSpellChecker::AddRange mainly while typing an email in Lotus Notes
Let's let enterprises qualifying the release let us know if specific stability bugs are crucial to their operations.
Duplicate of this bug: 725641
Shaun, does the crash also occur if you disable spell checking before sending
the mail in Lotus Notes?  (uncheck the "Check Spelling" checkbox in the context menu
on the text area before sending)
Summary: Crash in mozInlineSpellChecker::AddRange mainly while typing an email in Lotus Notes → Crash in mozInlineSpellChecker::AddRange mainly while typing an email in Lotus Notes iWeb
Hello Mats,

I've disabled the spell check on send email and used it for 2 days now and it has not crashed so I 99% sure you have nailed it. Is there a simple fix or workaround as this is obviously a useful feature.....many thanks Shaun
Shaun, thanks for testing, that's very helpful.  Let me know if you can reproduce
the crash after you update to Firefox 11.
This is probably easy to fix once we can reproduce it...
Do we have access to a test installation of "IBM Lotus Notes iWeb" by any chance?
(In reply to Scoobidiver from comment #0)
> Amongst the 6 users that hit it so far, 83% has the Firefox Hotfix extension

What is "Firefox Hotfix extension"?
Hello Mats, yes it was happening in FF11 I was already updated to that as soon as it was out. I'm sorry but we don't have a test installation at all never mind a public one.
Shaun, can you run a Fx11 debug build from a terminal window and attach the debug output when the crash occurs?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-03-23-mozilla-release-debug/
(In reply to Mats Palmgren [:mats] from comment #13)
> (In reply to Scoobidiver from comment #0)
> > Amongst the 6 users that hit it so far, 83% has the Firefox Hotfix extension
> 
> What is "Firefox Hotfix extension"?

https://wiki.mozilla.org/Features/Desktop/Add-on_hotfix
Shaun, can you run a Fx11 debug build from a terminal window and attach the debug output when the crash occurs?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-03-23-mozilla-release-debug/
Any update on this bug? It's been a few months.
IIRC this is the same bug I did some debugging with ehsan on a while back. We figured out there's a significant bug in the code that finds the start and end of a range under certain circumstances, resulting in basically all of memory being considered part of the range (because the start point was after the end point). He was going to look into it further when he had time, but I don't know where it went from there.

That's bug 759858.
(In reply to Eric Shepherd [:sheppy] from comment #19) 
> That's bug 759858.

So is this dupe of or depends on bug 759858? and is there anything QA can do to help move this forward?
OK, in 759858, ehsan said he doesn't think this is a dupe, although possibly related.
Okay, adding to See Also for now. I'm not seeing anything specific QA can action in this bug so removing qawanted. Please re-add if there's some way we can help.
Keywords: qawanted
See Also: → 759858
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #20)
> (In reply to Eric Shepherd [:sheppy] from comment #19) 
> > That's bug 759858.
> 
> So is this dupe of or depends on bug 759858? and is there anything QA can do
> to help move this forward?

Reliable STRs would be nice!
Keywords: qawanted
(In reply to Ehsan Akhgari [:ehsan] from comment #23)
> Reliable STRs would be nice!

We would need access to an installation of Lotus iNotes to even begin testing:
http://www-01.ibm.com/software/lotus/products/inotes/

It does not appear to be freely available. Does anyone know of a public version we can use for testing?
Alternatively, can you do some outreach to users reporting these crashes?
Removing qawanted on this bug until some pending outreach is complete.
Keywords: qawanted
Crash Signature: nsTArrayElementTraits<nsCOMPtr<nsIObserver> >::Destruct(nsCOMPtr<nsIObserver>*) ] → nsTArrayElementTraits<nsCOMPtr<nsIObserver> >::Destruct(nsCOMPtr<nsIObserver>*) ] [@ nsRefPtr<mozilla::places::Database>::~nsRefPtr<mozilla::places::Database>() | RangeData::`scalar deleting destructor''(unsigned int) ]
Duplicate of this bug: 774856
Blocks: 759858
From bug 722679 comment 0:
>This crash occurred when I hit Cmd-I to italicize text in the CKEditor on devmo while >editing documentation this morning. Current beta build.
Checking the query from the last month for this signature there are only 10 crashes, all of which are on unsupported Firefox 10 or 11 Beta builds. I might be looking at the wrong data though. Can someone please confirm?
(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #29)
> Checking the query from the last month for this signature
Which signature? There are at least five ones.
(In reply to Scoobidiver from comment #30)
> (In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #29)
> > Checking the query from the last month for this signature
>
> Which signature? There are at least five ones.

Based on the "More reports at" URL in comment 0.
Crash Signature: nsTArrayElementTraits<nsCOMPtr<nsIObserver> >::Destruct(nsCOMPtr<nsIObserver>*) ] [@ nsRefPtr<mozilla::places::Database>::~nsRefPtr<mozilla::places::Database>() | RangeData::`scalar deleting destructor''(unsigned int) ] → nsTArrayElementTraits<nsCOMPtr<nsIObserver> >::Destruct(nsCOMPtr<nsIObserver>*) ] [@ nsRefPtr<mozilla::places::Database>::~nsRefPtr<mozilla::places::Database>() | RangeData::`scalar deleting destructor''(unsigned int) ] [@ nsRefPtr<T>::~nsRefPtr<T> | n…
Considering that these signatures have been encountered on a Firefox version 10 and ESR 10. I will mark this issue as Resolved-WORKSFORME. If you still encounter this crash, feel free to reopen this issue.
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.