722039 - Crash in mozInlineSpellChecker::AddRange mainly while typing an email in Lotus Notes iWeb

Status: RESOLVED WORKSFORME

(Core :: Spelling checker, defect)

Description

[Scoobidiver (away)]

With this crash signature form, it first appeared in 10.0b6.
It seems the Windows version of bug 699770 that appeared in 9.0a2 on Mac OS X.

Amongst the 6 users that hit it so far, 83% has the Firefox Hotfix extension installed.
None of the users have an additional dictionary.

Signature 	nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext>() | nsWifiListener::`scalar deleting destructor''(unsigned int) More Reports Search
UUID	29b19056-b895-4610-99b2-610792120128
Date Processed	2012-01-28 04:45:08
Uptime	1640
Last Crash	27.6 minutes before submission
Install Age	21.8 hours since version was first installed.
Install Time	2012-01-27 06:54:58
Product	Firefox
Version	10.0
Build ID	20120123235200
Release Channel	beta
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x4
App Notes 	
AdapterVendorID: 8086, AdapterDeviceID: 2a42, AdapterSubsysID: 1484103c, AdapterDriverVersion: 8.15.10.2202
Has dual GPUs. GPU #2: AdapterVendorID2: 8086, AdapterDeviceID2: 2a43, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.15.10.2202D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext> 	obj-firefox/dist/include/nsAutoPtr.h:907
1 	xul.dll 	nsWifiListener::`scalar deleting destructor' 	
2 	xul.dll 	nsTArrayElementTraits<RangeData>::Destruct 	obj-firefox/dist/include/nsTArray.h:359
3 	xul.dll 	nsTArray<RangeData,nsTArrayDefaultAllocator>::DestructRange 	obj-firefox/dist/include/nsTArray.h:1202
4 	xul.dll 	nsTArray<RangeData,nsTArrayDefaultAllocator>::RemoveElementsAt 	obj-firefox/dist/include/nsTArray.h:932
5 	xul.dll 	nsTypedSelection::AddItem 	
6 	xul.dll 	nsTypedSelection::addTableCellRange 	layout/generic/nsSelection.cpp:3159
7 	xul.dll 	nsTypedSelection::AddRange 	layout/generic/nsSelection.cpp:4773
8 	xul.dll 	nsTypedSelection::AddRange 	layout/generic/nsSelection.cpp:4756
9 	xul.dll 	mozInlineSpellChecker::AddRange 	extensions/spellcheck/src/mozInlineSpellChecker.cpp:1629
10 	xul.dll 	mozInlineSpellChecker::DoSpellCheck 	extensions/spellcheck/src/mozInlineSpellChecker.cpp:1427

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsRefPtr%3CnsPresContext%3E%3A%3A~nsRefPtr%3CnsPresContext%3E%28%29%20|%20nsWifiListener%3A%3A%60scalar%20deleting%20destructor%27%27%28unsigned%20int%29

Comment 3

[Marcia Knous [:marcia]]

https://crash-stats.mozilla.com/report/list?signature=nsCOMPtr_base::~nsCOMPtr_base%28%29%20|%20nsCOMPtr%3CnsISupports%3E::%60scalar%20deleting%20destructor%27%27%28unsigned%20int%29%20|%20nsTArrayElementTraits%3CnsCOMPtr%3CnsIObserver%3E%20%3E::Destruct%28nsCOMPtr%3CnsIObserver%3E*%29 seems to be the manifestation of this in 10.0.2.

Comment 5

[Marcia Knous [:marcia]]

Many of the comments reference Lotus-Notes (INotes).

Comment 6

[Scoobidiver (away)]

Lotus Notes is used by many big enterprises.

Comment 7

[Alex Keybl [:akeybl]]

Let's let enterprises qualifying the release let us know if specific stability bugs are crucial to their operations.

Comment 9

[Mats Palmgren (inactive)]

Shaun, does the crash also occur if you disable spell checking before sending
the mail in Lotus Notes?  (uncheck the "Check Spelling" checkbox in the context menu
on the text area before sending)

Comment 10

[Shaun Storey]

Hello Mats,

I've disabled the spell check on send email and used it for 2 days now and it has not crashed so I 99% sure you have nailed it. Is there a simple fix or workaround as this is obviously a useful feature.....many thanks Shaun

Comment 11

[Mats Palmgren (inactive)]

Shaun, thanks for testing, that's very helpful.  Let me know if you can reproduce
the crash after you update to Firefox 11.

Comment 12

[Mats Palmgren (inactive)]

This is probably easy to fix once we can reproduce it...
Do we have access to a test installation of "IBM Lotus Notes iWeb" by any chance?

Comment 13

[Mats Palmgren (inactive)]

(In reply to Scoobidiver from comment #0)
> Amongst the 6 users that hit it so far, 83% has the Firefox Hotfix extension

What is "Firefox Hotfix extension"?

Comment 14

[Shaun Storey]

Hello Mats, yes it was happening in FF11 I was already updated to that as soon as it was out. I'm sorry but we don't have a test installation at all never mind a public one.

Comment 15

[Mats Palmgren (inactive)]

Shaun, can you run a Fx11 debug build from a terminal window and attach the debug output when the crash occurs?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-03-23-mozilla-release-debug/

Comment 16

[Ryan VanderMeulen [:RyanVM]]

(In reply to Mats Palmgren [:mats] from comment #13)
> (In reply to Scoobidiver from comment #0)
> > Amongst the 6 users that hit it so far, 83% has the Firefox Hotfix extension
> 
> What is "Firefox Hotfix extension"?

https://wiki.mozilla.org/Features/Desktop/Add-on_hotfix

Comment 17

[Mats Palmgren (inactive)]

Shaun, can you run a Fx11 debug build from a terminal window and attach the debug output when the crash occurs?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-03-23-mozilla-release-debug/

Comment 18

[u279076]

Any update on this bug? It's been a few months.

Comment 19

[Eric Shepherd [:sheppy]]

IIRC this is the same bug I did some debugging with ehsan on a while back. We figured out there's a significant bug in the code that finds the start and end of a range under certain circumstances, resulting in basically all of memory being considered part of the range (because the start point was after the end point). He was going to look into it further when he had time, but I don't know where it went from there.

That's bug 759858.

Comment 20

[u279076]

(In reply to Eric Shepherd [:sheppy] from comment #19) 
> That's bug 759858.

So is this dupe of or depends on bug 759858? and is there anything QA can do to help move this forward?

Comment 21

[Eric Shepherd [:sheppy]]

OK, in 759858, ehsan said he doesn't think this is a dupe, although possibly related.

Comment 22

[u279076]

Okay, adding to See Also for now. I'm not seeing anything specific QA can action in this bug so removing qawanted. Please re-add if there's some way we can help.

Comment 23

[(no longer active)]

(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #20)
> (In reply to Eric Shepherd [:sheppy] from comment #19) 
> > That's bug 759858.
> 
> So is this dupe of or depends on bug 759858? and is there anything QA can do
> to help move this forward?

Reliable STRs would be nice!

Comment 24

[u279076]

(In reply to Ehsan Akhgari [:ehsan] from comment #23)
> Reliable STRs would be nice!

We would need access to an installation of Lotus iNotes to even begin testing:
http://www-01.ibm.com/software/lotus/products/inotes/

It does not appear to be freely available. Does anyone know of a public version we can use for testing?

Comment 25

[u279076]

Alternatively, can you do some outreach to users reporting these crashes?

Comment 26

[u279076]

Removing qawanted on this bug until some pending outreach is complete.

Comment 28

[Mats Palmgren (inactive)]

From bug 722679 comment 0:
>This crash occurred when I hit Cmd-I to italicize text in the CKEditor on devmo while >editing documentation this morning. Current beta build.

Comment 29

[u279076]

Checking the query from the last month for this signature there are only 10 crashes, all of which are on unsupported Firefox 10 or 11 Beta builds. I might be looking at the wrong data though. Can someone please confirm?

Comment 30

[Scoobidiver (away)]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #29)
> Checking the query from the last month for this signature
Which signature? There are at least five ones.

Comment 31

[u279076]

(In reply to Scoobidiver from comment #30)
> (In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #29)
> > Checking the query from the last month for this signature
>
> Which signature? There are at least five ones.

Based on the "More reports at" URL in comment 0.

Comment 32

[Ciprian Muresan [:cmuresan], Ecosystem QA]

Considering that these signatures have been encountered on a Firefox version 10 and ESR 10. I will mark this issue as Resolved-WORKSFORME. If you still encounter this crash, feel free to reopen this issue.