79807 - purify FMR (free-mem-read) of IME widget

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[kill this account]

I get this purify message after finishing creating a new profile.

  FMR: Free memory read
  This is occurring while in:
    nsWidget*nsIMEGtkIC::GetFocusWidget() [nsGtkIMEHelper.cpp]
    void nsWidget::IMEDestroyIC() [nsWidget.cpp]
    void nsWindow::DestroyNative() [nsWindow.cpp]
    unsigned nsWidget::Destroy() [nsWidget.cpp]
    unsigned nsWindow::Destroy() [nsWindow.cpp]
    void nsWindow::DestroyNativeChildren() [nsWindow.cpp]
    void nsWindow::DestroyNative() [nsWindow.cpp]
    unsigned nsWidget::Destroy() [nsWidget.cpp]
    unsigned nsWindow::Destroy() [nsWindow.cpp]
    void nsWindow::DestroyNativeChildren() [nsWindow.cpp]
  Reading 4 bytes from 0x882bb4 in the heap.
  Address 0x882bb4 is 4 bytes into a freed  block at 0x882bb0 of 24 bytes.
  This block was allocated from:
    malloc         [rtlib.o]
    c2n6Fi_Pv___1  [libCrun.so.1]
    void*operator new(unsigned) [rtlib.o]
    nsIMEGtkIC*nsIMEGtkIC::GetXIC(nsWidget*,_GdkFont*,_GdkFont*)
[nsGtkIMEHelper.cpp]
    void nsWidget::GetXIC() [nsWidget.cpp]
    void nsWidget::IMESetFocusWidget() [nsWidget.cpp]
    unsigned nsWindow::SetFocus(int) [nsWindow.cpp]
    unsigned GlobalWindowImpl::Focus() [nsGlobalWindow.cpp]
    nsEventStatus nsWebShellWindow::HandleEvent(nsGUIEvent*)
[nsWebShellWindow.cpp]
    unsigned nsWidget::DispatchEvent(nsGUIEvent*,nsEventStatus&) [nsWidget.cpp]
  There have been 6 frees since this block was freed from:
    free           [rtlib.o]
    c2k6FPv_v___1  [libCrun.so.1]
    void operator delete(void*) [rtlib.o]
    void nsWidget::IMEDestroyIC() [nsWidget.cpp]
    void nsWindow::DestroyNative() [nsWindow.cpp]
    unsigned nsWidget::Destroy() [nsWidget.cpp]
    unsigned nsWindow::Destroy() [nsWindow.cpp]
    nsWindow::~nsWindow() [nsWindow.cpp]
    __SLIP.DELETER__A [nsWindow.cpp]
    unsigned nsBaseWidget::Release() [nsBaseWidget.cpp]

Comment 1

[Masaki Katakai]

Could you assign to me? I'm now building Mozilla and trying to run with purify.
Thanks.

Comment 2

[Hidetoshi Tajima]

reassign this to katakai. He will have mozilla build with purify for this bug.

Comment 3

[Masaki Katakai]

I haven't succeeded to run Purify on my environment.
Purify 5.3 isn't available yet on my site.

For this problem, I believe the order of destroying
IC is not correct, which was already reported in bug 53989.
In DestroyNative(),IMEDestroyIC() should be called *after*
DestroNativeChildren().

/* virtual */
void
nsWindow::DestroyNative(void)
{

#ifdef USE_XIM
IMEDestroyIC();
#endif // USE_XIM

  // destroy all of the children that are nsWindow() classes
  // preempting the gdk destroy system.
  DestroyNativeChildren();

I'll commit the patch for the problem soon, then will ask you
to run Purify again.

Comment 4

[Masaki Katakai]

patch for bug 53989 has been checked in. Please try if you have a chance, and
if you still see the problem, please re-open this bugreport. Thank you.

Comment 5

[Jon Rubin]

qa --> bstell