905066 - crash in nsTextStore::RequestLock

Status: RESOLVED INVALID

(Core :: Widget: Win32, defect)

Description

[Scoobidiver (away)]

It first showed up in 22.0a1/20130320.

Signature 	CRange::Release() More Reports Search
UUID 	6bd40128-4dba-4324-8023-b842a2130813
Date Processed	2013-08-13 19:32:31.560619
Uptime	4581
Last Crash	519782 seconds before submission
Install Age 	4581 since version was first installed.
Install Time 	2013-08-13 18:15:53
Product 	MetroFirefox
Version 	26.0a1
Build ID 	20130813030205
Release Channel 	nightly
OS 	Windows NT
OS Version 	6.2.9200
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 58 stepping 9 | 4
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 	0x8
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0166, AdapterSubsysID: 01661414, AdapterDriverVersion: 9.17.10.3062
D2D? D2D+ DWrite? DWrite+ 

Frame 	Module 	Signature 	Source
0 	msctf.dll 	CRange::Release() 	
1 	msctf.dll 	[thunk]:CThreadInputMgr::Release`adjustor{12}' () 	
2 	xul.dll 	nsTextStore::RequestLock(unsigned long,long *) 	widget/windows/nsTextStore.cpp
3 	msctf.dll 	CicBridge::Notify(TLS *,ITfThreadMgr_P *,HIMC__ *,unsigned long,unsigned long,unsigned long) 	
4 	xul.dll 	nsTextStore::OnSelectionChangeInternal() 	widget/windows/nsTextStore.cpp
5 	xul.dll 	MetroWidget::NotifyIME(mozilla::widget::NotificationToIME) 	widget/windows/winrt/MetroWidget.cpp
6 	xul.dll 	SelectionChangeEvent::Run() 	content/events/src/nsIMEStateManager.cpp
7 	xul.dll 	nsContentUtils::AddScriptRunner(nsIRunnable *) 	content/base/src/nsContentUtils.cpp
8 	xul.dll 	nsTextStateManager::NotifySelectionChanged(nsIDOMDocument *,nsISelection *,short) 	content/events/src/nsIMEStateManager.cpp
9 	xul.dll 	mozilla::Selection::NotifySelectionListeners() 	layout/generic/nsSelection.cpp
10 	xul.dll 	mozilla::Selection::EndBatchChanges() 	layout/generic/nsSelection.cpp
11 	xul.dll 	nsEditor::EndUpdateViewBatch() 	editor/libeditor/base/nsEditor.cpp
12 	xul.dll 	nsEditor::EndPlaceHolderTransaction() 	editor/libeditor/base/nsEditor.cpp
13 	xul.dll 	nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch() 	editor/libeditor/base/nsEditorUtils.h
14 	xul.dll 	nsPlaintextEditor::TypedText(nsAString_internal const &,nsPlaintextEditor::ETypingAction) 	editor/libeditor/text/nsPlaintextEditor.cpp
15 	xul.dll 	nsPlaintextEditor::HandleKeyPressEvent(nsIDOMKeyEvent *) 	editor/libeditor/text/nsPlaintextEditor.cpp
16 	xul.dll 	nsEditorEventListener::KeyPress(nsIDOMEvent *) 	editor/libeditor/base/nsEditorEventListener.cpp
17 	xul.dll 	nsEditorEventListener::HandleEvent(nsIDOMEvent *) 	editor/libeditor/base/nsEditorEventListener.cpp
18 	xul.dll 	nsEventListenerManager::HandleEventSubType(nsListenerStruct *,mozilla::dom::CallbackObjectHolder<mozilla::dom::EventListener,nsIDOMEventListener> const &,nsIDOMEvent *,mozilla::dom::EventTarget *,nsCxPusher *) 	content/events/src/nsEventListenerManager.cpp
19 	xul.dll 	nsEventListenerManager::HandleEventInternal(nsPresContext *,nsEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *,nsCxPusher *) 	content/events/src/nsEventListenerManager.cpp
20 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor &,nsDispatchingCallback *,ELMCreationDetector &,nsCxPusher *) 	content/events/src/nsEventDispatcher.cpp
21 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor &,nsDispatchingCallback *,ELMCreationDetector &,nsCxPusher *) 	content/events/src/nsEventDispatcher.cpp
22 	xul.dll 	nsEventDispatcher::Dispatch(nsISupports *,nsPresContext *,nsEvent *,nsIDOMEvent *,nsEventStatus *,nsDispatchingCallback *,nsCOMArray<mozilla::dom::EventTarget> *) 	content/events/src/nsEventDispatcher.cpp
23 	xul.dll 	PresShell::HandleEventInternal(nsEvent *,nsEventStatus *) 	layout/base/nsPresShell.cpp
24 	xul.dll 	PresShell::HandleEvent(nsIFrame *,nsGUIEvent *,bool,nsEventStatus *) 	layout/base/nsPresShell.cpp
25 	xul.dll 	PresShell::HandleEvent(nsIFrame *,nsGUIEvent *,bool,nsEventStatus *) 	layout/base/nsPresShell.cpp
26 	xul.dll 	nsViewManager::DispatchEvent(nsGUIEvent *,nsView *,nsEventStatus *) 	view/src/nsViewManager.cpp
27 	xul.dll 	nsView::HandleEvent(nsGUIEvent *,bool) 	view/src/nsView.cpp
28 	xul.dll 	MetroWidget::DispatchEvent(nsGUIEvent *,nsEventStatus &) 	widget/windows/winrt/MetroWidget.cpp
29 	xul.dll 	MetroWidget::DispatchWindowEvent(nsGUIEvent *) 	widget/windows/winrt/MetroWidget.cpp
30 	xul.dll 	mozilla::widget::NativeKey::DispatchKeyEvent(nsKeyEvent &,tagMSG const *) 	widget/windows/KeyboardLayout.cpp
31 	xul.dll 	mozilla::widget::NativeKey::HandleCharMessage(tagMSG const &,bool *) 	widget/windows/KeyboardLayout.cpp
32 	xul.dll 	mozilla::widget::NativeKey::DispatchKeyPressEventForFollowingCharMessage() 	widget/windows/KeyboardLayout.cpp
33 	xul.dll 	mozilla::widget::NativeKey::HandleKeyDownMessage(bool *,bool *) 	widget/windows/KeyboardLayout.cpp
34 	xul.dll 	MetroWidget::WindowProcedure(HWND__ *,unsigned int,unsigned int,long) 	widget/windows/winrt/MetroWidget.cpp
35 	user32.dll 	InternalCallWinProc 	
36 	user32.dll 	UserCallWinProcCheckWow 	
37 	user32.dll 	DispatchMessageWorker 	
38 	user32.dll 	DispatchMessageW 	
39 	windows.ui.dll 	Windows::UI::Core::CDispatcher::ProcessMessage(int,int *) 	d:\\w8rtm\\windows\\advcore\\winrt\\iwindow\\corewindow\\dispatcher.cpp
40 	xul.dll 	mozilla::widget::winrt::FrameworkView::Run() 	widget/windows/winrt/FrameworkView.cpp

More reports at:
https://crash-stats.mozilla.com/report/list?product=MetroFirefox&signature=CRange%3A%3ARelease%28%29
https://crash-stats.mozilla.com/report/list?product=MetroFirefox&signature=[thunk]%3ACRange%3A%3ARelease%60adjustor{4}%27%27+%28%29

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Looks strange to me.

If we assume this bug isn't caused by:

* memory broken bug
* TSF internal bug

If so, we must be releasing ITfRange instances overly. However, we always use nsRefPtr for handling them. So, we must use getter_AddRefs() at wrong method.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

FYI: I always use TSF mode on Desktop Firefox. However, I've never see this crash. Therefore, I feel this might not be our bug.