956984 - Crash: MOZ_ASSERT(GUIEvent->message != NS_COMPOSITION_START); in nsIMEStateManager::DispatchCompositionEvent

Status: RESOLVED INACTIVE

(Firefox for Android Graveyard :: Keyboards and IME, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

STR:

1. Make a debug fennec build
2. go to google.com
3. select the search field to bring up the onscreen keyboard
4. enter some text (i typed 'hh' without quotes), wait for auto-completion

Result:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 32018]
0x7dc1da52 in nsIMEStateManager::DispatchCompositionEvent (aEventTargetNode=0x877b98e0, aPresContext=0x85dcb400, aEvent=0x77624700, aStatus=0x77624658, aCallBack=0x77624498)
    at /hack/mozilla-central/content/events/src/nsIMEStateManager.cpp:565
565         MOZ_ASSERT(GUIEvent->message != NS_COMPOSITION_START);
(gdb) bt 16
#0  0x7dc1da52 in nsIMEStateManager::DispatchCompositionEvent (aEventTargetNode=0x877b98e0, aPresContext=0x85dcb400, aEvent=0x77624700, aStatus=0x77624658, aCallBack=0x77624498)
    at /hack/mozilla-central/content/events/src/nsIMEStateManager.cpp:565
#1  0x7deb0ae2 in PresShell::HandleEventInternal (this=this@entry=0x87314bc0, aEvent=aEvent@entry=0x77624700, aStatus=aStatus@entry=0x77624658) at /hack/mozilla-central/layout/base/nsPresShell.cpp:7053
#2  0x7deb172c in HandleEvent (aEventStatus=0x77624658, aDontRetargetEvents=<optimized out>, aEvent=0x77624700, aFrame=<optimized out>, this=0x87314bc0) at /hack/mozilla-central/layout/base/nsPresShell.cpp:6673
#3  PresShell::HandleEvent (this=0x87314bc0, aFrame=<optimized out>, aEvent=0x77624700, aDontRetargetEvents=<optimized out>, aEventStatus=0x77624658) at /hack/mozilla-central/layout/base/nsPresShell.cpp:6197
#4  0x7deb0f4e in HandleEvent (aEventStatus=0x77624658, aDontRetargetEvents=false, aEvent=0x77624700, aFrame=<optimized out>, this=<optimized out>) at /hack/mozilla-central/layout/base/nsPresShell.cpp:6272
#5  PresShell::HandleEvent (this=<optimized out>, aFrame=<optimized out>, aEvent=0x77624700, aDontRetargetEvents=<optimized out>, aEventStatus=0x77624658) at /hack/mozilla-central/layout/base/nsPresShell.cpp:6197
#6  0x7db27b6e in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0x77624700, aView=<optimized out>, aStatus=0x77624658) at /hack/mozilla-central/view/src/nsViewManager.cpp:753
#7  0x7db25696 in nsView::HandleEvent (this=<optimized out>, aEvent=0x77624700, aUseAttachedEvents=<optimized out>) at /hack/mozilla-central/view/src/nsView.cpp:1084
#8  0x7d93c83e in nsWindow::DispatchEvent (this=this@entry=0x861e8000, aEvent=aEvent@entry=0x77624700) at /hack/mozilla-central/widget/android/nsWindow.cpp:670
#9  0x7d93e9d2 in nsWindow::OnIMEEvent (this=0x861e8000, ae=ae@entry=0x7a3e0d00) at /hack/mozilla-central/widget/android/nsWindow.cpp:1906
#10 0x7d93f116 in nsWindow::OnGlobalAndroidEvent (ae=0x7a3e0d00) at /hack/mozilla-central/widget/android/nsWindow.cpp:895
#11 0x7d9391ec in nsAppShell::ProcessNextNativeEvent (this=<optimized out>, mayWait=<optimized out>) at /hack/mozilla-central/widget/android/nsAppShell.cpp:599
#12 0x7d94b2a4 in nsBaseAppShell::DoProcessNextNativeEvent (this=this@entry=0x73511100, mayWait=mayWait@entry=false, recursionDepth=recursionDepth@entry=0) at /hack/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:137
#13 0x7d94b336 in nsBaseAppShell::OnProcessNextEvent (this=0x73511100, thr=0x73520600, mayWait=false, recursionDepth=0) at /hack/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:277
#14 0x7d1bb39e in ProcessNextEvent (result=0x77624957, mayWait=false, this=0x73520600) at /hack/mozilla-central/xpcom/threads/nsThread.cpp:607
#15 nsThread::ProcessNextEvent (this=0x73520600, mayWait=<optimized out>, result=0x77624957) at /hack/mozilla-central/xpcom/threads/nsThread.cpp:567

(gdb) set print pretty on
(gdb) p GUIEvent
$1 = (mozilla::WidgetCompositionEvent *) 0x77624700
(gdb) p *GUIEvent
$2 = (mozilla::WidgetCompositionEvent) {
  <mozilla::WidgetGUIEvent> = {
    <mozilla::WidgetEvent> = {
      _vptr.WidgetEvent = 0x7f17b058 <vtable for mozilla::WidgetCompositionEvent+8>, 
      eventStructType = NS_COMPOSITION_EVENT, 
      message = 2200, 
      refPoint = {
        <mozilla::gfx::BasePoint<int, mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel> >> = {
          x = 0, 
          y = 0
        }, 
        <mozilla::LayoutDevicePixel> = {<No data fields>}, <No data fields>}, 
      lastRefPoint = {
        <mozilla::gfx::BasePoint<int, mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel> >> = {
          x = 0, 
          y = 0
        }, 
        <mozilla::LayoutDevicePixel> = {<No data fields>}, <No data fields>}, 
      time = 1389059509627, 
      mFlags = {
        mIsTrusted = true, 
        mInBubblingPhase = false, 
        mInCapturePhase = false, 
        mInSystemGroup = false, 
        mCancelable = false, 
        mBubbles = true, 
        mPropagationStopped = false, 
        mImmediatePropagationStopped = false, 
        mDefaultPrevented = false, 
        mDefaultPreventedByContent = false, 
        mMultipleActionsPrevented = false, 
        mIsBeingDispatched = false, 
        mDispatchedAtLeastOnce = false, 
        mIsSynthesizedForTests = false, 
        mExceptionHasBeenRisen = false, 
        mRetargetToNonNativeAnonymous = false, 
        mNoCrossProcessBoundaryForwarding = false, 
        mNoContentDispatch = false, 
        mOnlyChromeDispatch = false
      }, 
      userType = {
        mRawPtr = 0x0
      }, 
      typeString = {
        <nsAString_internal> = {
          mData = 0x7f34a024 <gNullChar> u"", 
          mLength = 0, 
          mFlags = 1
        }, <No data fields>}, 
      target = {
        mRawPtr = 0x0
      }, 
      currentTarget = {
        mRawPtr = 0x0
      }, 
      originalTarget = {
        mRawPtr = 0x0
      }
---Type <return> to continue, or q <return> to quit---
    }, 
    members of mozilla::WidgetGUIEvent: 
    widget = {
      mRawPtr = 0x861e8000
    }, 
    pluginEvent = 0x0
  }, 
  members of mozilla::WidgetCompositionEvent: 
  seqno = 2040601632, 
  data = {
    <nsAString_internal> = {
      mData = 0x7f34a024 <gNullChar> u"", 
      mLength = 0, 
      mFlags = 1
    }, <No data fields>}
}
(gdb) p GUIEvent->message
$3 = 2200

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

Reproduced on a Nexus 10 with Android 4.3.