Bug 178274

This bug still exists in thunderbird-1.5-3.x86_64

ellson@ontap:thunderbird-1.5> ./run-mozilla.sh -g -d gdb ./thunderbird-bin
MOZILLA_FIVE_HOME=.
  LD_LIBRARY_PATH=.:./plugins:.
DISPLAY=:0.0
DYLD_LIBRARY_PATH=.:.
     LIBRARY_PATH=.:./components:.
       SHLIB_PATH=.:.
          LIBPATH=.:.
       ADDON_PATH=.
      MOZ_PROGRAM=./thunderbird-bin
      MOZ_TOOLKIT=
        moz_debug=1
     moz_debugger=gdb
/usr/bin/gdb ./thunderbird-bin -x /tmp/mozargs.K23769
GNU gdb Red Hat Linux (6.3.0.0-1.106rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...Using host libthread_db l
ibrary "/lib64/libthread_db.so.1".

(gdb) run
Starting program: /usr/lib64/thunderbird-1.5/thunderbird-bin
[Thread debugging using libthread_db enabled]
[New Thread 47050767849216 (LWP 23772)]
[New Thread 1084229968 (LWP 23775)]
[New Thread 1094719824 (LWP 23776)]
[New Thread 1105209680 (LWP 23777)]
Detaching after fork from child process 23778.
[New Thread 1115699536 (LWP 23779)]
[New Thread 1126189392 (LWP 23780)]
[New Thread 1136679248 (LWP 23781)]
[New Thread 1147169104 (LWP 23782)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47050767849216 (LWP 23772)]
0x00002aaaaeba1069 in mozInlineSpellChecker::EndOfAWord (this=Variable "this" is
 not available.
)
    at mozInlineSpellChecker.cpp:980
980           if (NS_SUCCEEDED(res) && IsNonwordChar(text[aOffset]))
(gdb) where
#0  0x00002aaaaeba1069 in mozInlineSpellChecker::EndOfAWord (this=Variable "this
" is not available.
)
    at mozInlineSpellChecker.cpp:980
#1  0x00002aaaaeba41d5 in mozInlineSpellChecker::AdjustSpellHighlighting (
    this=0x175ae40, aNode=0x166f110, aOffset=-1,
    aSpellCheckSelection=0x16de410, isDeletion=0)
    at mozInlineSpellChecker.cpp:848
#2  0x00002aaaaeba45ce in mozInlineSpellChecker::SpellCheckAfterEditorChange (
    this=0x175ae40, action=1001, aSelection=0x16e05b0,
    previousSelectedNode=0x166f110, previousSelectedOffset=-1,
    aStartNode=0x166f110, aStartOffset=0, aEndNode=0x166f110, aEndOffset=1)
    at mozInlineSpellChecker.cpp:277
#3  0x00002aaaad7f7f8b in nsHTMLEditRules::AfterEditInner (this=0x16fd540,
    action=1001, aDirection=1) at nsHTMLEditRules.cpp:547
#4  0x00002aaaad7f807c in nsHTMLEditRules::AfterEdit (this=0x16fd540,
    action=1001, aDirection=Variable "aDirection" is not available.
) at nsHTMLEditRules.cpp:391
#5  0x00002aaaad7ca3ce in nsHTMLEditor::EndOperation (this=0x16c4c10)
    at nsHTMLEditor.cpp:4261
#6  0x00002aaaad81eddd in nsPlaintextEditor::InsertText (this=0x16c4c10,
    aStringToInsert=@0x7ffffffc8c60) at nsPlaintextEditor.cpp:800
#7  0x00002aaaad81d4a3 in nsPlaintextEditor::TypedText (this=0x16c4c10,
    aString=@0x7ffffffc8c60, aAction=0) at nsPlaintextEditor.cpp:426
#8  0x00002aaaad7ca4dd in nsHTMLEditor::TypedText (this=0x16c4c10,
    aString=@0x7ffffffc8c60, aAction=0) at nsHTMLEditor.cpp:1356
---Type <return> to continue, or q <return> to quit---
#9  0x00002aaaad7d38c8 in nsHTMLEditor::HandleKeyPress (this=0x16c4c10,
    aKeyEvent=0x158d590) at nsHTMLEditor.cpp:1334
#10 0x00002aaaad826df4 in nsTextEditorKeyListener::KeyPress (this=0x17119f0,
    aKeyEvent=0x158d5b0) at nsEditorEventListeners.cpp:249
#11 0x00002aaaac81092f in nsEventListenerManager::HandleEvent (this=0x16deb20,
    aPresContext=Variable "aPresContext" is not available.
) at nsEventListenerManager.cpp:141
#12 0x00002aaaac7d5c2c in nsDocument::HandleDOMEvent (this=0x16d3c30,
    aPresContext=0x15b2520, aEvent=0x7ffffffc9650, aDOMEvent=0x7ffffffc9098,
    aFlags=514, aEventStatus=0x7ffffffc9428) at nsDocument.cpp:4002
#13 0x00002aaaac7eb97b in nsGenericElement::HandleDOMEvent (this=0x15a2de0,
    aPresContext=0x15b2520, aEvent=0x7ffffffc9650, aDOMEvent=0x7ffffffc9098,
    aFlags=519, aEventStatus=0x7ffffffc9428) at nsGenericElement.cpp:2206
#14 0x00002aaaac6a17e1 in PresShell::HandleEventInternal (this=0x16dc840,
    aEvent=0x7ffffffc9650, aView=0x15ab740, aFlags=1, aStatus=0x7ffffffc9428)
    at nsPresShell.cpp:6420
#15 0x00002aaaac6a1fa4 in PresShell::HandleEvent (this=0x16dc840,
    aView=0x15ab740, aEvent=0x7ffffffc9650, aEventStatus=0x7ffffffc9428,
    aForceHandle=1, aHandled=@0x7ffffffc9424) at nsPresShell.cpp:6203
#16 0x00002aaaac8bd986 in nsViewManager::HandleEvent (this=0x16d5120,
    aView=0x15ab740, aEvent=0x7ffffffc9650, aCaptured=0)
    at nsViewManager.cpp:2512
#17 0x00002aaaac8bf42e in nsViewManager::DispatchEvent (this=0x16d5120,
    aEvent=0x7ffffffc9650, aStatus=0x7ffffffc95bc) at nsViewManager.cpp:2246
---Type <return> to continue, or q <return> to quit---
#18 0x00002aaaac8b62f8 in HandleEvent (aEvent=0x7ffffffc9650) at nsView.cpp:171
#19 0x00002aaaab334c2e in nsCommonWidget::DispatchEvent (this=0x15b2cb0,
    aEvent=0x7ffffffc9650, aStatus=@0x7ffffffc971c) at nsCommonWidget.cpp:219
#20 0x00002aaaab32f143 in nsWindow::OnKeyPressEvent (this=0x15b2cb0, aWidget=Var
iable "aWidget" is not available.
)
    at nsWindow.cpp:1783
#21 0x000000369a923bfd in gtk_marshal_BOOLEAN__VOID ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#22 0x000000369960b21d in g_closure_invoke ()
   from /usr/lib64/libgobject-2.0.so.0
#23 0x000000369961af28 in g_signal_override_class_closure ()
   from /usr/lib64/libgobject-2.0.so.0
#24 0x000000369961c13d in g_signal_emit_valist ()
   from /usr/lib64/libgobject-2.0.so.0
#25 0x000000369961c553 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#26 0x000000369a9fd7ce in gtk_widget_get_default_style ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#27 0x000000369aa0affb in gtk_window_propagate_key_event ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#28 0x000000369aa0db4b in gtk_window_activate_key ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#29 0x000000369a923bfd in gtk_marshal_BOOLEAN__VOID ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#30 0x000000369960b21d in g_closure_invoke ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib64/libgobject-2.0.so.0
#31 0x000000369961b538 in g_signal_override_class_closure ()
   from /usr/lib64/libgobject-2.0.so.0
#32 0x000000369961c13d in g_signal_emit_valist ()
   from /usr/lib64/libgobject-2.0.so.0
#33 0x000000369961c553 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#34 0x000000369a9fd7ce in gtk_widget_get_default_style ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#35 0x000000369a91d995 in gtk_propagate_event ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#36 0x000000369a91e901 in gtk_main_do_event ()
   from /usr/lib64/libgtk-x11-2.0.so.0
#37 0x000000369a6465bc in gdk_add_client_message_filter ()
   from /usr/lib64/libgdk-x11-2.0.so.0
#38 0x0000003699426f7a in g_main_context_dispatch ()
   from /usr/lib64/libglib-2.0.so.0
#39 0x000000369942a105 in g_main_context_check ()
   from /usr/lib64/libglib-2.0.so.0
#40 0x000000369942a42d in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
#41 0x000000369a91ec93 in gtk_main () from /usr/lib64/libgtk-x11-2.0.so.0
#42 0x00002aaaab333c3e in nsAppShell::Run (this=0x729f80) at nsAppShell.cpp:139
#43 0x00002aaaab79fda8 in nsAppStartup::Run (this=0x729f00)
    at nsAppStartup.cpp:150
---Type <return> to continue, or q <return> to quit---
#44 0x000000000040b239 in XRE_main (argc=Variable "argc" is not available.
) at nsAppRunner.cpp:2313
#45 0x00000030f1c1d024 in __libc_start_main () from /lib64/libc.so.6
#46 0x0000000000406b29 in _start ()
#47 0x00007ffffffcafa8 in ?? ()
#48 0x0000000000000000 in ?? ()
(gdb) list
2313              rv = appStartup->Run();
2314              NS_TIMELINE_LEAVE("appStartup->Run");
2315              if (NS_FAILED(rv)) {
2316                NS_ERROR("failed to run appstartup");
2317                gLogConsoleErrors = PR_TRUE;
2318              }
2319
2320              // Check for an application initiated restart.  This is one th at
2321              // corresponds to nsIAppStartup.quit(eRestart)
2322              if (rv == NS_SUCCESS_RESTART_APP) {
(gdb) info locals
res = Variable "res" is not available.
(gdb) info threads

  8 Thread 1147169104 (LWP 23782)  0x00000030f2d09667 in pthread_cond_timedwait@
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
  7 Thread 1136679248 (LWP 23781)  0x00000030f2d09667 in pthread_cond_timedwait@
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
  6 Thread 1126189392 (LWP 23780)  0x00000030f2d09667 in pthread_cond_timedwait@
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
  5 Thread 1115699536 (LWP 23779)  0x00000030f2d09667 in pthread_cond_timedwait@
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
  4 Thread 1105209680 (LWP 23777)  0x00000030f2d09667 in pthread_cond_timedwait@
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
  3 Thread 1094719824 (LWP 23776)  0x00000030f2d09667 in pthread_cond_timedwait@
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
  2 Thread 1084229968 (LWP 23775)  0x00000030f1cc2ac6 in poll ()
   from /lib64/libc.so.6
* 1 Thread 47050767849216 (LWP 23772)  0x00002aaaaeba1069 in mozInlineSpellCheck
er::EndOfAWord (this=Variable "this" is not available.
) at mozInlineSpellChecker.cpp:980
(gdb)

gdb: list after where isn't very useful...

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47801366312704 (LWP 23836)]
0x00002aaaaea71069 in mozInlineSpellChecker::EndOfAWord (this=Variable "this" is
not available.
) at mozInlineSpellChecker.cpp:980
980           if (NS_SUCCEEDED(res) && IsNonwordChar(text[aOffset]))
(gdb) list
975         nsresult res = aNode->GetNodeType(&nodeType);
976         if (NS_SUCCEEDED(res))
977         {
978           if (nodeType == nsIDOMNode::TEXT_NODE) {
979             res = aNode->GetNodeValue(text);
980           if (NS_SUCCEEDED(res) && IsNonwordChar(text[aOffset]))
981             endOfWord = PR_TRUE;
982           }
983         }
984       }
(gdb) p res
Variable "res" is not available.
(gdb) p aOffset
$1 = -1
(gdb)

Just checking to see if this bug still exists in  thunderbird-1.5.0.10-1.fc7

I don't get the crash anymore, but I still don't see any spaces after the smiley.

Try:
    <smiley><space><space>tree

and the 'tree' is tight against the smiley.   The spell checker seem to be OK
though.  It recognizes "tree" as a word.

Probably not important.      Close this one if you like.

We found that this bug (which I can reproduce just fine with
thunderbird-1.5.0.10-1.fc6) has been already registered in the upstream database
(https://bugzilla.mozilla.org/show_bug.cgi?id=328606, and also
https://bugs.launchpad.net/ubuntu/+source/mozilla-thunderbird/+bug/56139) and
believe that it is more approriate to let it be resolved upstream.

Red Hat will continue to track the issue in the centralized upstream bug
tracker, and will review any bug fixes that become available for consideration
in future updates.

Thank you for the bug report.