Bug 1380652 - ContentCacheInParent::RequestIMEToCommitComposition() shouldn't handle the request synchronously when its TabParent has already sent eCompositionCommit(AsIs) event of the composition r?m_kato
If ContentCacheInParent::RequestIMEToCommitComposition() returns true after its TabParent has already sent eCompositionCommit(AsIs) event, ContentCacheInParent::OnEventNeedingAckHandled() will receive both eCompositionCommit(AsIs) and eCompositionCommitRequestHandled for a composition. Then, that causes making mPendingCompositionCount decreased twice. That causes the crash.
So, even if its TabParent already lost focus, it should return false after its TabParent sent eCompositionCommit(AsIs).
MozReview-Commit-ID: 6OylQtc8kgC
--- a/widget/ContentCache.cpp
+++ b/widget/ContentCache.cpp
@@ -1248,35 +1248,34 @@ ContentCacheInParent::RequestIMEToCommit
// eCompositionCommit(AsIs) to the remote process. So, this request is
// too late for IME. The remote process should wait following
// composition events for cleaning up TextComposition and handle the
// request as it's handled asynchronously.
if (mPendingCompositionCount > 1) {
return false;
}
+ // If there is no pending composition, we may have already sent
+ // eCompositionCommit(AsIs) event for the active composition. If so, the
+ // remote process will receive composition events which causes cleaning up
+ // TextComposition. So, this shouldn't do nothing and TextComposition
+ // should handle the request as it's handled asynchronously.
+ if (mIsPendingLastCommitEvent) {
+ return false;
+ }
+
// If TabParent which has IME focus was already changed to different one, the
// request shouldn't be sent to IME because it's too late.
if (!IMEStateManager::DoesTabParentHaveIMEFocus(&mTabParent)) {
// Use the latest composition string which may not be handled in the
// remote process for avoiding data loss.
aCommittedString = mCompositionString;
return true;
}
- // Even if the remote process has IME focus and there is no pending
- // composition, we may have already sent eCompositionCommit(AsIs) event
- // to it. If so, the remote process will receive composition events
- // which causes cleaning up TextComposition. So, this shouldn't do nothing
- // and TextComposition should handle the request as it's handled
- // asynchronously.
- if (mIsPendingLastCommitEvent) {
- return false;
- }
-
RefPtr<TextComposition> composition =
IMEStateManager::GetTextCompositionFor(aWidget);
if (NS_WARN_IF(!composition)) {
MOZ_LOG(sContentCacheLog, LogLevel::Warning,
(" 0x%p RequestToCommitComposition(), "
"does nothing due to no composition", this));
return false;
}