529459 - crash at [@ CFDictionaryGetValue] in Safari profile migration code

Status: RESOLVED FIXED

(Firefox :: Migration, defect)

Description

[John Daggett (:jtd)]

#86 in top mac crashers:

http://crash-stats.mozilla.com/report/list?product=Firefox&platform=mac&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=CFDictionaryGetValue

Stack crawl:

0 CoreFoundation CFDictionaryGetValue
1 libbrowsercomps.dylib GetDictionaryCStringValue browser/components/migration/src/nsSafariProfileMigrator.cpp:303
2 libbrowsercomps.dylib nsSafariProfileMigrator::GetSourceHomePageURL browser/components/migration/src/nsSafariProfileMigrator.cpp:1258
3 XUL NS_InvokeByIndex_P xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4 XUL XPCWrappedNative::CallMethod js/src/xpconnect/src/xpcwrappednative.cpp:2456
5 XUL XPC_WN_GetterSetter js/src/xpconnect/src/xpcprivate.h:2323
6 libmozjs.dylib js_Invoke js/src/jsinterp.cpp:1386
7 libmozjs.dylib js_InternalInvoke js/src/jsinterp.cpp:1447
8 libmozjs.dylib js_InternalGetOrSet js/src/jsinterp.cpp:1510

Possibly related to bug 371824.  Occurs in both 3.0.x code and 3.5.x code.

Comment 1

[Josh Aas]

Attachment: fix v1.0

I suspect this only happens for users that have never launched Safari in their account. I can reproduce this sometimes when I remove my Safari plist preferences and then do a Safari import. I cannot reproduce consistently, and I can only reproduce in the official opt-no-symbols Firefox 3.5.5 build.

I suspect this patch will fix the problem, we'll have to make sure by tracking crash reports. CFDictionaryGetValue will crash if you pass NULL or a bad pointer so this patch checks that. It also fixes some other potentially problematic code including uninitialized pointers.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

Comment on attachment 414117 [details] [diff] [review]
fix v1.0

Looks fine to me.

Comment 3

[Josh Aas]

Dietrich, I need a Firefox/browser reviewer. If you can't do it please re-target to someone who can. Thanks.

Comment 4

[Dietrich Ayala (:dietrich)]

Comment on attachment 414117 [details] [diff] [review]
fix v1.0

looks ok, r=me.

Comment 5

[Josh Aas]

pushed to mozilla-central

http://hg.mozilla.org/mozilla-central/rev/92c9e42e75e6

Comment 6

[Samuel Sidler (old account; do not CC)]

1.9.0.16 is frozen, pushing blocking request to 1.9.0.17.

Comment 7

[Josh Aas]

pushed to mozilla-1.9.2

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/d3dd5d4a97cc

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 414117 [details] [diff] [review]
fix v1.0

Approved for 1.9.1.8, a=dveditz for release-drivers

Comment 9

[Josh Aas]

Attachment: 1.9.1 branch patch v1.0

Comment 10

[Josh Aas]

pushed to mozilla-1.9.1

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/361f74ce4784