1157193 - crash in nsContentUtils::TransferableToIPCTransferable(nsITransferable*, mozilla::dom::IPCDataTransfer*, mozilla::dom::nsIContentChild*, mozilla::dom::nsIContentParent*)

Status: VERIFIED FIXED

(Core :: DOM: Copy & Paste and Drag & Drop, defect)

Description

[Jim Mathies [:jimm]]

New top crash climbing in the content process. All platforms.

https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=3&range_unit=days&date=2015-04-22&signature=nsContentUtils%3A%3ATransferableToIPCTransferable%28nsITransferable*%2C+mozilla%3A%3Adom%3A%3AIPCDataTransfer*%2C+mozilla%3A%3Adom%3A%3AnsIContentChild*%2C+mozilla%3A%3Adom%3A%3AnsIContentParent*%29&version=Firefox%3A40.0a1#tab-sigsummary


0 	xul.dll 	nsContentUtils::TransferableToIPCTransferable(nsITransferable*, mozilla::dom::IPCDataTransfer*, mozilla::dom::nsIContentChild*, mozilla::dom::nsIContentParent*) 	dom/base/nsContentUtils.cpp
1 	xul.dll 	nsContentUtils::TransferablesToIPCTransferables(nsISupportsArray*, nsTArray<mozilla::dom::IPCDataTransfer>&, mozilla::dom::nsIContentChild*, mozilla::dom::nsIContentParent*) 	dom/base/nsContentUtils.cpp
2 	xul.dll 	nsDragServiceProxy::InvokeDragSession(nsIDOMNode*, nsISupportsArray*, nsIScriptableRegion*, unsigned int) 	widget/nsDragServiceProxy.cpp
3 	xul.dll 	nsBaseDragService::InvokeDragSessionWithImage(nsIDOMNode*, nsISupportsArray*, nsIScriptableRegion*, unsigned int, nsIDOMNode*, int, int, nsIDOMDragEvent*, nsIDOMDataTransfer*) 	widget/nsBaseDragService.cpp
4 	xul.dll 	mozilla::EventStateManager::DoDefaultDragStart(nsPresContext*, mozilla::WidgetDragEvent*, mozilla::dom::DataTransfer*, nsIContent*, nsISelection*) 	dom/events/EventStateManager.cpp
5 	xul.dll 	mozilla::EventStateManager::GenerateDragGesture(nsPresContext*, mozilla::WidgetMouseEvent*) 	dom/events/EventStateManager.cpp
6 	xul.dll 	mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*) 	dom/events/EventStateManager.cpp
7 	xul.dll 	PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) 	layout/base/nsPresShell.cpp

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

null pointer crash. Regression from bug 1071562.

Comment 2

[Neil Deakin]

Attachment: Add null check on surafce

Not sure how to reproduce this (drag failed or half-loaded image maybe?), but this should fix the crash.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8bcdac2a7ad1

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8bcdac2a7ad1

Comment 5

[Marco Mucci [:MarcoM]]

Hi Neil, can you provide a point value.

Comment 6

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows zero crashes with this signature in Nightly builds after April 22nd.

[1] - https://crash-stats.mozilla.com/report/list?range_unit=days&range_value=28&signature=nsContentUtils%3A%3ATransferableToIPCTransferable%28nsITransferable%2A%2C+mozilla%3A%3Adom%3A%3AIPCDataTransfer%2A%2C+mozilla%3A%3Adom%3A%3AnsIContentChild%2A%2C+mozilla%3A%3Adom%3A%3AnsIContentParent%2A%29#tab-reports