1192060 - crash in _wcsicmp

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect, P5)

Description

[alex_mayorga]

This bug was filed from the Socorro interface and is 
report bp-ecb5abee-3dc7-4451-8ab9-86c872150724.
=============================================================

Over 1000 crashes in the past week per https://crash-stats.mozilla.com/report/list?product=Firefox&signature=_wcsicmp

Crashing Thread
Frame 	Module 	Signature 	Source
0 	msvcr120.dll 	_wcsicmp 	
1 	xul.dll 	nsPipeInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) 	xpcom/io/nsPipe3.cpp
2 	xul.dll 	nsPipeInputStream::Read(char*, unsigned int, unsigned int*) 	xpcom/io/nsPipe3.cpp
3 	xul.dll 	nsDOMFileReader::DoReadData(nsIAsyncInputStream*, unsigned __int64) 	dom/base/nsDOMFileReader.cpp
4 	xul.dll 	mozilla::dom::FileIOObject::OnInputStreamReady(nsIAsyncInputStream*) 	dom/base/FileIOObject.cpp
5 	xul.dll 	nsInputStreamReadyEvent::Run() 	xpcom/io/nsStreamUtils.cpp
6 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp

Comment 1

[Nathan Froyd [:froydnj]]

Ben, do you have any insight into what might be going wrong here?

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Clicking through a number of reports I only see the stack in comment 0 once.  I've seen this one three times (out of about 6 stacks):

Frame 	Module 	Signature 	Source
0 	msvcr120.dll 	_wcsicmp 	
1 	xul.dll 	mozilla::CircularByteBuffer::AppendElements(unsigned char const*, unsigned int) 	dom/media/AudioStream.h
2 	xul.dll 	mozilla::AudioStream::Write(float const*, unsigned int, mozilla::TimeStamp*) 	dom/media/AudioStream.cpp
3 	xul.dll 	mozilla::AudioSink::PlayFromAudioQueue() 	dom/media/AudioSink.cpp
4 	xul.dll 	mozilla::AudioSink::AudioLoop() 	dom/media/AudioSink.cpp

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

In regards to the comment 0 stack, I don't see how _wcsicmp (case insensitive string comparison) would get used.  Bogus symbol?

The nsDOMFileInputReader does use this slightly unsafe writer func with ReadSegments(), though:

  https://dxr.mozilla.org/mozilla-central/source/dom/base/nsDOMFileReader.cpp#260

It seems there is no checking to make sure |end = dest + count| doesn't wrap, although in theory DoReadData() should avoid using it that way.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature '_wcsicmp':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 2 crashes from 2016-06-07.
 - beta    (version 48): 1938 crashes from 2016-06-06.
 - release (version 47): 6049 crashes from 2016-05-31.
 - esr     (version 45): 257 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           1          0          0          1          0          0          0
 - beta           332        230        216        285        385        286         77
 - release        858        676        976       1029        994        904        296
 - esr             20         29         18         31         23         36         21

Affected platform: Windows

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature '_wcsicmp':
 - nightly (version 53): 0 crashes from 2016-11-14.
 - aurora  (version 52): 0 crashes from 2016-11-14.
 - beta    (version 51): 36 crashes from 2016-11-14.
 - release (version 50): 193 crashes from 2016-11-01.
 - esr     (version 45): 848 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       0       0       0
 - aurora        0       0       0       0       0       0       0
 - beta          6       3       9       5       5       4       3
 - release      27      32      29      31      26      26      10
 - esr          24      31      82      58      87      68      48

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly
 - aurora
 - beta    #5765               #491
 - release #3008     #2715     #182
 - esr     #308                #425