1198594 - crash in libsystem_kernel.dylib@0x16286

Status: RESOLVED FIXED

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Might be slow response)]

This bug was filed from the Socorro interface and is 
report bp-2566c28d-147d-445d-9d77-919fb2150825.
=============================================================

Crashed at deleting something in mozilla::ContentCacheInParent::FlushPendingNotifications(nsIWidget*). The possibility is that IMENotification::mMessage is NOTIFY_IME_OF_SELECTION_CHANGE unexpectedly.

This must be caused by bug 1189396, but it's indirectly.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Might be slow response)]

Attachment: The copy constructor of IMENotification should initialize mMessage before calling Assign()

I don't know the reason why this is reproduced only on Mac OS X and the frequency is too high.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Might be slow response)]

This bug can be reproduced on 42 or later. The actual cause of this regression is bug 1184449.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Might be slow response)]

url:        https://hg.mozilla.org/integration/mozilla-inbound/rev/b01fa62c7a5216dc2bb47113492efa8f094929cd
changeset:  b01fa62c7a5216dc2bb47113492efa8f094929cd
user:       Masayuki Nakano <[e-mail]>
date:       Wed Aug 26 20:01:05 2015 +0900
description:
Bug 1198594 The copy constructor of IMENotification should initialize mMessage before calling Assign() r=smaug

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b01fa62c7a52

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Might be slow response)]

Comment on attachment 8652701 [details] [diff] [review]
The copy constructor of IMENotification should initialize mMessage before calling Assign()

Approval Request Comment
[Feature/regressing bug #]: bug 1184449, but the frequency was increased by bug 1189396 on OS X 10.10.x
[User impact if declined]: This is rare crash bug on 42. If it's completely random, this may be reproduced 2~3/UINT32_MAX per an operation with IME. However, the crash reason is double free. So, we should fix this for security.
[Describe test coverage new/current, TreeHerder]: Landed on m-c.
[Risks and why]: Nothing because this adds a member initializer to the copy constructor. It should be, but I forgot to add at bug 1184449.
[String/UUID change made/needed]: Nothing.

Comment 6

[Sylvestre Ledru [:sylvestre]]

Comment on attachment 8652701 [details] [diff] [review]
The copy constructor of IMENotification should initialize mMessage before calling Assign()

Fix a crash, taking it.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/8629acbf383a