Closed Bug 1279000 Opened 8 years ago Closed 8 years ago

Crash in mozilla::dom::DataTransfer::GetDataAtInternal when copy/pasting in Google Spreadsheet

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla50
Tracking Status
firefox47 --- unaffected
firefox48 --- unaffected
firefox49 --- unaffected
firefox50 + verified

People

(Reporter: cpeterson, Unassigned)

References

Details

(Keywords: crash, regression, reproducible, Whiteboard: btpp-followup-2016-06-15)

Crash Data

[Tracking Requested - why for this release]:

I believe this crash is a regression in Nightly 50 from DataTransfer bug 906420.

This bug was filed from the Socorro interface and is 
report bp-6910c2f1-31fd-42a0-8dab-651552160608.
=============================================================

STR:
1. Open a Google Spreadsheet.
2. Select a cell.
3. Copy the cell contents using the CMD+C keyboard shortcut.
4. Paste the cell contents to a different cell.

RESULT:

CRASH!

0 	XUL 	mozilla::dom::DataTransfer::GetDataAtInternal(nsAString_internal const&, unsigned int, nsIPrincipal*, nsIVariant**) 	dom/events/DataTransfer.cpp:646
1 	XUL 	mozilla::dom::DataTransfer::GetData(nsAString_internal const&, nsAString_internal&, mozilla::ErrorResult&) 	dom/events/DataTransfer.cpp:377
2 	XUL 	mozilla::dom::DataTransferBinding::getData 	obj-firefox/x86_64/dom/bindings/DataTransferBinding.cpp:277
3 	XUL 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp:2784
4 	XUL 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/jscntxtinlines.h:235
5 	XUL 	Interpret 	js/src/vm/Interpreter.cpp:503
6 	XUL 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:398
7 	XUL 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:470
8 	XUL 	js:: 	js/src/vm/Interpreter.cpp:516
9 	XUL 	js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) 	js/src/jit/VMFunctions.cpp:111
10 		@0x119a8327f
Michael, can you take a look?
Flags: needinfo?(michael)
Whiteboard: btpp-followup-2016-06-15
Tracking this in 50 since this is regression and a common operation.
Crashes seen on Linux and Windows as well, but only 7 total in the last week.
OS: Mac OS X → All
Hardware: Unspecified → All
(In reply to Marcia Knous [:marcia - use ni] from comment #3)
> Crashes seen on Linux and Windows as well, but only 7 total in the last week.

The crashes are infrequent because the patch which caused them was backed out. I'll be hopefully re-landing it soon with a patch which should fix this issue.
Flags: needinfo?(michael)
(In reply to Michael Layzell [:mystor] from comment #4)
> (In reply to Marcia Knous [:marcia - use ni] from comment #3)
> > Crashes seen on Linux and Windows as well, but only 7 total in the last week.
> 
> The crashes are infrequent because the patch which caused them was backed
> out. I'll be hopefully re-landing it soon with a patch which should fix this
> issue.

Hello Michael - Were you able to re-land the patch?
Flags: needinfo?(michael)
(In reply to Marcia Knous [:marcia - use ni] from comment #5)
> (In reply to Michael Layzell [:mystor] from comment #4)
> > (In reply to Marcia Knous [:marcia - use ni] from comment #3)
> > > Crashes seen on Linux and Windows as well, but only 7 total in the last week.
> > 
> > The crashes are infrequent because the patch which caused them was backed
> > out. I'll be hopefully re-landing it soon with a patch which should fix this
> > issue.
> 
> Hello Michael - Were you able to re-land the patch?

Yes, the patch is in nightly right now.
Flags: needinfo?(michael)
Version: unspecified → Trunk
I may be socorroing incorrectly but I don't see any recent reports.
(In reply to Andrew Overholt [:overholt] from comment #7)
> I may be socorroing incorrectly but I don't see any recent reports.

I don't see any either. Unless Chris still sees this issue, I think we can close this one out.
Verified fixed on Nightly 50.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.