Closed Bug 1331340 Opened 7 years ago Closed 7 years ago

Crash in memcpy | NS_CopySegmentToBuffer rising in Firefox 49

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
49 Branch
Platform:
x86
Windows
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla53
Tracking Flags:
Tracking Status
firefox50 --- wontfix
firefox51 --- fixed
firefox52 --- fixed
firefox53 --- fixed

People

(Reporter: baku, Assigned: baku)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

fr.patch
673 bytes, patch
bkelly
: review+
lizzard
: approval-mozilla-aurora+
lizzard
: approval-mozilla-beta+
lizzard
: approval-mozilla-release+
Details | Diff | Splinter Review 
+++ This bug was initially created as a clone of Bug #1330273 +++

+++ This bug was initially created as a clone of Bug #1294533 +++
Attached patch fr.patch — — Splinter Review 
Maybe the solution was easier...
Assignee: nobody → amarchesini
Attachment #8827099 - Flags: review?(bkelly)
Attachment #8827099 - Flags: review?(bkelly) → review+
Pushed by amarchesini@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/99ea5dbd2916
FileReader should not continue when allocation fails, r=bkelly
Comment on attachment 8827099 [details] [diff] [review]
fr.patch

Approval Request Comment
[Feature/Bug causing the regression]: FileReader
[User impact if declined]: a crash can occur
[Is this code covered by automated tests?]: no test needed
[Has the fix been verified in Nightly?]: not yet
[Needs manual test from QE? If yes, steps to reproduce]: probably just a big big allocation can be enough to reproduce this issue.
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: none
[Why is the change risky/not risky?]: it's just a missing 'return'.
[String changes made/needed]: none
Attachment #8827099 - Flags: approval-mozilla-beta?
Attachment #8827099 - Flags: approval-mozilla-aurora?
i can confirm that the try build from https://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-inbound-win32/1484584581/ no longer crashes when attempting to attach a > 3GB file in yahoo mail.
Comment on attachment 8827099 [details] [diff] [review]
fr.patch


Crash fix, let's uplift. 
This needs uplift to m-r as well since the beta to release merge happened for 51 today.
Attachment #8827099 - Flags: approval-mozilla-release+
Attachment #8827099 - Flags: approval-mozilla-beta?
Attachment #8827099 - Flags: approval-mozilla-beta+
Attachment #8827099 - Flags: approval-mozilla-aurora?
Attachment #8827099 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/mozilla-central/rev/99ea5dbd2916
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox53: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
Depends on: 1332587
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: