1334257 - Crash in mozilla::TIPMessageHandler::SendMessageTimeoutWHook

Status: RESOLVED FIXED

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-52fabcd9-25d0-4529-a508-c85422170126.
=============================================================

this seems to be a regression in firefox 52 in a codepath that was added in bug 1329616. so far it's rather low level while it was on aurora and there isn't much data from 52.0b yet...

Comment 1

[Aaron Klotz [:aklotz] (a11y work receiving priority right now, please send interceptor reviews to dmajor or handyman)]

Oddly enough this looks kind of like the SendMessageTimeoutW hook was applied twice, thus causing SendMessageTimeoutWStub to point to SendMessageTimeoutWHook.

I suppose this could happen if all nsWindow objects were destroyed and then another one was subsequently created. This is probably a rare occurrence but not impossible.

Comment 2

[Aaron Klotz [:aklotz] (a11y work receiving priority right now, please send interceptor reviews to dmajor or handyman)]

Created attachment 8830924 [details]
Bug 1334257: Assure that TIPMessageHandler hooks may not be instantiated more than once;

Review commit: https://reviewboard.mozilla.org/r/107592/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/107592/

Comment 3

[Jim Mathies [:jimm]]

Comment on attachment 8830924 [details]
Bug 1334257: Assure that TIPMessageHandler hooks may not be instantiated more than once;

https://reviewboard.mozilla.org/r/107592/#review109022

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2a94f3b94970
Assure that TIPMessageHandler hooks may not be instantiated more than once; r=jimm

Comment 5

[Wes Kocher (:KWierso)]

https://hg.mozilla.org/mozilla-central/rev/2a94f3b94970

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Given the current state of e10s+a11y, I'm not sure where if anywhere this needs backporting to. But please request it where needed :)

Comment 7

[Aaron Klotz [:aklotz] (a11y work receiving priority right now, please send interceptor reviews to dmajor or handyman)]

Comment on attachment 8830924 [details]
Bug 1334257: Assure that TIPMessageHandler hooks may not be instantiated more than once;

Approval Request Comment
[Feature/Bug causing the regression]: bug 1329616
[User impact if declined]: Possible crashes due to stack overflow
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No
[Why is the change risky/not risky?]: Really simple patch, just added checks to ensure affected code isn't run more than once.
[String changes made/needed]: None

Comment 8

[Julien Cristau [:jcristau]]

Comment on attachment 8830924 [details]
Bug 1334257: Assure that TIPMessageHandler hooks may not be instantiated more than once;

fix crash in beta52 and aurora53

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e0080533f0ef

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/716b06d07433