1365825 - Crash in objc_msgSend | -[GeckoNSMenu performSuperKeyEquivalent:]

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-4a81ca5d-02ef-4d6c-80e1-7eefd0170518.
=============================================================

Seen while looking at nightly crash stats - crashes started on Mac using 20170516122050: 

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3e166b6838931b3933ca274331f9e0e115af5cc0&tochange=6e3ca5b38f7173b214b10de49e58cb01890bf39d

Bug 429824 is in the range. ni on spohl.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

(In reply to [:philipp] from comment #1)
> the crashing address of most of these reports indicates it's a UAF situation.

Comment 3

[Calixte Denizet (:calixte)]

:spohl, why did you close this bug ?

Comment 4

[Stephen A Pohl [:spohl]]

Umm... I only meant to assign this bug to me. Looking into it now.

Comment 5

[Marcia Knous [:marcia]]

Tracking 55+ for this regression.

Comment 6

[Stephen A Pohl [:spohl]]

Attachment: Patch

Comment 7

[Stephen A Pohl [:spohl]]

Comment on attachment 8869144 [details] [diff] [review]
Patch

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
Unknown

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
Yes

Which older supported branches are affected by this flaw?
None. This only affects nightly since this past Tuesday.

If not all supported branches, which bug introduced the flaw?
bug 429824

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
n/a

How likely is this patch to cause regressions; how much testing does it need?
No risk of regressions. There is no good way to test the fix.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8869144 [details] [diff] [review]
Patch

This doesn't need sec approval since it only affects trunk. Land away!

Comment 9

[Stephen A Pohl [:spohl]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9f160f5995bbd3c62fe44d45681dcdd3b04c04ee
Bug 1365825: Fix occasional crashes on OSX when handling custom shortcuts. r=mstange

Comment 10

[Stephen A Pohl [:spohl]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)
> Comment on attachment 8869144 [details] [diff] [review]
> Patch
> 
> This doesn't need sec approval since it only affects trunk. Land away!

Between closing the wrong bug as duplicate (bug 1365880, which was already marked as core-security, instead of this one), accidentally closing this bug here as fixed when I meant to only assign it to myself, and seeing "sec-approval required on patches before landing" and following that advice when it wasn't necessary, I clearly still need to get used to the new bugzilla... Thanks for bearing with me.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9f160f5995bb