1368315 - Crash in mozilla::layers::APZCTreeManager::ReceiveInputEvent

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect, P2)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-c5855478-1dc9-4d8a-b0c6-3e4430170527.
=============================================================

There is 1 crash in nightly 55 with buildid 20170526030203. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1352863.

[1] https://hg.mozilla.org/mozilla-central/rev?node=f3a6eadd0a977a588b5076ece395e1e2f2929167

Comment 1

[Botond Ballo [:botond]]

Thanks. This is actually a regression from bug 1349750, which introduced this code (bug 1352863 just moved it around a bit).

The problem is that we're calling ConfirmDragBlock() and then dragBlock->SetContentResponse(), but ConfirmDragBlock() can potentially process and consume the block. We need to call SetContentResponse() first.

Patch coming up.

Comment 2

[Botond Ballo [:botond]]

Attachment: Bug 1368315 - Avoid calling SetContentResponse() on an already-consumed drag block.

Review commit: https://reviewboard.mozilla.org/r/143860/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/143860/

Comment 3

[Botond Ballo [:botond]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=73b1f8908ee55cc44ea9d03763cf2d6b5b2a849a

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Comment on attachment 8872372 [details]
Bug 1368315 - Avoid calling SetContentResponse() on an already-consumed drag block.

https://reviewboard.mozilla.org/r/143860/#review147608

Comment 5

[Calixte Denizet (:calixte)]

Some crashes adresses indicate an UAF, so marking it as security sensitive.

Comment 6

[Kartikaya Gupta (email:[e-mail])]

This landed on autoland (pulsebot can't post to this bug)

https://hg.mozilla.org/integration/autoland/rev/c516c8e50993

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c516c8e50993