Firefox Crashes while uploading a .pgm file on yahoo mail

NEW
Unassigned

Status

()

Core
Drag and Drop
--
critical
8 months ago
2 days ago

People

(Reporter: emilghitta, Unassigned)

Tracking

({crash, regression})

Trunk
All
Mac OS X
crash, regression
Points:
---

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox53 wontfix, firefox54 wontfix, firefox55 wontfix, firefox56 wontfix, firefox57 fix-optional, firefox58 affected, firefox59 ?)

Details

(crash signature)

(Reporter)

Description

8 months ago
[Affected versions]:
53.0.3 (Build Id:20170518000419)
54.0b13 (Build Id:20170601133324)
55.0a1 (Build Id:20170601030206)

[Unaffected versions]:
52.1.2 esr (Build Id:20170517122419)

[Affected platforms]:
Mac 10.11.6/Graphics: Intel Iris Pro 1536.
Mac 10.11.6/Graphics: AMD Radeon HD 6750M 512.

[Steps to reproduce]:
1.Launch Firefox.
2.Access the https://ro.yahoo.com website.
3.Login with your email account.
4.Compose a new email.
5.Attach the pgm test file(Found at: https://drive.google.com/open?id=0B94iuIVMr-TERDcwelUybWdUUGM).
7.Observe that Firefox Crashes.


[Expected result]:
The file is successfully uploaded or an error is displayed because the format is not supported.

[Actual result]:
Firefox Crashes.

[Regression range]:
I will come back with a regression range asap.

[Additional information]:
Crash Id:a1ffa348-bfcf-4d36-bb14-2fac60170602 and 2bcdbbc7-07b8-45b4-8208-be3df0170602

Please use this https://drive.google.com/open?id=0B94iuIVMr-TERDcwelUybWdUUGM test-file in order to reproduce this issue.

Please note that I managed to reproduce this issue only on the up mentioned platforms.

Updated

8 months ago
Crash Signature: [@ libsystem_kernel.dylib@0x16f06 ]
Has STR: --- → yes
Keywords: crash
I managed to reproduce this. The problem does not occur on macOS 10.12, only on 10.11.

The crash appears to be happening in QuickLook code, off main thread. It looks like it might be a double-free. It occurs when trying to select the file in the filepicker dialog.

I don't really understand the macOS platform very well, but I'll try to attach stacks:

The result of "sampling" the process in Activity Monitor while it is paused at the crash site: https://pastebin.com/V3LyFjTi
The result of calling `bt all` in lldb: https://pastebin.com/heAD16G8
The SYM file for that libxul: http://symbols.mozilla.org/XUL/799157E9557035BFBBFD042D78515C250/XUL.sym

Comment 2

4 months ago
Last good build id: 20140523030202 (2017-05-23)
First bad build id: 20140524030204 (2017-05-24)

Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e9b2b72f4e6c&tochange=f2f81e83f4ff

I tried to narrow it down, but unfortunately mozregression showed this error "There are no build artifacts on inbound for these changesets (they are probably too old)." 

I tested this issue using the latest Nightly 58.0a1 (2017-09-27) and beta 57.0b3 and the bug is still reproducing. But I have to mention that sometimes (1-3 out of 10) the browser freezes and you have to force quit Firefox.
(Reporter)

Comment 3

4 months ago
I can confirm that this issue is reproducible on Firefox 58.0a1, Firefox 57.0b3 and Firefox 56.0. 

Thanks for the detailed info Oana!
status-firefox56: --- → affected
status-firefox57: --- → affected
status-firefox58: --- → affected
Keywords: regressionwindow-wanted → regression
Crash volume is pretty low here (and decreasing...). Just 11 crashes on beta 56 in the last week.
status-firefox53: affected → wontfix
status-firefox54: affected → wontfix
status-firefox55: affected → wontfix
status-firefox56: affected → wontfix
status-firefox57: affected → fix-optional
You need to log in before you can comment on or make changes to this bug.