1380214 - Crash in IPCError-browser | PBrowserParent::RecvPDocAccessibleConstructor Constructing a top-level PDocAccessible with null COM

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Ting-Yu Chou [:ting] (away)]

This bug was filed from the Socorro interface and is 
report bp-fcb2988f-32ca-4188-ac71-362590170710.
=============================================================
Top #17 of Nightly 20170709030204 on Windows.

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

One cause of this is that if we fail to serialize the handler payload, we fail marshaling entirely.

This is entirely possible if for example there is a sandboxing violation during serialization.

Since failing to serialize the handler payload is non-fatal, I think we can modify our code so that we successfully marshal with an empty payload.

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: In addition to checking for null mSerializer pointer, also check for failed state

This patch adds a check that ends up calling

https://dxr.mozilla.org/mozilla-central/rev/aff336ac161daa3ea350e59a288963edbd58ed39/ipc/mscom/StructStream.h#92

to check for a successful error code. It is non-fatal for payload serialization to fail, so we just resort to writing an empty struct in that case.

This allows us to successfully marshal an accessible even if the payload fails to serialize for some reason, thus preventing some (hopefully most or all) instances of the crash in this bug.

Comment 3

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: In addition to checking for null mSerializer pointer, also check for failed state (r2)

I realized that we should also be checking this when computing the payload size.

Comment 4

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: In addition to checking for null mSerializer pointer, also check for failed state (r3)

For real this time.

Comment 5

[(No longer employed by Mozilla) Aaron Klotz]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9fa7419d9080260365669174e4ed13c65280492d
Bug 1380214: Ensure that if the handler payload fails to serialize that we may still marshal the accessible itself; r=eeejay

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9fa7419d9080

Comment 7

[Julian Seward [:jseward]]

This signature is still showing up in the Windows nightly of 20170720030203,
as topcrash #3.

Comment 8

[alexander :surkov (:asurkov)]

Aaron, do we need to file a new bug for this stack signature (comment 7)?

Comment 9

[(No longer employed by Mozilla) Aaron Klotz]

We can use bug 1383501 for that purpose.