1407147 - Crash in strlen | libvoikko-1.dll@0x1fe40 with Finnish spellchecker addon

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Other, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-5b2ed882-4736-49e9-9f05-745690170819.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	msvcrt.dll 	strlen 	
Ø 1 	libvoikko-1.dll 	libvoikko-1.dll@0x1fe40 	
Ø 2 	libvoikko-1.dll 	libvoikko-1.dll@0x201cb 	
Ø 3 	libvoikko-1.dll 	libvoikko-1.dll@0x90687 	
Ø 4 	libvoikko-1.dll 	libvoikko-1.dll@0x1a73c 	
5 		@0x6943ff2e4f 	
Ø 6 	libvoikko-1.dll 	libvoikko-1.dll@0xbf74 	
Ø 7 	libvoikko-1.dll 	libvoikko-1.dll@0x435d1 	
Ø 8 	libvoikko-1.dll 	libvoikko-1.dll@0xc954 	
9 	xul.dll 	js::detail::HashTable<js::InitialShapeEntry const, js::HashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::relookupOrAdd<js::InitialShapeEntry const&>(js::detail::HashTable<js::InitialShapeEntry const, js::HashSet<js::InitialShapeEntry, js::InitialShapeEntry, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::AddPtr&, js::InitialShapeEntry::Lookup const&, js::InitialShapeEntry const&) 	obj-firefox/dist/include/js/HashTable.h:1873
10 		@0x21aa2371d87 	
11 	xul.dll 	JS::Zone::getUniqueId(js::gc::Cell*, unsigned __int64*) 	js/src/gc/Zone.h:518
12 		@0x21aa23621f7 	
13 	xul.dll 	js::ctypes::ImplicitConvert 	js/src/ctypes/CTypes.cpp:3505
14 	xul.dll 	js::ctypes::ConvertArgument 	js/src/ctypes/CTypes.cpp:7005
15 	xul.dll 	js::ctypes::FunctionType::Call 	js/src/ctypes/CTypes.cpp:7143
16 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:452
17 	xul.dll 	js::Wrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Wrapper.cpp:166
18 	xul.dll 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/CrossCompartmentWrapper.cpp:353
19 	xul.dll 	xpc::AddonWrapper<js::CrossCompartmentWrapper>::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/xpconnect/wrappers/AddonWrapper.cpp:156
20 	xul.dll 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Proxy.cpp:479
21 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:452
22 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:3064
23 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:410
24 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:488
25 	xul.dll 	InternalConstruct 	js/src/vm/Interpreter.cpp:563
26 	xul.dll 	js::Construct(JSContext*, JS::Handle<JS::Value>, js::AnyConstructArgs const&, JS::Handle<JS::Value>, JS::MutableHandle<JSObject*>) 	js/src/vm/Interpreter.cpp:612
27 	xul.dll 	js::Wrapper::construct(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Wrapper.cpp:185
28 	xul.dll 	js::CrossCompartmentWrapper::construct(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/CrossCompartmentWrapper.cpp:373
29 	xul.dll 	js::Proxy::construct(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Proxy.cpp:499
30 	xul.dll 	js::proxy_Construct(JSContext*, unsigned int, JS::Value*) 	js/src/proxy/Proxy.cpp:748
31 	xul.dll 	InternalConstruct 	js/src/vm/Interpreter.cpp:573
32 	xul.dll 	js::ConstructFromStack(JSContext*, JS::CallArgs const&) 	js/src/vm/Interpreter.cpp:599
33 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:3056
34 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:410
35 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:488
36 	xul.dll 	js::Wrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Wrapper.cpp:166
37 	xul.dll 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/CrossCompartmentWrapper.cpp:353
38 	xul.dll 	xpc::AddonWrapper<js::CrossCompartmentWrapper>::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/xpconnect/wrappers/AddonWrapper.cpp:156
39 	xul.dll 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Proxy.cpp:479
40 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:452
41 	xul.dll 	JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp:2832
42 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJSClass.cpp:1215
43 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJS.cpp:615
44 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/md/win32/xptcstubs_x86_64.cpp:174
45 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/md/win32/xptcstubs_asm_x86_64.asm:57
46 	xul.dll 	nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) 	xpcom/components/nsComponentManager.cpp:1104
47 	xul.dll 	nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) 	xpcom/components/nsComponentManager.cpp:1460
48 	xul.dll 	nsCOMPtr_base::assign_from_gs_contractid_with_error(nsGetServiceByContractIDWithError const&, nsID const&) 	xpcom/base/nsCOMPtr.cpp:106
49 	xul.dll 	mozSpellChecker::GetEngineList(nsCOMArray<mozISpellCheckingEngine>*) 	extensions/spellcheck/src/mozSpellChecker.cpp:571
50 	xul.dll 	mozSpellChecker::GetDictionaryList(nsTArray<nsString>*) 	extensions/spellcheck/src/mozSpellChecker.cpp:325
51 	xul.dll 	mozilla::dom::ContentParent::NotifyUpdatedDictionaries() 	dom/ipc/ContentParent.cpp:4195
52 	xul.dll 	mozHunspell::LoadDictionaryList(bool) 	extensions/spellcheck/hunspell/glue/mozHunspell.cpp:410
53 	xul.dll 	mozHunspell::AddDirectory(nsIFile*) 	extensions/spellcheck/hunspell/glue/mozHunspell.cpp:599
54 	xul.dll 	XPTC__InvokebyIndex 	xpcom/reflect/xptcall/md/win32/xptcinvoke_asm_x86_64.asm:97
55 		@0x21aa3723abf 	
56 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp:1282
57 	xul.dll 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:983
58 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:470
59 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:3064
60 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:410
61 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:488
62 	xul.dll 	js::Wrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Wrapper.cpp:166
63 	xul.dll 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/CrossCompartmentWrapper.cpp:353
64 	xul.dll 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/Proxy.cpp:479
65 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:452
66 	xul.dll 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp:2453
67 		@0x2d7bcbf6a2d 

this is a win64 only crash on windows 8 & 10 with the finish spellchecker addon from https://addons.mozilla.org/firefox/addon/finnish-spellchecker/ 

many user comments say that they crashed immediately after updating to a 64bit version. since the addon is not a webextension, those crashes will probably go away.
not sure what are the options in the meantime (not migrating finish users to win64 or maybe it's even possible to selectively mark the addon as incompatible to 64bit)?

Comment 1

[Chris Peterson [:cpeterson]]

https://addons.mozilla.org/en-US/firefox/addon/finnish-spellchecker/

Jorge, can we mark this Finnish Spellchecker add-on as not compatible with Firefox 56? It is crashing for Win64 Firefox users. We just started migrating some 32-bit users to 64-bit, so more users will be hitting this crash.

I think this is the GitHub repo for the Voikko spellchecker. This repo hasn't been updated since 2016, but other Voikko repos are still active so there

https://github.com/voikko/mozvoikko

Comment 2

[Henri Sivonen (:hsivonen)]

Pinged the voikko development list:
http://lists.puimula.org/pipermail/libvoikko/2017-October/000919.html

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

I added the add-on to the compatibility override list, which should make it appear as incompatible and disable it. Let me know if the crashes don't decrease, and we'll proceed with a block.

Comment 4

[Chris Peterson [:cpeterson]]

(In reply to Henri Sivonen (:hsivonen) from comment #2)
> Pinged the voikko development list:
> http://lists.puimula.org/pipermail/libvoikko/2017-October/000919.html

Thanks!

(In reply to Jorge Villalobos [:jorgev] from comment #3)
> I added the add-on to the compatibility override list, which should make it
> appear as incompatible and disable it. Let me know if the crashes don't
> decrease, and we'll proceed with a block.

Thanks! I didn't realize we had the option of just disabling the add-on instead of blocking it. Since this is a legacy add-on, it won't be compatible with Firefox 57 anyway.

Comment 5

[Chris Peterson [:cpeterson]]

Resolving this bug as fixed because Jorge disabled the crashing add-on.

Comment 6

[timo.jyrinki]

According to the mailing list the bug was fixed in September 2015, but the latest available extension version was built in August 2015 (using libvoikko released in September 2014). So, also an update to the extension would do if there is a maintainer available.

Comment 7

[Chris Peterson [:cpeterson]]

(In reply to Jorge Villalobos [:jorgev] from comment #3)
> I added the add-on to the compatibility override list, which should make it
> appear as incompatible and disable it. Let me know if the crashes don't
> decrease, and we'll proceed with a block.

Jorge, which Firefox versions did you mark as incompatible with the Finnish Spellchecker add-on? We have had at least 160 crash reports from Firefox 56.0.1 after you added the add-on to the compatibility override list (October 13):

https://crash-stats.mozilla.com/search/?cpu_arch=amd64&signature=~libvoikko&product=Firefox&platform=Windows&date=%3E%3D2017-10-14T23%3A18%3A00.000Z&_sort=-date&_facets=signature&_facets=version&_columns=date&_columns=signature&_columns=version&_columns=email#facet-version

Comment 8

[Chris Peterson [:cpeterson]]

I checked a dozen random crash reports and they all had the Finnish Spellchecker ([e-mail]) version 2.1.0, the latest version.

I think we should block the add-on for Firefox 56.0 and later.

Comment 9

[Jorge Villalobos [:jorgev] (he/him)]

Yes, those versions should have been covered by the compatibility override. I'll add a block tomorrow, since I need another admin to confirm it.

Comment 10

[Jorge Villalobos [:jorgev] (he/him)]

The block is now staged. Andreas, please review and push live.

Comment 11

[Andreas Wagner [:TheOne] [use NI]]

The block is now live.

Comment 12

[Chris Peterson [:cpeterson]]

Thanks! I will continue to monitor the spellchecker crash volume.