Closed Bug 1424661 Opened 2 years ago Closed 2 years ago

Crash in free.cold.84 | nsClipboard::GetData

Categories

(Core :: Widget: Gtk, defect, critical)

59 Branch
Unspecified
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla59
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 --- unaffected
firefox59 --- fixed

People

(Reporter: calixte, Assigned: stransky)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, Whiteboard: [clouseau])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-6087b658-2d05-440b-bc51-5dd850171210.
=============================================================

Top 10 frames of crashing thread:

0 firefox free.cold.84 
1 libxul.so nsClipboard::GetData widget/gtk/nsClipboard.cpp:340
2 libxul.so mozilla::dom::ContentParent::RecvGetClipboard dom/ipc/ContentParent.cpp:2629
3 libxul.so mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:7674
4 libxul.so mozilla::ipc::MessageChannel::DispatchSyncMessage 
5 libxul.so mozilla::ipc::MessageChannel::DispatchMessage 
6 libxul.so mozilla::ipc::MessageChannel::MessageTask::Run 
7 libxul.so nsThread::ProcessNextEvent 
8 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:508
9 libxul.so mozilla::ipc::MessagePump::Run 

=============================================================

There are 11 crashes with signature 'free.cold.[0-9]+ | nsClipboard::GetData' in nightly 59 starting with buildid 20171209100033. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1417874.

[1] https://hg.mozilla.org/mozilla-central/rev/296dd5f8849a
Flags: needinfo?(stransky)
Looks like double free - will look at it, Thanks!
Assignee: nobody → stransky
Flags: needinfo?(stransky)
Comment on attachment 8936235 [details]
Bug 1424661 - refactor ncClipboard::GetData(), allocate all memory by moz_xmalloc() and release by free(),

https://reviewboard.mozilla.org/r/206998/#review212808

::: widget/gtk/nsClipboard.h:22
(Diff revision 1)
>  #define GTK_DEFAULT_MIME_TEXT "UTF8_STRING"
>  
>  class nsRetrievalContext {
>  public:
> +    // Returned data must be released by free()
>      virtual guchar* WaitForClipboardContext(const char* aMimeType,

The type guchar* is confusing there, we expect the guchar* to be freed by g_free call. 

Since WaitForClipboardContext callers mostly cast the result to const char\*, use const char\* instead of guchar\*. As far as I checked the content of return memory is not modified, therefore you should be fine with const.

::: widget/gtk/nsClipboard.cpp:321
(Diff revision 1)
> -            g_free(data);
> +            free(data);
>  
>              // Try next data format?
>              if (!htmlBodyLen)
>                  continue;
>              data = (guchar *)htmlBody;

This will also need a touch.

::: widget/gtk/nsClipboardX11.cpp:296
(Diff revision 1)
>  
>      GtkSelectionData *selectionData = WaitForContents(clipboard, aMimeType);
>      if (!selectionData)
>          return nullptr;
>  
>      int contentLength = gtk_selection_data_get_length(selectionData);

When touching this, I'm not sure if the contentLength can be 0 or even negative, please check this and do the warning if this happens.

::: widget/gtk/nsClipboardX11.cpp:297
(Diff revision 1)
>      GtkSelectionData *selectionData = WaitForContents(clipboard, aMimeType);
>      if (!selectionData)
>          return nullptr;
>  
>      int contentLength = gtk_selection_data_get_length(selectionData);
> -    guchar* data = reinterpret_cast<guchar*>(g_malloc(sizeof(guchar)*contentLength));
> +    guchar* data =

use char\* there
Attachment #8936235 - Flags: review?(jhorak) → review-
Comment on attachment 8936235 [details]
Bug 1424661 - refactor ncClipboard::GetData(), allocate all memory by moz_xmalloc() and release by free(),

https://reviewboard.mozilla.org/r/206998/#review213386

Looks much better now. Thanks.

::: widget/gtk/nsClipboard.cpp:227
(Diff revision 2)
>    
>      return rv;
>  }
>  
> +void
> +nsClipboard::TransferClipboardData(nsITransferable* aTransferable,

This can be static member and please rename it to something more self describing, like TransferClipboardDataToGecko or something like this.
Attachment #8936235 - Flags: review?(jhorak) → review+
Pushed by stransky@redhat.com:
https://hg.mozilla.org/integration/autoland/rev/70eb26bf8760
refactor ncClipboard::GetData(), allocate all memory by moz_xmalloc() and release by free(), r=jhorak
https://hg.mozilla.org/mozilla-central/rev/70eb26bf8760
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
You need to log in before you can comment on or make changes to this bug.