Crash in _moz_pixman_region32_copy working with folder [Mac]

RESOLVED FIXED in Firefox 61

Status

()

defect
P2
critical
RESOLVED FIXED
Last year
9 months ago

People

(Reporter: wsmwk, Assigned: mstange)

Tracking

({crash})

Trunk
mozilla62
Unspecified
macOS
Points:
---

Firefox Tracking Flags

(firefox-esr52 wontfix, firefox-esr60 wontfix, firefox60 wontfix, firefox61 fixed, firefox62 fixed)

Details

(Whiteboard: [tbird crash], crash signature)

Attachments

(1 attachment)

Reporter

Description

Last year
#10 crash for Macs


The user of bp-8b0e7652-e940-43fe-9381-5bad80180505 writes "While trying to create a new subfolder. "

=============================================================
Top 6 frames of crashing thread:

0 XUL _moz_pixman_region32_copy gfx/cairo/libpixman/src/pixman-region.c:523
1 XUL -[ChildView mouseUp:] /builds/slave/tb-rel-c-esr52-m64_bld-0000000/build/objdir-tb/x86_64/dist/include/nsRegion.h:67
2 AppKit -[NSWindow _handleMouseUpEvent:isDelayedEvent:] 
3 AppKit -[NSWindow _reallySendEvent:isDelayedEvent:] 
4 AppKit -[NSWindow sendEvent:] 
5 AppKit -[NSApplication sendEvent:] 
=============================================================


bp-657edeb0-fcce-4d58-ac55-ed70b0180325 is "moving folder from one account to another account"
bp-8f417869-1441-4287-b9c4-d9c1a0180512 is Firefox 60, so I change component to Core
Component: General → Graphics
Product: Thunderbird → Core
Maybe Lee knows what's going on here?
Flags: needinfo?(lsalzman)
Priority: -- → P2
It seems like, inside the ChildView mouseUp handler that mGeckoChild is possibly a null pointer. So when it tries to call GetNonDraggableRegion() on it, it invokes the nsRegion copy constructor, which is then objecting to the source being an offset from said null pointer.

Markus, since you implemented that particular code in bug 1070710, want to take a look?
Flags: needinfo?(lsalzman) → needinfo?(mstange)
Assignee

Comment 4

Last year
Right on. There's even this comment just above the call:

  // This might destroy our widget (and null out mGeckoChild).
Assignee: nobody → mstange
Status: NEW → ASSIGNED
Flags: needinfo?(mstange)
Comment hidden (mozreview-request)

Comment 6

Last year
mozreview-review
Comment on attachment 8981261 [details]
Bug 1461118 - Null-check mGeckoChild after calling DispatchInputEvent.

https://reviewboard.mozilla.org/r/247352/#review253396
Attachment #8981261 - Flags: review?(spohl.mozilla.bugs) → review+

Comment 7

Last year
Pushed by mstange@themasta.com:
https://hg.mozilla.org/integration/autoland/rev/f620bf59c952
Null-check mGeckoChild after calling DispatchInputEvent. r=spohl
https://hg.mozilla.org/mozilla-central/rev/f620bf59c952
Status: ASSIGNED → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla62
Does seem worth worrying about for ESR60, but a Beta uplift wouldn't hurt since we're only halfway through the cycle.
Flags: needinfo?(mstange)
Assignee

Comment 10

Last year
Comment on attachment 8981261 [details]
Bug 1461118 - Null-check mGeckoChild after calling DispatchInputEvent.

Approval Request Comment
[Feature/Bug causing the regression]: probably bug 1072391, four years ago
[User impact if declined]: crashes on rare mouse interactions
[Is this code covered by automated tests?]: no
[Has the fix been verified in Nightly?]: no
[Needs manual test from QE? If yes, steps to reproduce]: no, mostly affects Thunderbird and steps to reproduce are unclear
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: it's just an addition of an obviously-necessary null check
[String changes made/needed]: none
Flags: needinfo?(mstange)
Attachment #8981261 - Flags: approval-mozilla-beta?
Comment on attachment 8981261 [details]
Bug 1461118 - Null-check mGeckoChild after calling DispatchInputEvent.

Adds a null check to fix a rare crash. Approved for 61.0b10.
Attachment #8981261 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Reporter

Comment 13

9 months ago
No crashes reported in Thunderbird nightly, so impossible to tell whether this is fixed until we build beta 63 (we've skipped 61 and 62)
Whiteboard: [tbird crash]
You need to log in before you can comment on or make changes to this bug.