Open Bug 1524237 Opened 3 years ago Updated 2 months ago

Crash in mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PContent::Msg_SetClipboard on attempt to copy much text into the clipboard

Categories

(Core :: Widget, defect, P1)

defect

Tracking

()

Tracking Status
firefox-esr78 --- affected
firefox89 --- affected
firefox90 --- affected
firefox91 --- affected

People

(Reporter: aryx, Unassigned)

References

(Regression)

Details

(Keywords: crash, reproducible, Whiteboard: widget-next)

Crash Data

This bug is for crash report bp-5e257e8c-18d7-4fa1-84c0-f112b0190131.

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::ProcessLink::SendMessage ipc/glue/MessageLink.cpp:152
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:995
2 xul.dll mozilla::dom::PContentChild::SendSetClipboard ipc/ipdl/PContentChild.cpp:2711
3 xul.dll nsClipboardProxy::SetData widget/nsClipboardProxy.cpp:36
4 xul.dll static nsresult SelectionCopyHelper dom/base/nsCopySupport.cpp:269
5 xul.dll nsCopySupport::FireClipboardEvent dom/base/nsCopySupport.cpp:801
6 xul.dll nsClipboardCommand::DoCommand dom/base/nsGlobalWindowCommands.cpp:525
7 xul.dll nsControllerCommandTable::DoCommand dom/commandhandler/nsControllerCommandTable.cpp:140
8 xul.dll nsBaseCommandController::DoCommand dom/commandhandler/nsBaseCommandController.cpp:123
9 xul.dll nsresult nsXBLPrototypeHandler::DispatchXBLCommand dom/xbl/nsXBLPrototypeHandler.cpp:541

Reproduces on Ubuntu 16.10 (tested with 64.0 64-bit) and Windows 8.1 (latest Nightly 67.0a1 32-bit and 65.0 64-bit)

Steps to reproduce:

  1. Open https://taskcluster-artifacts.net/HYfODDPwRwqqFSFf1QzG2w/0/public/logs/live_backing.log
  2. Hit Ctrl+A (crashes on Linux, auto copy?)
  3. Hit Ctrl+C

Linux crash report: bp-1f114fb3-f707-4239-8622-3a3ac0190131

Priority: -- → P3
Whiteboard: widget-next

I reproduced this with bp-d1490658-2ef2-434a-8982-3cede0190629

STR:

  1. Create a 64 MB file, e.g. python -c 'print("x x "*16777216)' > /tmp/quitebig.txt
  2. Hit Ctrl-A. On Linux, selecting text puts the text on the primary clipboard.
  3. If not on Linux, press Ctrl-C to put the text on the clipboard.

Expected:

  • Text is selected, and put on the clipboard.
  • Alternatively, the text is not put on the clipboard, but an error is reported to the global JS console / stderr.

Actual:

  • Tab crashes.
Duplicate of this bug: 1638800
Crash Signature: [@ mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PContent::Msg_SetClipboard] → [@ mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PContent::Msg_SetClipboard] [@ mozilla::ipc::MessageChannel::Send | mozilla::ipc::IProtocol::ChannelSend | IPC_Message_Name=PContent::Msg_SetClipboard] [@ mozilla::ipc::MessageChannel::Send | …
See Also: → 1564196

The issue is that there is an attempt to serialize the whole nsTransferable to send it over IPC. There used to be a file-based cache for large clipboard data (which results in a reasonably-sized IPC message), but that was disabled for content processes because opening files is not allowed in the content process (bug 1482540).

There is some more context on this cache and its behavior at https://bugzilla.mozilla.org/show_bug.cgi?id=1433030#c20 and the linked bugs.

To fix this bug without regressing on behavior (i.e. still being able to copy lots of data), the clipboard content should be shared separately from the main IPC message when it's too large.

See Also: → 1482540
Crash Signature: IPC_Message_Name=PContent::Msg_SetClipboard] → IPC_Message_Name=PContent::Msg_SetClipboard] [@ mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PContent::Reply_GetClipboard]
Duplicate of this bug: 1681335

Bug 1564196 comment 1 says this may be a regression from 2015 bug 1071562.

The 67 MB log file that crashed Firefox can be selected and copied in Chrome. Safari, however, won't even select the text.

Severity: critical → S1
Crash Signature: IPC_Message_Name=PContent::Msg_SetClipboard] [@ mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PContent::Reply_GetClipboard] → IPC_Message_Name=PContent::Msg_SetClipboard] [@ mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PContent::Reply_GetClipboard] [@ mozilla::ipc::MessageChannel::Send | mozilla::dom::PContentChild::SendSetClipboard | IPC_Message_Name=PContent::M…
Keywords: reproducible
Priority: P3 → P1
Regressions: 1071562
Severity: S1 → S2
Regressed by: 1071562
No longer regressions: 1071562
See Also: → 1719760
You need to log in before you can comment on or make changes to this bug.