1624251 - Crash in [@ objc_retain | -[NSProgress cancel]]

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect, P1)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-5ab2b585-02c1-49f0-97db-c59e00200322.

Top 10 frames of crashing thread:

0 libobjc.A.dylib objc_retain 
1 Foundation -[NSProgress cancel] 
2 Foundation __NSXPCCONNECTION_IS_CALLING_OUT_TO_EXPORTED_OBJECT_S0__ 
3 Foundation -[NSXPCConnection _decodeAndInvokeMessageWithEvent:flags:] 
4 Foundation message_handler 
5 libxpc.dylib _xpc_connection_call_event_handler 
6 libxpc.dylib _xpc_connection_mach_event 
7 libdispatch.dylib _dispatch_client_callout4 
8 libdispatch.dylib _dispatch_mach_msg_invoke 
9 libdispatch.dylib _dispatch_lane_serial_drain 

Low-volume crash but looks like a nasty one: the NSProgress code is accessing either a NULL or an already freed pointer. Note that this is not happening on the main thread.

Scouring our code-base I found only one use of NSProgress in nsMacFinderProgress.mm.

I'm not familiar with this code but there's something that looks odd. In the destructor we release both the cancellationHandler and the object itself but without calling unpublish first. In the End() method we call unpublish before releasing the object but we don't release the cancellationHandler.

Since this code is being called on a separate thread is it possible we're doing something wrong in one of those two sequences causing a callback to access a nil'd or free'd object?

Comment 1

[Stephen A Pohl [:spohl]]

Christoph, do you have time to take a look at this?

Comment 2

[Christoph Walcher]

I'll take a look. I remember having troubles with a memory leak, which lead to this destructor.

Comment 3

[Christoph Walcher]

Attachment: Bug 1624251 - Fix use-after-free in nsMacFinderProgress

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/40fe811eab33
Fix use-after-free in nsMacFinderProgress r=spohl

Comment 5

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/40fe811eab33