1715812 - Trouble reading strings from "mac_crash_info" in the CoreUI private framework

Status: RESOLVED WONTFIX

(Toolkit :: Crash Reporting, defect)

Description

[Steven Michaud [:smichaud] (Retired)]

I've found two crash reports where I think this is happening:

bp-34fe2d10-fd78-42ea-a143-c130f0210610
bp-90ab5997-bc5e-4dc8-951e-aac180210610

    {
      "num_records": 1,
      "records": [
        {
          "message": "\u043d#\u0012\u0001",
          "module": "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
        }
      ]
    }

    {
      "num_records": 1,
      "records": [
        {
          "message": "\u0080\u00a32\u0085\u0001",
          "module": "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
        }
      ]
    }

Give me a few days, and I'll write a HookCase hook library to pin down exactly what's going on.

Comment 1

[Steven Michaud [:smichaud] (Retired)]

It's conceivable that this problem is specific to "mac crash info" from the CoreUI private framework:

https://crash-stats.mozilla.org/search/?mac_crash_info=~CoreUI&date=%3E%3D2021-03-10T15%3A58%3A00.000Z&date=%3C2021-06-10T15%3A58%3A00.000Z&_facets=signature&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 2

[Steven Michaud [:smichaud] (Retired)]

minidump_stackwalk has the same problem. So the bug must be in the Mozilla tree.

I'll be working on this.

Comment 3

[Steven Michaud [:smichaud] (Retired)]

This seems to be an Apple bug.

There's a _CUILog() function in the CoreUI private framework that writes a CFString/NSString object to that module's mac_crash_info's message field, then deletes it. This is two violations of the mac_crash_info "protocol": 1) All strings fields should contain UTF8 strings 2) The memory they occupy should be valid.

The message "object" written by _CUILog() is full of 0xe5 characters (a poison value for memory formerly used by deleted objects). And even if it weren't, it would be unparseable by code that expects a UTF8 or ASCII string.

The question now is what to do about it. Maybe we should just do nothing. Apparently this error condition doesn't always cause a crash. (And when it did, the crash stacks would be distinctive enough to be noticeable.) And it seems to be quite rare -- only two examples since Mozilla started gathering mac_crash_info about a month ago.

And even if we wanted to, there might be nothing we can do. I'll think about this for a while.

Comment 4

[Steven Michaud [:smichaud] (Retired)]

Interestingly, this bug also effects Safari:

    Application Specific Information:
    Ó¥F¸

Comment 5

[Steven Michaud [:smichaud] (Retired)]

Attachment: HookCase hook library I tested with

Comment 6

[Steven Michaud [:smichaud] (Retired)]

I think we should do nothing here, at least for the time being.