1818500 - Crash in [@ IPC::EnumSerializer<T>::Write] in mozilla::dom::PBrowserChild::SendPFilePickerConstructor

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

This is hitting reliably for me when trying to add an attachment to an email in Gmail.

Crash report: https://crash-stats.mozilla.org/report/index/da34b842-bb04-41dd-bd7a-724650230223

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(EnumValidator::IsLegalValue( static_cast<std::underlying_type_t<paramType>>(aValue)))

Top 10 frames of crashing thread:

0  xul.dll  IPC::EnumSerializer<nsIFilePicker::Mode, IPC::ContiguousEnumValidatorInclusive<nsIFilePicker::Mode, 0, 2> >::Write  ipc/glue/EnumSerializer.h:60
0  xul.dll  IPC::WriteParam  ipc/chromium/src/chrome/common/ipc_message_utils.h:291
0  xul.dll  mozilla::dom::PBrowserChild::SendPFilePickerConstructor  ipc/ipdl/PBrowserChild.cpp:1782
1  xul.dll  nsFilePickerProxy::Init  widget/nsFilePickerProxy.cpp:38
2  xul.dll  mozilla::dom::HTMLInputElement::InitFilePicker  dom/html/HTMLInputElement.cpp:817
3  xul.dll  mozilla::dom::HTMLInputElement::MaybeInitPickers  dom/html/HTMLInputElement.cpp:3544
3  xul.dll  mozilla::dom::HTMLInputElement::PostHandleEvent  dom/html/HTMLInputElement.cpp:4104
4  xul.dll  mozilla::EventTargetChainItem::PostHandleEvent  dom/events/EventDispatcher.cpp:441
4  xul.dll  mozilla::EventTargetChainItem::HandleEventTargetChain  dom/events/EventDispatcher.cpp:552
5  xul.dll  mozilla::EventTargetChainItem::HandleEventTargetChain  dom/events/EventDispatcher.cpp:629

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1816740

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1818500 - Fix serialization of nsIFilePicker::Mode. r=rkraesig,#ipc-reviewers

modeOpenMultiple is the last variant, this reproduces clicking on:

data:text/html,<input type=file multiple>

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1818500 - Try to re-enable test_picker_no_crash.html. r=rkraesig

This seems to consistently leak an nsFilePickerProxy, at least on Linux,
tho...

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/16f49fd3a5dc
Fix serialization of nsIFilePicker::Mode. r=ipc-reviewers,mccr8 a=RyanVM

Comment 5

[Ryan VanderMeulen [:RyanVM]]

I've landed Emilio's patch on m-c and am getting Nightly respins going. Nightly updates are paused in the mean time.

Comment 6

[Ray Kraesig [:rkraesig]]

Well, there's my morning dose of horror taken care of.

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

This seems to consistently leak an nsFilePickerProxy, at least on Linux,
tho...

If you'd prefer, you can foist that patch on me and I'll take on investigating the leak. Alternatively, we can roll back the entire offending patchset, and you can land the test-enabling patch ahead of it.

Comment 7

[Ray Kraesig [:rkraesig]]

Alternatively, we can roll back the entire offending patchset, and you can land the test-enabling patch ahead of it.

Alternatively alternatively, we can, and probably should, just roll back the final patch of the set, D169855, which was the only one that touched the allocation code.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

FWIW, this test was original disabled way back when due to leaks and crashes (see bug 1267491), so whatever issues it's hitting now very well may not be newly-introduced behaviors from your patches.

Comment 9

[Ray Kraesig [:rkraesig]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)

FWIW, this test was original disabled way back when due to leaks and crashes (see bug 1267491), so whatever issues it's hitting now very well may not be newly-introduced behaviors from your patches.

For the record: your try-push here does indicate that it's preexisting. This bug can probably be closed, and any further work done under bug 1267491.

Comment 10

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1818500 - Try to re-enable test_picker_no_crash.html. r=rkraesig

This seems to consistently leak an nsFilePickerProxy, at least on Linux,
tho...

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/794b37afb146
Try to re-enable test_picker_no_crash.html. r=rkraesig

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/794b37afb146