1860321 - Crash in [@ mozilla::dom::Directory::GetFileSystem]

Status: RESOLVED FIXED

(Core :: DOM: File, defect, P3)

Description

[andrew.kemeklis]

Crash report: https://crash-stats.mozilla.org/report/index/01286c2f-84b2-48d1-80f0-687ed0231017

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  RefPtr<mozilla::dom::FileSystemBase>::operator! const  /build/firefox/parts/firefox/build/mfbt/RefPtr.h:350
0  libxul.so  mozilla::dom::Directory::GetFileSystem  /build/firefox/parts/firefox/build/dom/filesystem/Directory.cpp:182
1  libxul.so  mozilla::dom::Directory::GetName  /build/firefox/parts/firefox/build/dom/filesystem/Directory.cpp:105
2  libxul.so  mozilla::dom::HTMLInputElement::nsFilePickerShownCallback::Done  /build/firefox/parts/firefox/build/dom/html/HTMLInputElement.cpp:514
3  libxul.so  nsFilePickerProxy::Recv__delete__  /build/firefox/parts/firefox/build/widget/nsFilePickerProxy.cpp:190
4  libxul.so  mozilla::dom::PFilePickerChild::OnMessageReceived  s3:gecko-generated-sources-l1:57ccb964e36b78689c461ae10fbba9ce1fc8eae3306e939f6c8f5eab3d625144ccaddb91392be8aa2c5face2cb3ce563eb62bd73a7d25ee69050d845b48c6428/ipc/ipdl/PFilePickerChild.cpp::210
5  libxul.so  mozilla::dom::PContentChild::OnMessageReceived  s3:gecko-generated-sources-l1:357add1a746cdabb01fd00b94364df2144bb50a28c9f5f16a9ec27789bacfeca7536fb1820f920c44e18109c84f885e38c0f35970eefcca169843383f06c2b7e/ipc/ipdl/PContentChild.cpp::8654
6  libxul.so  mozilla::ipc::MessageChannel::DispatchAsyncMessage  /build/firefox/parts/firefox/build/ipc/glue/MessageChannel.cpp:1811
6  libxul.so  mozilla::ipc::MessageChannel::DispatchMessage  /build/firefox/parts/firefox/build/ipc/glue/MessageChannel.cpp:1736
6  libxul.so  mozilla::ipc::MessageChannel::RunMessage  /build/firefox/parts/firefox/build/ipc/glue/MessageChannel.cpp:1536

RefPtr<FileSystemBase> mFileSystem not null check is failing due to RefPtr ! operator check on the raw pointer. Should be easy fix to initialize so this !mFileSystem check works and user does not experience crashing.

Comment 1

[BugBot [:suhaib / :marco]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 2

[Jens Stutte [:jstutte]]

It seems that mFilePicker->GetDomFileOrDirectory can return NS_OK and nullptr at the same time, which we do not check before using tmp.

Comment 3

[Jens Stutte [:jstutte]]

I see this mostly happening on Linux. Could it be that this happens if a user manages to pick some weird directory entry that is no file or directory (like symlinks or /dev entries or some such) ? Should GetDomFileOrDirectory just return an error in that case instead of NS_OK or was that done on purpose in bug 1238515 ?

Comment 4

[Jens Stutte [:jstutte]]

(I'd see this more in the Widget component, btw)

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

bug 1238515 was just a renaming bug.

But yes, there should be a null check and error case should be handled like
aResult == nsIFilePicker::returnCancel

Comment 6

[Andrea Marchesini [:baku]]

Attachment: Bug 1860321 - Check the return value of nsIFilePicker::GetDomFileOrDirectory, r?smaug

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b353577b651d
Check the return value of nsIFilePicker::GetDomFileOrDirectory, r=smaug

Comment 8

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/b353577b651d