1918579 - Tab crashes when dropping text from an external program

Status: VERIFIED FIXED

(Firefox :: Data Loss Prevention, defect)

Description

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Found in

• 132.0a1

Affected versions

• 132.0a1 (2024-09-12)

Tested platforms

• Affected platforms: Windows 11, Windows 10
• Unaffected platforms:macOS 12, Ubuntu 22

Preconditoins

• Download the DLP test assets from https://drive.google.com/file/d/1yjqVRuxdKV3WnO7D2wzMgDXBuYBxUgVw/view
• Create a distribution folder inside the Firefox folder and paste the policies-1.json to it and then rename it to policies.json
• Run the DLP agent in CMD using: .\content_analysis_sdk_agent.exe --user --toblock=.\d{3}-?\d{2}-?\d{4}. --towarn=.warn. --delays=10

Steps to reproduce

1. Open Notepad++/ Notepad and write some random text
2. Open https://www.wikipedia.org/ and drop the text in the search box.

Expected result

• The scan is performed and text is dropped(depending on the text).

Actual result

• Tab crashes.

Regression range

• This probably happens after bug 1910452. I will set it as the regressor. Please let us know if this is incorrect.

Additional notes

• Attached a screen recording.
• The crash may be intermittent but happens often, setting this as [fidefe-quality-foundation?].

Comment 1

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Attachment: crash_drop.gif

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1910452

:handyman, since you are the author of the regressor, bug 1910452, could you take a look?

For more information, please visit BugBot documentation.

Comment 3

[Greg Stoll :gstoll]

I can reproduce this, but not on every website. (note that it reproduces on https://www.wikipedia.org, but not https://en.wikipedia.org)

We're hitting MOZ_ASSERT(dragSession) in BrowserChild::RecvDispatchToDropTargetAndResumeEndSession. FWIW mPuppetWidget is non-null and looks reasonable to me, but mDelayedDropPoint looks like it's (0,0), which I'm not sure is expected.

Comment 4

[David Parks [:handyman]]

Thanks, Greg!

Comment 5

[Greg Stoll :gstoll]

The problem seems to be that this code in IMEContentObserver.cpp detects that the focus has changed, so it blanks out the reply to the eQueryDropTargetHitTest message. The caller doesn't care about mContentsRoot so maybe it's OK to skip the check in this case?

Comment 6

[Greg Stoll :gstoll]

Attachment: Bug 1918579 - don't crash when dropping with content analysis and focus changes r=#dlp-reviewers!,masayuki!

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a0bc6b19deda
don't crash when dropping with content analysis and focus changes r=masayuki,dlp-reviewers,handyman

Comment 8

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/a0bc6b19deda

Comment 9

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Verified fixed with Firefox 132.0a1 (20240918041351) on Windows 10x64 and 11. The tab no longer crashes after dropping text from an external program.