2030461 - Tab crash after drag-and-dropping and reading nested folder structure

Status: VERIFIED FIXED

(Core :: DOM: File, defect)

Description

[Mark]

Attachment: out.webm

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0

Steps to reproduce:

A tab can be crashed by drag-and-dropping a specific folder structure, and trying to recursively list their sub-folders.
This crash happens on windows, when dragging a folder from windows explorer. (Might also happen in other cases)
Note that this doesn't crash the entire browser, only the affected tab.
I'm using windows 10, and firefox developer edition 150.0b7

To reproduce, add this javascript code to a webpage:

window.addEventListener("dragover", ev => ev.preventDefault());

window.addEventListener("drop", async ev => {
    ev.preventDefault();

    const { dataTransfer } = ev;
    if (dataTransfer === null) {
        return;
    }

    /** @type {FileSystemEntry[]} */
    const queue = [];

    for (const item of dataTransfer.items) {
        const entry = item.webkitGetAsEntry();
        if (entry !== null) {
            queue.push(entry);
        }
    }

    while (queue.length > 0) {
        const entry = queue.pop();

        if (entry.isDirectory) {
            /** @type {FileSystemDirectoryEntry} */
            const folder = entry;

            const reader = folder.createReader();

            /** @type {FileSystemEntry[]} */
            const entries = await new Promise(res => {
                reader.readEntries(res);
            });

            if (entries !== null) {
                queue.push(...entries);
            }
        }
    }
});

Then drop a folder onto the page, which has at least one sub-folder. For example:

drop this
└─── test

(the drop this folder has a test sub-folder)

After dropping the folder, the tab crashes after reaching the reader.readEntries line for the second time.

Actual results:

The tab crashed.

Expected results:

The tab should not crash.

Comment 1

[Mayank Bansal]

Confirmed crash on Nightly : https://crash-stats.mozilla.org/report/index/20364201-87f8-4bea-b891-640a50260409

Comment 2

[Mayank Bansal]

Attachment: Reporters Testcase.html

Open the testcase and drag-and-drop a nested folder onto it.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 desktop browser crashes on nightly

For more information, please visit BugBot documentation.

Comment 4

[Jari Jalkanen [:jari]]

Thank you for the excellent report!

Comment 5

[Jari Jalkanen [:jari]]

Attachment: Bug 2030461 - Use platform path separators with paths from nsIFile. r=#dom-storage

Comment 6

[Andrew McCreight [:mccr8]]

I'll call this S2 because it is at least one piece of a top crash.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/13a478bb2af3
https://hg.mozilla.org/integration/autoland/rev/9db7c69f1bd2
Use platform path separators with paths from nsIFile. r=dom-storage-reviewers,asuth

Comment 8

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/9db7c69f1bd2

Comment 9

[Jari Jalkanen [:jari]]

Attachment: Bug 2030461 - Use platform path separators with paths from nsIFile.

Original Revision: https://phabricator.services.mozilla.com/D293871

Comment 10

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Fixes a top crasher: prevents users from dragging and dropping folders on Windows.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: 1. Create a upper folder, which contains a lower folder, which contains some file (content doesn't matter.)

2. Use google drive, youtube upload etc. where you can drag-and-drop file system items to a browser window. The site should be such that it keeps inventory locally. This can be checked from devtools storage panel - it should show something under IDB/indexedDB menu.
3. Drag and drop the upper folder to the appropriate drop target.
4. Expected: The content gets loaded appropriately
5. Without the fix: The tab will crash

• Risk associated with taking this patch: low
• Explanation of risk level: This is easy to validate and it's a small, well-localized fix.
• String changes made/needed?: -
• Is Android affected?: yes

Comment 11

[Donal Meehan [:dmeehan]]

Updated the affected versions based on the regressor
:jari, is this a nightly only crash due to asserts? Wondering why we don't see it in beta for Fx150?

Comment 12

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/da7838b04520
https://hg.mozilla.org/releases/mozilla-beta/rev/5d03daaedee6

Comment 13

[Jari Jalkanen [:jari]]

(In reply to Donal Meehan [:dmeehan] from comment #11)

Updated the affected versions based on the regressor
:jari, is this a nightly only crash due to asserts? Wondering why we don't see it in beta for Fx150?

No this is an IPC_FAIL response which will crash the tab and impacts popular sites under particular conditions. If I read it correctly, the regressor is in 150 and this fix is strictly necessary.

Comment 14

[Monica Chiorean]

I was able to reproduce the tab crash on Win11x64 using Firefox build 150.0(20260415192539) and steps from comment #10.
Verified as fixed on Win11x64 using Firefox build 152.0a1(20260421211246).
Waiting for next Beta to check in the fix.

Comment 15

[Donal Meehan [:dmeehan]]

(In reply to Jari Jalkanen [:jari] from comment #13)

(In reply to Donal Meehan [:dmeehan] from comment #11)

Updated the affected versions based on the regressor
:jari, is this a nightly only crash due to asserts? Wondering why we don't see it in beta for Fx150?

No this is an IPC_FAIL response which will crash the tab and impacts popular sites under particular conditions. If I read it correctly, the regressor is in 150 and this fix is strictly necessary.

We're not seeing any crash volume outside of nightly. This would also need uplift requests for release and ESR115/ESR140

Comment 16

[Monica Chiorean]

Verified as fixed on Win11x64/Mac15.5/Ubuntu 24.04 using Firefox build 151.0b1(20260422120759).

Comment 18

[Dianna Smith [:diannaS]]

:jari did you want to uplift this for next weeks dot release (desktop+esr)? I did see it mentioned in reddit just not sure if it is the same thing

Comment 19

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined/Reason for urgency: Fixes a windows crasher: prevents users from dragging and dropping folders on Windows.

NB: Replicating the beta uplift request modulo not calling this a top crasher because comment 15 said reported crashes were only experienced on nightly. I am requesting esr115 since bug 2022276 was uplifted there as well.

• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: 1. Create a upper folder, which contains a lower folder, which contains some file (content doesn't matter.)

2. Use google drive, youtube upload etc. where you can drag-and-drop file system items to a browser window. The site should be such that it keeps inventory locally. This can be checked from devtools storage panel - it should show something under IDB/indexedDB menu.
3. Drag and drop the upper folder to the appropriate drop target.
4. Expected: The content gets loaded appropriately
5. Without the fix: The tab will crash

• Risk associated with taking this patch: low
• Explanation of risk level: This is easy to validate and it's a small, well-localized fix.
• String changes made/needed?: -
• Is Android affected?: yes

Comment 20

[Andrew Sutherland [:asuth] (he/him)]

Attachment: Bug 2030461 - Use platform path separators with paths from nsIFile.

Original Revision: https://phabricator.services.mozilla.com/D293871

Comment 21

[Andrew Sutherland [:asuth] (he/him)]

Attachment: Bug 2030461 - Use platform path separators with paths from nsIFile.

Original Revision: https://phabricator.services.mozilla.com/D293871

Comment 22

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: Fixes a windows crasher: prevents users from dragging and dropping folders on Windows.

NB: Replicating the beta uplift request modulo not calling this a top crasher because comment 15 said reported crashes were only experienced on nightly. I am requesting esr115 since bug 2022276 was uplifted there as well.

• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: 1. Create a upper folder, which contains a lower folder, which contains some file (content doesn't matter.)

2. Use google drive, youtube upload etc. where you can drag-and-drop file system items to a browser window. The site should be such that it keeps inventory locally. This can be checked from devtools storage panel - it should show something under IDB/indexedDB menu.
3. Drag and drop the upper folder to the appropriate drop target.
4. Expected: The content gets loaded appropriately
5. Without the fix: The tab will crash

• Risk associated with taking this patch: low
• Explanation of risk level: This is easy to validate and it's a small, well-localized fix.
• String changes made/needed?: -
• Is Android affected?: yes

Comment 23

[Andrew Sutherland [:asuth] (he/him)]

Attachment: Bug 2030461 - Use platform path separators with paths from nsIFile.

Original Revision: https://phabricator.services.mozilla.com/D293871

Comment 24

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Fixes a windows crasher: prevents users from dragging and dropping folders on Windows.

NB: Replicating the beta uplift request modulo not calling this a top crasher because comment 15 said reported crashes were only experienced on nightly. I am requesting esr115 since bug 2022276 was uplifted there as well.

• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: 1. Create a upper folder, which contains a lower folder, which contains some file (content doesn't matter.)

2. Use google drive, youtube upload etc. where you can drag-and-drop file system items to a browser window. The site should be such that it keeps inventory locally. This can be checked from devtools storage panel - it should show something under IDB/indexedDB menu.
3. Drag and drop the upper folder to the appropriate drop target.
4. Expected: The content gets loaded appropriately
5. Without the fix: The tab will crash

• Risk associated with taking this patch: low
• Explanation of risk level: This is easy to validate and it's a small, well-localized fix.
• String changes made/needed?: -
• Is Android affected?: yes

Comment 25

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/866bb588a52f

Comment 29

[Monica Chiorean]

I was able to verify the fix on Win11x64 using treeherder build 140.11.0esr(20260429200123). Marking as verified.

Comment 30

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/e5e5d572e6b3

Comment 31

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/68bdabab8b8d
https://hg.mozilla.org/releases/mozilla-release/rev/76bc79e15e19

Comment 32

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/8bdb2c734537

Comment 33

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/7009fa164e12

Comment 34

[Monica Chiorean]

I was able to verify the fix on Win11x64 using builds 115.35.2esr(20260506115224) and 150.0.2(20260506140522).