292823 - Crash [@ nsDirEnumerator::HasMoreElements()] or [@ CarbonCore.557.0.0]

Status: RESOLVED WORKSFORME

(Core :: XPCOM, defect)

Description

[Robert Strong (they/them - no direct email)]

A crash can occur on Mac OS X in nsDirEnumerator::HasMoreElements() (CarbonCore
is at the top of the stack) when it is called after the directory has been
deleted. The nsIDirectoryEnumerator interface where this was discovered was
introduced by Bug 291177. This is a spin off of Bug 292362 which fixes the
incorrect code in the caller and this bug is for fixing the interface so that
when the calling code is incorrect this interface doesn't cause a crash on Mac OS X.

Note: This doesn't cause a crash on Win32 or Linux as reported in Bug 292362

Comment 1

[Robert Strong (they/them - no direct email)]

Talkback data

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=CarbonCore.557.0.0&vendor=MozillaOrg&product=FirefoxTrunk&platform=All&buildid=&sortby=bbid

Comment 2

[Caleb]

Is this still reproducable? If not, mark this as WFM.

Comment 3

[Robert Strong (they/them - no direct email)]

Caleb - there are only a couple of call sites that use
nsDirEnumerator::HasMoreElements since it was recently added and they have to
use it improperly and test on Mac OS X to cause the crash as stated in comment
#0. It will take someone that has the time and possibly Mac OS X experience to
fix this.

Comment 4

[Jesse Ruderman]

rs, want to make a mochitest for this, so it will be easy for someone with the Mac OS X experience to reproduce and fix the bug?

Comment 5

[Robert Strong (they/them - no direct email)]

I wrote a simple unit test and Mossop wasn't able to reproduce it. Resolving -> WFM. I'll attach the unit test in a bit in case someone wants to make a crashtest out of it

Comment 6

[Robert Strong (they/them - no direct email)]

Attachment: unit test