646895 - Firefox crash [@ trayToolkit.dll@0x2140] (Minimize to Tray addon)

Status: RESOLVED FIXED

(Firefox :: Extension Compatibility, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-addc7291-5918-4346-8dc7-1b6452110328 .
============================================================= 

Found in top changers. https://crash-stats.mozilla.com/report/list?range_value=7&range_unit=days&signature=trayToolkit.dll%400x2140&version=Firefox%3A4.0 links to the report.

100% correlation to Minimize to Tray extension.

100% (14/14) vs.   0% (71/52073) [e-mail] (MinimizeToTray revived, https://addons.mozilla.org/addon/12581)


Frame 	Module 	Signature [Expand] 	Source
0 	trayToolkit.dll 	trayToolkit.dll@0x2140 	
1 	user32.dll 	InternalCallWinProc 	
2 	user32.dll 	UserCallWinProcCheckWow 	
3 	user32.dll 	DispatchClientMessage 	
4 	user32.dll 	__fnDWORD 	
5 	ntdll.dll 	KiUserCallbackDispatcher 	
6 	trayToolkit.dll 	trayToolkit.dll@0x1e33 	
7 	user32.dll 	NtUserPeekMessage 	
8 	xul.dll 	nsAppShell::ProcessNextNativeEvent 	widget/src/windows/nsAppShell.cpp:332

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Adding add-on author.

Comment 2

[Nils Maier [:nmaier]]

I was already aware of this...

This thing is fixed in version 0.9.3, which was released on March 23 and already made public and hence distributed via AMO on March 29.
Looking at the stats for the last 5 days, any crash reports remaining can be attributed either to old versions or random crashes:
https://crash-stats.mozilla.com/query/query?product=Firefox&&range_value=5&range_unit=days&query_search=signature&query_type=contains&query=trayToolkit&do_query=1

I'm not quite sure why, but some code seem to have gotten re-entrant on some systems.
Seems unrelated to Firefox code itself, as it affected also moz-1.9.2, but only reared its ugly head recently. I suspect either a Windows patch or an update to some popular third-party software to be the underlying cause.

I wasn't able to reproduce this myself, but was able to map the location in the source and determine what happened from the stack and crafted fixes with that information.
Better NULL checking and setting (also to prepare for better crash stats):
https://github.com/nmaier/mintrayr/commit/ebe5868488d4701ae2299c17696ce6c2d92def62
Fixing the now re-entrant code path:
https://github.com/nmaier/mintrayr/commit/17bf22f4d30a8482a32e607331ab7e5b34dc3b80