988311 - Roboform-cased crashes in nsACString_internal::SetCapacity(unsigned int, mozilla::fallible_t const&)

Status: VERIFIED FIXED

(Firefox :: Extension Compatibility, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-c4e4f709-0c9b-4e25-839a-5b2522140325.
=============================================================

This is a startup crasher on Aurora (fx30) that has been around in light volume for a long time. Something has caused it to rise in volume since builds of 20140321. However, it was creeping up a bit with builds of 20140319 and 20140320. So it's not clear when it regressed exactly.

Comment 1

[Benjamin Smedberg]

This particular example has roboform.dll/rf-firefox-22. Is that common across them all? I wouldn't expect roboform-22 to be loaded into FF30, and I thought roboform stopped using XPCOM binaries altogether...

Comment 2

[Tracy Walker [:tracy]]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #1)
> This particular example has roboform.dll/rf-firefox-22. Is that common
> across them all? I wouldn't expect roboform-22 to be loaded into FF30, and I
> thought roboform stopped using XPCOM binaries altogether...

Yes, roboform.dll/rf-firefox-22 is common to all the reports.

Comment 3

[Makoto Kato [:m_kato]]

bp-af0844d3-25a5-4a5a-9822-5abe32140324 is same issue

Comment 4

[Vadim Maslov]

you should upgrade RoboForm to ver 7.9.5.

you use really old version

Comment 5

[Benjamin Smedberg]

dmajor can you just DLL-block this? It's not an updated roboform so it's not actually *working* for these people anyway.

Comment 6

[(Away)]

I don't think this is a matter of old versions. The report in comment 0 is up to date:

    Image name: rf-firefox-22.dll
    Timestamp:        Sat Mar 01 07:04:26 2014 (5310CFAA)
    File version:     7.9.5.5

Given the compile date, maybe the number means "for 22 and higher"? I think we need to do some more digging on this.

Comment 7

[(Away)]

Each of the signatures has only a few dozen reports. Is this really a topcrash?

Comment 8

[(Away)]

I saw a crash report on 7.9.6.6 as well.

I'm not convinced there's a good enough case to take action here.

Comment 9

[(Away)]

To be clear, any of these would be good enough in my book:

* High volumes
* Old roboform only
* Clear FF regression
* Reproducible

...but I don't see any of these factors here. Let me know if I've overlooked something.

Comment 10

[Tracy Walker [:tracy]]

This is no longer a topcrash on Fx30. And the table for this signature is no longer showing why I marked it as such in the first place.  :-/

Comment 11

[Vadim Maslov]

ok, here is updated info from RoboForm developers.

RoboForm2Go crashes Firefox ver 30 (alpha)
seen in our dumps and in Firefox's bugzilla too, see this thread for instance.

This is because of change in Firefox ABI which is used for injection.
I will add new rf-firefox-30.dll compiled with the latest Firefox SDK.
The problem is that they did not release it yet in compiled form for Firefox ver 30,
so I have to wait. Compiling it locally from sources is not reliable,
I tried it in the past and the resulting dll crashed. 

Is there any chance to get stable versions of ABI before you release them?
Or alternatively declare that all binary APIs are totally unstable and
nobody should attach to FF from outside using them.

Comment 12

[Benjamin Smedberg]

Our XPCOM ABI is unstable by design. The only safe way to use it is to compile a separate DLL for each release. I thought roboform stopped using binary XPCOM completely?

Comment 13

[Vadim Maslov]

RoboForm has stopped using binary API completely.

But this is RoboForm2Go, portable version.
It attached to Firefox from outside, without being installed,
so it needs binary API to get "initial foothold" in the browser.

I will ask developers what exactly do we use and 
what they propose to make it less binary on FF side.

Comment 14

[Benjamin Smedberg]

dmajor please add rf-firefox-22 to the DLL blocklist.

Comment 15

[Vadim Maslov]

we will fix it soon and publish it.

this is for alpha, as I understand

Comment 16

[Vadim Maslov]

actually developers tell me that we cannot do a release,
since Mozilla did not release SDK for Firefox 30.

Comment 17

[Benjamin Smedberg]

30 SDK appears to be in its normal spot: http://ftp.mozilla.org/pub/mozilla.org/xulrunner/nightly/30.0b1-candidates/build1/sdk/

Comment 18

[Benjamin Smedberg]

My other concern is that this DLL was being loaded into Firefox 30 at all. Why would you choose to load this DLL into any future/unknown version of Firefox at all, knowing that it's unlikely to be compatible and will probably cause problems?

Comment 19

[Vadim Maslov]

1) we will change to the new API in the next RF version

2) mid-term we will probably just kill RF2Go on Firefox.
with lack of stable APIs attaching to browser from outside become too bothersome.

Comment 20

[(Away)]

Attachment: blocklist

Not sure whether this one is ready to proceed. Let me know if/when.

Comment 21

[Vadim Maslov]

We will have a new release in 1-2 days that addresses the issue

Comment 22

[Benjamin Smedberg]

Will the new release still have the DLL name rf-firefox-22.dll or will it be something like rf-firefox-30.dll?

If it is still rf-firefox-22.dll, what will the DLL version number be? The version number of the current broken version appears to be 7.9.5.5.

Comment 23

[Vadim Maslov]

it will have a different name

DLL name is based on SDK version

Comment 24

[Benjamin Smedberg]

Comment on attachment 8418572 [details] [diff] [review]
blocklist

Let's get the old one blocked in Firefox 30+ then. Thanks.

Comment 25

[Vadim Maslov]

seems reasonable.

I guess it will not cause blocking of this DLL in existing FF ver 29 and earlier?

this would be undesirable

Comment 26

[Benjamin Smedberg]

Correct, this block will only apply to FF30+

Comment 27

[(Away)]

Attachment: Blocklist rf-firefox-22.dll

Patch as landed, updated to all versions of this filename

http://hg.mozilla.org/integration/mozilla-inbound/rev/2175e6154ed7

Comment 28

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/2175e6154ed7

Comment 29

[(Away)]

Comment on attachment 8419034 [details] [diff] [review]
Blocklist rf-firefox-22.dll

These crashes aren't super huge volume but I'm flagging per comment 24.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): RoboForm2Go
User impact if declined: Crashes
Testing completed (on m-c, etc.): been on m-c a few days
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch: none

Comment 30

[(Away)]

Sheriffs: the patch will apply more easily if you uplift bug 1002748 before this one.

Comment 31

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/69aff1330269
https://hg.mozilla.org/releases/mozilla-beta/rev/79e75d908e1d

Comment 32

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/79e75d908e1d

Comment 33

[Tracy Walker [:tracy]]

There is but a single report of this crash (on 30.0Beta5) since this landed everywhere. 

It is one of type [@ nsACString_internal::MutatePrep(unsigned int, char**, unsigned int*)]. https://crash-stats.mozilla.com/report/index/665c24a0-2612-4ae1-8517-61f5c2140518 If this particular signature happens to rise significantly volume, I'll file a new bug for it only.

Comment 34

[Vadim Maslov]

RoboForm2Go ver 7-9-7 has been released, it contains the fix for this crash.