Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-17843

Firefox 52 crashreporter: crash on riched20 select_style()

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 0.4.15
    • Wine
      • QEMU 0.9.1
      • QEMU 0.10.5
      • Virtual PC 2004 SP1 (5.3.582.27)

    Description

      1. Install ReactOS.
      2. Install Firefox.
      (I disable Maintenance Service. Do not autolaunch at end.)
      3. Enable IgnoreManifestCompatVersion on firefox.exe (shortcut).
      4. Launch Firefox.
      4r1. After a few minutes, it deadlocks. (CORE-12828)
      4r2. Then, its crashreporter starts, begin to display and crashes too.

      reactos-bootcd-0.4.12-dev-1082-ge0e5363-x86-gcc-lin-dbg (LastBeforeReleaseBranch)
      Crashreporter displays fine.

      reactos-bootcd-0.4.13-dev-1227-g94a66f4-x86-gcc-lin-dbg (Unknown!)
      reactos-bootcd-0.4.14-dev-417-g80f091f-x86-gcc-lin-dbg
      Crashreporter displays fine.
      NB: Need to enable IgnoreManifestCompatVersion on Firefox installer too.

      reactos-bootcd-0.4.14-dev-418-g661b8a2-x86-gcc-lin-dbg (Blocks CORE-16441)
      Regressed!
      NB: Need to enable IgnoreManifestCompatVersion on Firefox installer too.

      reactos-bootcd-0.4.14-dev-1563-g950124b-x86-gcc-lin-dbg (Actually 0.4.15-dev-0)

      ReactOS 0.4.15-dev DrWtsn32
       
      FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
      0013F6D8 7A00BD53 00000000 008A001A 77A9F498 00000011 riched20!release_font_cache +0x3
      0013F780 7A00CA6C 0013F7D4 00000000 00000005 0015D7B0 riched20!select_style +0x368
      0013F798 79FE517D 0013F7D4 00000000 010101A2 0000015A riched20!ME_DestroyContext +0x1a
      0013F818 79FF3493 0015D100 010101A2 0013F86C 00000001 riched20!ME_PaintContent +0x277
      0013F8B8 79FEFE90 00000000 00000001 0013F8D8 00000000 riched20!RichEditWndProc_common +0x2ce
      0013F8D0 79FF01E7 01320216 0000000F 00000000 00000000 riched20!RichEditWndProcW +0x35
      0013F900 77A847EE 79FF01B2 01320216 0000000F 00000000 user32!CALL_EXTERN_WNDPROC +0x1a
      0013FA58 77A78A00 00805540 01320216 0000000F 00000000 user32!IntCallWindowProcW +0x15d8
      0013FAB0 77A7A9C9 0013FAC8 00000020 0013FF90 7C92FD74 user32!User32CallWindowProcFromKernel +0x374
      (win32ss/user/ntuser/msgqueue.c:1267) err: MsqSendMessage timed out 2 Status 102
      0013FB50 7C92FDC5 0013FCBC 01320216 0013FBB8 7C92E776 ntdll!KiUserCallbackDispatcher +0x2e
      0013FC90 77A63B49 00080176 0013FCBC 00000000 00000000 user32!IsDialogMessageW +0x988
      0013FCE8 77A63D47 00080176 00000000 00000001 0013FD18 user32!DIALOG_DoDialogBox +0x1a6
      0013FD08 77A63E9E 00000000 00000066 00000000 00405A32 user32!DialogBoxParamW +0xbb
      0013FD30 00405A28 00405A32 0013FD64 00000001 00410898 crashreporter!EntryPoint +0xffffffffffffffff
      0013FD98 00406E99 0013FE6C 0013FEA8 00154B88 002CDC30 crashreporter!EntryPoint +0xffffffffffffffff
      0013FF00 00403CE7 00000000 00414648 7FFD6000 0013FF64 crashreporter!EntryPoint +0xffffffffffffffff
      0013FF54 00403E9D 00400000 00000000 000206A2 00000001 crashreporter!EntryPoint +0xffffffffffffffff
      0013FFA0 0040E8DA FFFFFFFE 00000009 0013FFF8 00000004 crashreporter!EntryPoint +0xffffffffffffffff
      0013FFF0 7C5C16E7 0040E94C 00000000 EC0100ED 00000000 kernel32!BaseProcessStartup +0x35
      

      reactos-bootcd-0.4.15-dev-3361-g39003dd-x86-gcc-lin-dbg
      CORE-17843_0415-3361.txt with set condition * first always.

      Unhandled exception
      ExceptionCode:    c0000005
      Faulting Address:       60
      CS:EIP 1b:79d1b934
      DS 23 ES 23 FS 3b GS 0
      EAX: 001628f8   EBX: 0013f7bc   ECX: 00000000
      EDX: 00000000   EBP: 0013f768   ESI: 00000041   ESP: 0013f6c8
      EDI: 00000000   EFLAGS: 00010202
      Address:
      * <riched20.dll:2b934 (dll/win32/riched20/style.c:362 (select_style))> (C:\ReactOS\System32\riched20.dll@79cf0000)
      Frames:
      * <riched20.dll:51ca (dll/win32/riched20/context.c:47 (ME_DestroyContext))> (C:\ReactOS\System32\riched20.dll@79cf0000)
      * <riched20.dll:13930 (dll/win32/riched20/paint.c:104 (ME_PaintContent))> (C:\ReactOS\System32\riched20.dll@79cf0000)
      * <riched20.dll:1036d (dll/win32/riched20/editor.c:5029 (RichEditWndProc_common))> (C:\ReactOS\System32\riched20.dll@79cf0000)
      * <riched20.dll:10728 (dll/win32/riched20/editor.c:5087 (RichEditWndProcW))> (C:\ReactOS\System32\riched20.dll@79cf0000)
      * <USER32.dll:675ea (srv/buildbot/worker_data/Build_GCCLin_x86/build/win32ss/user/user32/windows/wndproc_fixup.S:48 (CALL_EXTERN_WNDPROC))> (C:\ReactOS\system32\USER32.dll@77a20000)
      * <USER32.dll:5b906 (win32ss/user/user32/windows/message.c:1547 (IntCallWindowProcW))> (C:\ReactOS\system32\USER32.dll@77a20000)
      * <USER32.dll:5d71c (win32ss/user/user32/windows/message.c:3005 (User32CallWindowProcFromKernel))> (C:\ReactOS\system32\USER32.dll@77a20000)
      * <ntdll.dll:10121 (srv/buildbot/worker_data/Build_GCCLin_x86/build/dll/ntdll/dispatch/i386/dispatch.S:142 (KiUserCallbackDispatcher))> (C:\ReactOS\System32\ntdll.dll@7c920000)
      * <USER32.dll:46662 (win32ss/user/user32/windows/dialog.c:2706 (IsDialogMessageW))> (C:\ReactOS\system32\USER32.dll@77a20000)
      * <USER32.dll:468cd (win32ss/user/user32/windows/dialog.c:549 (DIALOG_DoDialogBox))> (C:\ReactOS\system32\USER32.dll@77a20000)
      * <USER32.dll:46b66 (win32ss/user/user32/windows/dialog.c:1949 (DialogBoxParamW))> (C:\ReactOS\system32\USER32.dll@77a20000)
      ? <crashreporter.exe:5a28> (C:\Program Files\Mozilla Firefox\crashreporter.exe@400000)
      ? <crashreporter.exe:6e99> (C:\Program Files\Mozilla Firefox\crashreporter.exe@400000)
      ? <crashreporter.exe:3ce7> (C:\Program Files\Mozilla Firefox\crashreporter.exe@400000)
      ? <crashreporter.exe:3e9d> (C:\Program Files\Mozilla Firefox\crashreporter.exe@400000)
      ? <crashreporter.exe:e8da> (C:\Program Files\Mozilla Firefox\crashreporter.exe@400000)
      * <kernel32.dll:11a42 (dll/win32/kernel32/client/proc.c:463 (BaseProcessStartup))> (C:\ReactOS\system32\kernel32.dll@7c620000)
      err:(/win32ss/user/user32/windows/messagebox.c:1048) MessageBox: L"The instruction at \"0x79d1b934\" referenced memory at \"0x00000060\". The memory could not be \"read\".\r\n\nClick on OK to terminate the program.\nClick on CANCEL to debug the program."
      

      I confirmed that c->current_style->font_cache == NULL.

      https://git.reactos.org/?p=reactos.git;a=blob;f=dll/win32/riched20/style.c;hb=HEAD#l359

       360 static void release_font_cache(ME_FontCacheItem *item)
       361 {
       362     if (item->nRefs > 0)
       363     {
       364         item->nRefs--;
       365         item->nAge = 0;
       366     }
       367 }
       368 
       369 void select_style( ME_Context *c, ME_Style *s )
      ...
       432     if (c->current_style)
       433     {
       434         release_font_cache( c->current_style->font_cache );
       435         c->current_style->font_cache = NULL;
       436     }
      

      Attachments

        Activity

          People

            Serge Gautherie Serge Gautherie
            Serge Gautherie Serge Gautherie
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: