New issue
Advanced search Search tips

Issue 691984 link

Starred by 2 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Bug



Sign in to add a comment

Wrap all attempts to read non-plain-text from NSPasteboard in try/catch blocks.

Reported by tempelm...@gmail.com, Feb 14 2017

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce the problem:
(Note, I am a software developer, so this is pretty technical and I think I know what I'm doing :)

1. The pasteboard needs to be filled with particular data. I'm am including an Applescript that does this. Open it in Script Edito and Run it.
2. Open Chrome and nagivate to a Gmail account.
3. Compose a new email (which opens a pseudo window inside the Gmail window) or even reply to an existing mail (which adds an inline reply below the original mail in my setup).
4. Paste (cmd+V) into the mail body. This leads to a crash.

What is the expected behavior?
Should paste the text ("ListBoxTVPrivate").

What went wrong?
The (valid) rich text from the pasteboard causes Chrome to crash.

Crashed report ID: 617ef476-a554-437f-9ef6-cf4482bc1e79

How much crashed? Whole browser

Is it a problem with a plugin? N/A 

Did this work before? N/A 

Chrome version: 56.0.2924.87  Channel: stable
OS Version: OS X 10.10.5
Flash Version: 

About the clipboard content: The clipboard has to contain "classic" scrap style rich text, without the converted RTF and other modern rich text flavors. There are not many programs any more that create rich text in this old format (mainly pre-Cocoa apps), but it's still valid, and other apps do not crash with it.

 
Labels: Needs-Triage-M56

Comment 2 by a...@chromium.org, Feb 14 2017

This is missing the script; Thomas provided it to me.
Create clipboard contents.scpt
1.7 KB Download

Comment 3 by a...@chromium.org, Feb 14 2017

Cc: a...@chromium.org
Owner: erikc...@chromium.org
Status: Assigned (was: Unconfirmed)
Erik, you were the last one to mess around with the pasteboard, right?

Comment 4 by a...@chromium.org, Feb 14 2017

The OP wants this other archive attached. It contains three things: a screenshot, the AppleScript that I posted for the OP in comment 2, and a crashlog. crsym isn't symbolicating it, but the crash is pretty clear:

0   CoreFoundation                      0x00007fff8c03a03c __exceptionPreprocess + 172
1   Google Chrome Framework             0x000000010d401f54 ChromeMain + 21096420
2   libobjc.A.dylib                     0x00007fff89f5676e objc_exception_throw + 43
3   CoreFoundation                      0x00007fff8c039eed +[NSException raise:format:] + 205
4   Foundation                          0x00007fff8d148b02 -[NSMutableRLEArray replaceObjectsInRange:withObject:length:] + 142
5   Foundation                          0x00007fff8d191ebb -[NSConcreteMutableAttributedString setAttributes:range:] + 95
6   AppKit                              0x00007fff867cb3f4 _NSMakeAttributedStringFromCarbonATSUIData + 846
7   AppKit                              0x00007fff8683c459 +[_NSRTFPboardTypeConverter _getConvertedDataFromPasteboard:atIndex:] + 142
8   AppKit                              0x00007fff8658a7c4 -[NSPasteboard(NSTypeConversion) _dataWithConversionForType:] + 316
9   AppKit                              0x00007fff8683bbc9 -[NSPasteboard stringForType:] + 31
10  Google Chrome Framework             0x000000010e1874a0 ChromeMain + 35274032

It seems like the style information is bogus and we're crashing deep inside of AppKit. We may need to wrap this in an exception catcher.
Archive 11.31.56.zip
210 KB Download

Comment 5 by a...@chromium.org, Feb 14 2017

Application Specific Information:
Crashing on exception: NSMutableRLEArray replaceObjectsInRange:withObject:length:: Out of bounds


Huh, the style info should not be bogus, though. It's coming from copying a
styled textfield from the classic Carbon API. And pasting it into other
apps such as TextEdit works, preserving the style, without a crash (though,
maybe they're all catching the exc?)
I can reproduce the issue all the time when copying from a certain text
field of a certain app (which is - don't laugh - Real Studio).
Jeez, the captcha feature for this forum is not working for me at all. It
keeps telling me that I need to retry, even though I've clicked on a dozen
tiles or more, going thru several iterations of identifying street numbers
and store fronts. At least commenting thru email works painlessly.

I wanted to add that I, in fact, can not easily reproduce it any more. I
used to get this crash repeatedly, but suddenly I only get it with the
sample data I sent you but not with new copied text. Typical.

So yes, maybe the data was corrupt indeed, and it may even be a bug in
Apple's framework.

I hope a simple exception catching will handle this. As a fallback, please
try to fetch just the plain text.
What is the server ID of the crash?
Erik, I entered the ID in the bug report. Isn't that the right one? Though
that's a more recent crash report - of the same crash, though.

And the attached Applescript should make it easy to reproduce it. Avi was
able to reproduce it as well.

Thomas
When the crash is uploaded to our servers, it should be given a "server id".
Screen Shot 2017-02-14 at 10.19.36 AM.png
19.9 KB View Download
BTW, I was just able to reproduce the crash in one of my apps (it's a tool
to analyse the contents of the pasteboard, using all three APIs: Scrap Mgr,
Carbon and Cocoa). I now believe this is a bug in Apple's code, probably
where it attempts to convert the Scrap style into other rich types (such as
RTF).

Sigh.

Comment 12 by a...@chromium.org, Feb 14 2017

Still, we in places wrap sketchy framework calls to catch exceptions and prevent crashes, so perhaps we can do that here.
Labels: -Pri-2 Pri-3
Owner: ----
Status: Available (was: Assigned)
Summary: Wrap all attempts to read non-plain-text from NSPasteboard in try/catch blocks. (was: Crash when pasting certain styled text into Gmail mail editor)
I did some testing on 10.10.5, 10.11.6 and 10.12.3 with various Apple apps
and found this:

TextEdit and Finder crash on 10.10.5, but not on later versions - but they
then add logging about this exception to the Console. They then both fail
to paste the plain text content.

Script Editor pastes the rich text just fine (it's still Carbon based, I
suspect).

Pages crashes on 10.12.3.

I've reported this as a bug to Apple now as well. See
http://www.openradar.me/radar?id=6083703147069440
Project Member

Comment 15 by sheriffbot@chromium.org, Feb 15 2018

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
What can be helped to get this fixed in Chrome? Sure, Apple should do their own part, too. But since Apple does throw exceptions when accessing certain pasteboard contents, any app, including Chrome, should catch them to avoid crashing the entire app.

Should not be hard to locate the code in Chrome that reads from the Pasteboard and wrap it into try/catch, by ignoring any thrown exception, I'd think.
Labels: Hotlist-GoodFirstBug
Status: Available (was: Untriaged)
Searching for NSPasteboard shows that there are a fair number of locations where they're used: https://cs.chromium.org/search/?q=nspasteboard&type=cs

This seems like a good starter bug. Remarking as available.
Components: Blink>DataTransfer

Sign in to add a comment