213918 - Applet crashes latest Mozilla [@ nsCSecurityContext::GetOrigin ][@ jlSystem ]

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect)

Description

[Olivier Cahagne]

build ID: 2003072505 on Linux + JRE 1.4.2b28 (also crash build 20030724 Linux).

Steps to reproduce:
1. Load URL http://www.anciens.epita.fr/domino/anciens/freedisc.nsf/($all)?OpenView
2. Click on top button 'Nouveau sujet principal' (you may have to wait until the
Java loads these buttons),
3. Mozilla crashes.

I get the following stack with the nightly build (currently building a debug
build to get more data):

#0  0x4158d098 in jlSystem ()
   from /home/wolruf/fichiers/mozilla/components/liboji.so
#1  0xbfffea30 in ?? ()
#2  0x416778ca in getAndPackSecurityInfo(nsISecurityContext*, int*) ()
   from /usr/lib/j2re1.4.2/plugin/i386/ns610-gcc32/libjavaplugin_oji.so
#3  0x41675dad in jni_SecureGetStaticField ()
   from /usr/lib/j2re1.4.2/plugin/i386/ns610-gcc32/libjavaplugin_oji.so
#4  0x41679ca6 in RemoteJNIEnv_::SecureGetStaticField(jni_type, _jclass*,
_jfieldID*, jvalue*, nsISecurityContext*) ()
   from /usr/lib/j2re1.4.2/plugin/i386/ns610-gcc32/libjavaplugin_oji.so
#5  0x4165c8a6 in CSecureJNIEnv::GetStaticField(jni_type, _jclass*, _jfieldID*,
jvalue*, nsISecurityContext*) ()
   from /usr/lib/j2re1.4.2/plugin/i386/ns610-gcc32/libjavaplugin_oji.so
#6  0x4158a986 in jlSystem ()
   from /home/wolruf/fichiers/mozilla/components/liboji.so
#7  0x41566256 in _init () from /home/wolruf/fichiers/mozilla/libjsj.so
#8  0x41566834 in JSJ_ConnectToJavaVM ()
   from /home/wolruf/fichiers/mozilla/libjsj.so
#9  0x41566e0b in JSJ_AttachCurrentThreadToJava ()
   from /home/wolruf/fichiers/mozilla/libjsj.so
#10 0x41566e93 in jsj_MapJavaThreadToJSJavaThreadState ()
   from /home/wolruf/fichiers/mozilla/libjsj.so
#11 0x41567a48 in jsj_enter_js () from /home/wolruf/fichiers/mozilla/libjsj.so

This is a regression as a debug build from circa 20030720 didn't crash. Perhaps
a regression from bug 83536.
Maybe related: bug 213842.

Comment 1

[Olivier Cahagne]

Attachment: Java Applet used in testcase

Comment 2

[Olivier Cahagne]

Attachment: Reduced testcase crashing Mozilla

Comment 3

[Olivier Cahagne]

Attachment: Reduced testcase crashing Mozilla (correct one)

Comment 4

[Olivier Cahagne]

Attachment: stack from a debug Linux build (CVS 1h old)

Comment 5

[Olivier Cahagne]

definitely a regression from bug 83536.

Comment 6

[Christopher Aillon (sabbatical, not receiving bugmail)]

Mine

Comment 7

[Christopher Aillon (sabbatical, not receiving bugmail)]

I just checked in a fix.  Thanks for the testcase, Olivier.