893519 - Compartment mismatch with asm module in event listener attribute

Status: RESOLVED FIXED

(Core :: DOM: Events, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

bp-3956aca3-ec88-4820-8830-a6f392130714

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Andrew McCreight [:mccr8]]

Luke, could you take a look at this?  It seems like some kind of problem with cloning asm.js scripts across compartments.

Olli said that setAttribute lazily compiles whatever its argument is, so maybe that's related.  I didn't hit an error when I changed the setAttribute line to:
  e.ondrag = function module() { 'use asm'; return {}; };

I'm not very familiar with script cloning, so my poking around with the debugger was not very fruitful.

Comment 3

[Luke Wagner [:luke]]

Attachment: fix and test

Ah, event handlers.  With bug 900669 there will be an easy way to clone an AsmJS module which will allow CloneScript to just clone the the nested asm.js module.  However, a quick fix is to just disable Odin on non-compile-and-go scripts.  All normal <script>/eval/Function code is compile-and-go, so this shouldn't affect anyone.

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bb2abb7412e6

Comment 5

[Carsten Book [:Tomcat]]

checkin - https://hg.mozilla.org/mozilla-central/rev/bb2abb7412e6 patch and test

Comment 6

[Luke Wagner [:luke]]

Attachment: aurora-fix

At the least this is trivial to port to aurora (just need to rename /jit/ to /ion/ in paths).

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 840282
User impact if declined: potential security vulnerability
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): very low

Comment 7

[Luke Wagner [:luke]]

Attachment: beta-fix

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 840282
User impact if declined: potential security vulnerability
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): very low

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/6e0534f87045
https://hg.mozilla.org/releases/mozilla-beta/rev/ecdbdbed2233

Any particular reason the branch patches didn't include the test?

Comment 9

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed crash on ASan FF24, 2013-06-06.
Verified fixed on ASan FF26, 2013-11-20.