1034380 - Potential assertion failure in MessagePort structured cloning

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jon Morton [:jmorton]]

See http://mxr.mozilla.org/mozilla-central/source/dom/base/MessagePort.cpp#188

This callback should not return true and a null returnObject. If JS_WrapObject fails, this could happen.

Comment 1

[Jon Morton [:jmorton]]

Attachment: 0001-Bug-1034380-Prevent-MessagePort-transferable-callbac.patch

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8450687 [details] [diff] [review]
0001-Bug-1034380-Prevent-MessagePort-transferable-callbac.patch

This doesn't handle the case when "obj" is null.  It also relies on falling through out of our tag == SCTAG_DOM_MAP_MESSAGEPORT block, which is ok for now, but would get worse once we had more cases.

I'd prefer we just do early returns of false as needed:

  if (!obj) {
    retunr false;
  }

etc.

Comment 3

[Jon Morton [:jmorton]]

Attachment: 0001-Bug-1034380-Prevent-MessagePort-transferable-callbac.patch

Hopefully more like what you were thinking.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8451769 [details] [diff] [review]
0001-Bug-1034380-Prevent-MessagePort-transferable-callbac.patch

Looks great, thanks.  r=me.

Comment 5

[Jon Morton [:jmorton]]

Attachment: 0001-Bug-1034380-Prevent-MessagePort-transferable-callbac.patch

r=bz

Comment 6

[Carsten Book [:Tomcat]]

hi,

could you provide a Try link. Suggestions for what to run if you haven't
yet can be found here:
https://wiki.mozilla.org/Sheriffing/How:To:Recommended_Try_Practices

Comment 7

[Jon Morton [:jmorton]]

https://tbpl.mozilla.org/?tree=Try&rev=b2c1fb29dc97

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/61a09b7b7e9d

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/61a09b7b7e9d