1089049 - crash in nsContentUtils::CanCallerAccess(nsINode*), Browser crashes if contextNode is null of document.evaluate

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Alice0775 White]

[Tracking Requested - why for this release]:

This bug was filed from the Socorro interface and is 
report bp-4c7e0812-cd77-4e62-8d30-c98132141025.
=============================================================

Steps To Reproduce:
1. Install certain add-ons
2. open about:addons


Regression window(m-i)
Good:
https://hg.mozilla.org/integration/mozilla-inbound/rev/90cd5968c9ce
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 ID:20141024030110
Bad:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c1ab3cd59563
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 ID:20141024032212
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=90cd5968c9ce&tochange=c1ab3cd59563

Comment 1

[Alice0775 White]

Attachment: xpi

Steps To Reproduce:
1. Install certain add-ons and restart
2. Click [OK][Next][Next][Next][Finish] if dialog pops up
2. Alt > Tools > Options

Comment 2

[Alice0775 White]

Attachment: reduced xpi

Steps To Reproduce:
1. Install the attached reduced xpi and restart
2. Open about:addons

Comment 3

[Alice0775 White]

Ah, just run the following code

//------------------
var node =null;	
var xpathResult = document.evaluate(
  'ancestor-or-self::*[local-name()="textbox"]',
  node,
  null,
  XPathResult.FIRST_ORDERED_NODE_TYPE,
  null
);
//------------------

After landing Bug 1018658 :  browser crashes
Before landing Bug 1018658 : throw an error

Comment 4

[Peter Van der Beken [:peterv]]

Attachment: v1

Bug 1018658 made us not call the XPCOM version of XPathEvaluator from the WebIDL one, instead we go through XPathExpression's evaluate. But the WebIDL for XPathExpression and XPathEvaluator differ in their evaluate, one takes a Node and the other a Node?. They should just consistently take a Node. The dereferencing of the context node should have tipped me off, but it didn't :-/.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8511902 [details] [diff] [review]
v1

r=me

Comment 6

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f24cc6f4a15e

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f24cc6f4a15e