1104193 - crash in nsContentUtils::GetUTFOrigin(nsIURI*, nsString&)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-8641f819-213d-4a3f-86e0-8183a2141122.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsContentUtils::GetUTFOrigin(nsIURI*, nsString&) 	/home/geeksphone/FOS/peak/gecko/dom/base/nsContentUtils.cpp:5834
1 	libxul.so 	mozilla::dom::Link::GetOrigin(nsAString_internal&, mozilla::ErrorResult&) 	/home/geeksphone/FOS/peak/gecko/dom/base/Link.cpp:285
2 	libxul.so 	mozilla::dom::HTMLAnchorElementBinding::get_origin 	/home/geeksphone/FOS/peak/objdir-gecko/dom/bindings/HTMLAnchorElementBinding.cpp:850
3 	libxul.so 	mozilla::dom::GenericBindingGetter(JSContext*, unsigned int, JS::Value*) 	/home/geeksphone/FOS/peak/gecko/dom/bindings/BindingUtils.cpp:2362
4 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	/home/geeksphone/FOS/peak/gecko/js/src/jscntxtinlines.h:231
5 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Interpreter.cpp:538
6 	libxul.so 	js::InvokeGetterOrSetter 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Interpreter.cpp:611
7 	libxul.so 	js::baseops::GetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Shape-inl.h:44
8 	libxul.so 	JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	/home/geeksphone/FOS/peak/gecko/js/src/vm/NativeObject.h:1405
9 	libxul.so 	Interpret 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Interpreter.cpp:253
10 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Interpreter.cpp:432
11 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Interpreter.cpp:501
12 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	/home/geeksphone/FOS/peak/gecko/js/src/vm/Interpreter.cpp:538
13 	libxul.so 	js::jit::DoCallFallback 	/home/geeksphone/FOS/peak/gecko/js/src/jit/BaselineIC.cpp:8986
14 		@0x4325aab6

More Reports : 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsContentUtils%3A%3AGetUTFOrigin%28nsIURI*%2C+nsString%26%29#tab-reports

Build 20141122021409 only so far.

Comment 1

[Mats Palmgren (:mats)]

There used to be a null-check on 'principal', but it was removed in bug 1101584.
Was that intentional?

Comment 2

[Andrea Marchesini [:baku]]

Attachment: crash.patch

Comment 3

[Andrea Marchesini [:baku]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b66c71e822ca

Comment 4

[Mats Palmgren (:mats)]

What about nsContentUtils::GetASCIIOrigin, does that need a null-check too?
https://bugzilla.mozilla.org/attachment.cgi?id=8525515&action=diff

Comment 5

[Andrea Marchesini [:baku]]

Attachment: crash.patch

Sorry for this. I forgot that other method. I assume a r+ from smaug here too.

https://hg.mozilla.org/integration/mozilla-inbound/rev/0a6d23163848

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b66c71e822ca
https://hg.mozilla.org/mozilla-central/rev/0a6d23163848