1236607 - crash in mozilla::dom::nsContentPermissionRequester::nsContentPermissionRequester

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Martijn Wargers (dead)]

I got this crash, while doing some fuzzing. I can't really reproduce very well, but it crashes quite often in this code when I repeat it.

This bug was filed from the Socorro interface and is 
report bp-99bd37fb-8436-436a-b2a0-ae0e22151231.
=============================================================
0 	XUL 	mozilla::dom::nsContentPermissionRequester::nsContentPermissionRequester(nsPIDOMWindow*) 	xpcom/glue/nsCOMPtr.h
1 	XUL 	nsPointerLockPermissionRequest::nsPointerLockPermissionRequest(mozilla::dom::Element*, bool) 	dom/base/nsDocument.cpp
2 	XUL 	mozilla::dom::FullscreenRequest::~FullscreenRequest() 	dom/base/nsDocument.cpp
3 	XUL 	nsCallRequestFullScreen::~nsCallRequestFullScreen() 	dom/base/nsDocument.cpp
4 	XUL 	nsRunnable::Release() 	xpcom/glue/nsThreadUtils.cpp
5 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/glue/nsCOMPtr.h
6 	XUL 	NS_ProcessPendingEvents(nsIThread*, unsigned int) 	xpcom/glue/nsThreadUtils.cpp
7 	XUL 	nsBaseAppShell::NativeEventCallback() 	widget/nsBaseAppShell.cpp
8 	XUL 	nsAppShell::ProcessGeckoEvents(void*) 	widget/cocoa/nsAppShell.mm

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Looks like null + offset crash, and the relevant code indeed isn't null safe.
We may crash for example in
VisibilityChangeListener::VisibilityChangeListener when executing 
nsCOMPtr<nsIDocument> doc = aWindow->GetExtantDoc();

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: guess fix (null check)

Comment 3

[Xidorn Quan [:xidorn] UTC+10]

Comment on attachment 8703732 [details] [diff] [review]
guess fix (null check)

Review of attachment 8703732 [details] [diff] [review]:
-----------------------------------------------------------------

Should work. Not sure how to reproduce this crash so not tested.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/96f1081a231c

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/96f1081a231c

Comment 6

[Martijn Wargers (dead)]

I couldn't reproduce it anymore in 46.0a1 (2016-01-05), so I'm reasonably sure this fixed the crashes I was seeing (I was also seeing crashes with other stacktraces, which I now also don't get with this build anymore).