1240365 - Crash [@ xpc::PrivilegedJunkScope ] when instantiating FileReader in a worker with chrome privileges

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Markus Stange [:mstange]]

I'm working on an addon that launches a Worker, and in that worker I want to use FileReader. Here's the crash I'm getting:
https://crash-stats.mozilla.com/report/index/9f73ed48-3e95-4893-bc91-7c7562160117

Comment 1

[Andrew McCreight [:mccr8]]

It looks like this is just always going to crash safely when chrome privileged code attempts to create a FileReader off the main thread, so I'm going to mark this sec-other for now. Adjust as appropriate.

Comment 2

[Andrea Marchesini [:baku]]

Attachment: crash2.patch

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Comment on attachment 8709999 [details] [diff] [review]
crash2.patch

Review of attachment 8709999 [details] [diff] [review]:
-----------------------------------------------------------------

Looks fine to me, although I'd love someone who understands our security stuff better to glance at it.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8709999 [details] [diff] [review]
crash2.patch

>-  MOZ_ASSERT_IF(!NS_IsMainThread(), mWorkerPrivate && !aWindow);
>-  MOZ_ASSERT_IF(NS_IsMainThread(), !mWorkerPrivate);
>+  MOZ_ASSERT(aGlobal);
>+  MOZ_ASSERT(!!NS_IsMainThread() == !!mWorkerPrivate);
This assertion is clearly wrong.
As you said on IRC, MOZ_ASSERT(NS_IsMainThread() == !mWorkerPrivate);


>-  if (!owner && nsContentUtils::ThreadsafeIsCallerChrome()) {
>-    // Instead of grabbing some random global from the context stack,
>-    // let's use the default one (junk scope) for now.
>-    // We should move away from this Init...
>-    fileReader->BindToOwner(xpc::NativeGlobal(xpc::PrivilegedJunkScope()));
I added xpc::PrivilegedJunkScope() use long ago when it was in Init and we didn't have this proper webidl Constructor or so.
And all this was still main thread only. So yes, this change makes sense to me.

Comment 5

[Andrew McCreight [:mccr8]]

I'll just unhide this. I don't think there's any security issue here.

Comment 6

[Pulsebot]

https://hg.mozilla.org/mozilla-central/rev/b67a5343e79f

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b67a5343e79f