1257521 - Investigate if VariantToJsval is in anyway compartment safe

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

When dealing with variants which point to some DOM object, we execute
http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/XPCConvert.cpp#743

Not related to this bug, but http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/XPCConvert.cpp#771 is wrong since it isn't in anyway null-safe.

But more worrisome is http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/XPCConvert.cpp#786
I don't see, at least haven't yet seen, anything guaranteeing that we don't assert there.

Comment 1

[Andrew McCreight [:mccr8]]

Olli, do you think this should be marked sec-high or sec-audit? It sounds like you are pretty sure there is a problem.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

I tried to write a testcase but couldn't get it to assert yet.
I'm pretty sure, but not 100% we have an issue here.

sec-high for now, and if someone proves this can't for example happen on web content then reduce to -audit or invalid or so.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

I think I was wrong here. Looking at this again, and I can't see the assertion failing.
->invalid.