Intermittent dom/crypto/test/test_WebCrypto.html | application crashed [@ mozilla::dom::GetDOMClass]

RESOLVED FIXED in Firefox 50

Status

()

Core
DOM
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: Treeherder Bug Filer, Assigned: ttaubert)

Tracking

({intermittent-failure})

unspecified
mozilla50
intermittent-failure
Points:
---

Firefox Tracking Flags

(firefox50 fixed)

Details

Attachments

(1 attachment)

This is crashing because the mPublicExponent of a RsaHashedKeyAlgorithm ended up with a null object in it.

At first glance this could happen if the allocations and stuff that RsaHashedKeyAlgorithmStorage::ToKeyAlgorithm fail.  Sadly, it ignores those failures...
Flags: needinfo?(ttaubert)
(Assignee)

Comment 2

2 years ago
Created attachment 8775287 [details] [diff] [review]
0001-Bug-1289330-Check-for-success-when-calling-ToKeyAlgo.patch

(In reply to Boris Zbarsky [:bz] from comment #1)
> This is crashing because the mPublicExponent of a RsaHashedKeyAlgorithm
> ended up with a null object in it.
> 
> At first glance this could happen if the allocations and stuff that
> RsaHashedKeyAlgorithmStorage::ToKeyAlgorithm fail.  Sadly, it ignores those
> failures...

Yeah, that's definitely an oversight. This should fix it.
Assignee: nobody → ttaubert
Status: NEW → ASSIGNED
Flags: needinfo?(ttaubert)
Attachment #8775287 - Flags: review?(bzbarsky)
Comment on attachment 8775287 [details] [diff] [review]
0001-Bug-1289330-Check-for-success-when-calling-ToKeyAlgo.patch

>+    JSObject* prime = mPrime.ToUint8Array(aCx);
>+    JSObject* generator = mGenerator.ToUint8Array(aCx);

This is going to fail static analysis: "prime" is not rooted and mGenerator.ToUint8Array can gc.

Please just use JS::Rooted<JSObject*> to store the return values of all your ToUint8Array calls, like so:

  JS::Rooted<JSObject*> exponent(aCx, mPublicExponent.ToUint8Array(aCx));

Also, once an allocation fails, you need to return without trying to do more allocations: at this point an exception is pending on aCx and trying to do more work on it is not ok.  That means if !prime you need to return before trying to create generator.

r=me with those two issues fixed.
Attachment #8775287 - Flags: review?(bzbarsky) → review+

Comment 4

2 years ago
Pushed by ttaubert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2b89d0c341aa
Check for success when calling ToKeyAlgorithm() r=bz

Comment 5

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/2b89d0c341aa
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox50: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
You need to log in before you can comment on or make changes to this bug.