1343069 - Bug 1302071 added code which fails the static analysis check in 1336510

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Nika Layzell [:nika] (ni? for response)]

I rebased the static analysis onto inbound as I hope to land it as soon as I uplift to beta/aurora, and noticed that a new failure had appeared due to the lambda added here: http://searchfox.org/mozilla-central/rev/4039fb4c5833706f6880763de216974e00ba096c/layout/base/nsPresContext.cpp#3271-3274.

This bug blocks landing the analysis on central.

Comment 1

[Nika Layzell [:nika] (ni? for response)]

Attachment: Capture a strong reference to nsRootPresContext in EnsureEventualDidPaintEvent

MozReview-Commit-ID: GRi4afSovP4

Comment 2

[Nika Layzell [:nika] (ni? for response)]

Comment on attachment 8842096 [details] [diff] [review]
Capture a strong reference to nsRootPresContext in EnsureEventualDidPaintEvent

[Security approval request comment]
How easily could an exploit be constructed based on the patch? I imagine it would be quite difficult to exploit this bug.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? The security problem is fairly evident from the commit message and changes made.

Which older supported branches are affected by this flaw? Just nightly, but we're considering uplifting bug 1302071 which would make it affect aurora too.

If not all supported branches, which bug introduced the flaw? bug 1302071

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? There are no other affected branches.

How likely is this patch to cause regressions; how much testing does it need? This is unlikely to cause regressions.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8842096 [details] [diff] [review]
Capture a strong reference to nsRootPresContext in EnsureEventualDidPaintEvent

Bugs that only affect trunk can land whenever. Fire away!

Comment 4

[Nika Layzell [:nika] (ni? for response)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f3ee1078d7099276195aed0603e12d26dfae1807

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f3ee1078d709

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8842096 [details] [diff] [review]
Capture a strong reference to nsRootPresContext in EnsureEventualDidPaintEvent

This needs to be uplifted if bug 1302071 gets approved.

Comment 7

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8842096 [details] [diff] [review]
Capture a strong reference to nsRootPresContext in EnsureEventualDidPaintEvent

Not taking the uplift from bug 1302071 so we shouldn't need this on 53 aurora. (It's only aurora for a couple more days)