1475704 - DOM localization failure on OOM

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[mozillabugs]

nsINode::Localize() fails to check for OOM in one case, possibly causing an intermittent failure to localize one or more elements in a page. The bug is in line 3249 of dom\base\nsINode.cpp, which doesn't check whether nsTArray::AppendElement(..., fallible) fails:

3218: already_AddRefed<Promise>
3219: nsINode::Localize(JSContext* aCx,
3220:                   mozilla::dom::L10nCallback& aCallback,
3221:                   mozilla::ErrorResult& aRv)
3222: {
3223:   Sequence<L10nElement> l10nElements;
3224:   SequenceRooter<L10nElement> rooter(aCx, &l10nElements);
3225:   RefPtr<LocalizationHandler> nativeHandler = new LocalizationHandler();
3226:   nsTArray<nsCOMPtr<Element>>& domElements = nativeHandler->Elements();
3227:   nsIContent* node = IsContent() ? AsContent() : GetFirstChild();
3228:   nsAutoString l10nId;
3229:   nsAutoString l10nArgs;
3230:   nsAutoString l10nAttrs;
3231:   nsAutoString type;
3232:   for (; node; node = node->GetNextNode(this)) {
3233:     if (!node->IsElement()) {
3234:       continue;
3235:     }
3236: 
3237:     Element* domElement = node->AsElement();
3238:     if (!domElement->GetAttr(kNameSpaceID_None, nsGkAtoms::datal10nid, l10nId)) {
3239:       continue;
3240:     }
3241: 
3242:     domElement->GetAttr(kNameSpaceID_None, nsGkAtoms::datal10nargs, l10nArgs);
3243:     domElement->GetAttr(kNameSpaceID_None, nsGkAtoms::datal10nattrs, l10nAttrs);
3244:     L10nElement* element = l10nElements.AppendElement(fallible);
3245:     if (!element) {
3246:       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
3247:       return nullptr;
3248:     }
3249:     domElements.AppendElement(domElement, fallible);
...

I don't have a POC. I think this code is used only for XUL pages? (https://bugzilla.mozilla.org/show_bug.cgi?id=1363862 ).

Comment 1

[Andrew Overholt [:overholt]]

Thanks for the report. Gandalf, you wrote this code in bug 1363862 - can you take a look? https://searchfox.org/mozilla-central/source/dom/base/nsINode.cpp#2853

Comment 2

[Zibi Braniecki [:zbraniecki][:gandalf]]

Attachment: Bug 1475704 - Check for OOM in nsINode::Localize. r?smaug

Check for OOM in nsINode::Localize.

Comment 3

[Phabricator Automation]

Comment on attachment 8995670 [details]
Bug 1475704 - Check for OOM in nsINode::Localize. r?smaug

Olli Pettay [:smaug] has approved the revision.

https://phabricator.services.mozilla.com/D2483

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d722a38ace3c
Check for OOM in nsINode::Localize. r=smaug

Comment 5

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/d722a38ace3c

Comment 6

[mozillabugs]

Just for reference, you can invoke nsINode::Localize() by navigating to about:preferences .