1479588 - No null-check on mParentContent when creating remote browsers

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Nika Layzell [:nika] (ni? for response)]

We currently do this check for non-remote browsers correctly.

This caused me a segfault in some code when running the debugger, due to the debugger attempting to access the loadContext argument of a dead nsFrameLoader and causing a null deref.

Comment 1

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1479588 - Check mOwnerContent when starting new remote browser, r=bzbarsky

Comment 2

[Phabricator Automation]

Comment on attachment 8996092 [details]
Bug 1479588 - Check mOwnerContent when starting new remote browser, r=bzbarsky

Boris Zbarsky [:bz] (no decent commit message means r-) has approved the revision.

https://phabricator.services.mozilla.com/D2524

Comment 3

[Daniel Veditz [:dveditz]]

Is this really a security bug? "dead nsFrameLoader" sounds bad, but this patch fixes a guaranteed null-deref. Are there other places/ways the dead nsFrameLoader could be referenced and do bad things without hitting this null? If so that's not getting fixed here (yet?) but does sound like a good reason to keep the bug hidden.

Comment 4

[Nika Layzell [:nika] (ni? for response)]

(In reply to Daniel Veditz [:dveditz] from comment #3)
> Is this really a security bug? "dead nsFrameLoader" sounds bad, but this
> patch fixes a guaranteed null-deref. Are there other places/ways the dead
> nsFrameLoader could be referenced and do bad things without hitting this
> null? If so that's not getting fixed here (yet?) but does sound like a good
> reason to keep the bug hidden.

I am not aware of any way to trigger this without opening the jsdebugger, and I don't think there's any way to make it anything other than a null-deref, so I imagine this is not really a sec bug, but I marked it as one just-in-case.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a578e22f77c6
Check mOwnerContent when starting new remote browser, r=bzbarsky

Comment 6

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/a578e22f77c6