1495862 - Crash in mozilla::dom::FeaturePolicy::AllowsFeatureInternal

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-eb6d6e98-7013-4e3b-8670-8bddb0181002.
=============================================================

Top 10 frames of crashing thread:

0 libxul.so mozilla::dom::FeaturePolicy::AllowsFeatureInternal const xpcom/ds/nsTArray.h:510
1 libxul.so mozilla::dom::FeaturePolicy::InheritPolicy const dom/security/featurepolicy/FeaturePolicy.cpp:55
2 libxul.so mozilla::dom::FeaturePolicyUtils::ForEachFeature clang/include/c++/4.9.4/functional:2440
3 libxul.so mozilla::dom::FeaturePolicy::InheritPolicy dom/security/featurepolicy/FeaturePolicy.cpp:38
4 libxul.so mozilla::dom::HTMLIFrameElement::RefreshFeaturePolicy dom/html/HTMLIFrameElement.cpp:309
5 libxul.so mozilla::dom::HTMLIFrameElement::AfterSetAttr dom/html/HTMLIFrameElement.cpp:180
6 libxul.so mozilla::dom::Element::SetAttrAndNotify dom/base/Element.cpp:2762
7 libxul.so mozilla::dom::Element::SetAttr dom/base/Element.cpp:2609
8 libxul.so nsHtml5TreeOperation::SetHTMLElementAttributes dom/base/Element.h:864
9 libxul.so nsHtml5TreeOperation::CreateHTMLElement parser/html/nsHtml5TreeOperation.cpp:506

=============================================================

There is 1 crash in nightly 64 with buildid 20181001220118. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1390801.

[1] https://hg.mozilla.org/mozilla-central/rev?node=8edf2b229c9c

Comment 1

[Andrea Marchesini [:baku]]

I suspect this is going to be fixed by bug 1496034.

Comment 2

[Andrea Marchesini [:baku]]

Attachment: aa.patch

I managed to reproduce it. Sometimes StartLoad() is called after checking mFeaturePolicy.

Comment 3

[Andrea Marchesini [:baku]]

Attachment: aa.patch

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 9016778 [details] [diff] [review]
aa.patch

Review of attachment 9016778 [details] [diff] [review]:
-----------------------------------------------------------------

good catch. r=me

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d49ecfa61467
Ensure FeaturePolicy creation in the document, r=ckerschb

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/d49ecfa61467