Closed Bug 1515463 Opened 2 years ago Closed 2 years ago

Crash in nsWrapperCache::GetWrapperMaybeDead


(Core :: DOM: Core & HTML, defect)

66 Branch
Not set



Tracking Status
firefox-esr60 --- unaffected
firefox64 --- wontfix
firefox65 --- verified
firefox66 --- verified


(Reporter: marcia, Assigned: smaug)


(Keywords: crash, regression, regressionwindow-wanted)

Crash Data


(1 file)

This bug was filed from the Socorro interface and is
report bp-e3de76ab-519c-493d-b034-0c7a30181213.

Seen while looking at nightly crash stats: Mac crash which as 13 crashes/5 installs in the last 7 days. No comments and the URLs don't offer much in the way of clues.

It appears this regression goes back to at least when 64 was in nightly. 

Top 10 frames of crashing thread:

0 XUL nsWrapperCache::GetWrapperMaybeDead const dom/base/nsWrapperCache.h:162
1 XUL nsWrapperCache::GetWrapper const dom/base/nsWrapperCacheInlines.h:14
2 XUL mozilla::dom::MessageBroadcaster_Binding::getChildAt dom/bindings/BindingUtils.h:959
3 XUL bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3064
4 XUL js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:443
5 XUL js::ForwardingProxyHandler::call const js/src/vm/Interpreter.cpp:606
6 XUL js::CrossCompartmentWrapper::call const js/src/proxy/CrossCompartmentWrapper.cpp:304
7 XUL js::Proxy::call js/src/proxy/Proxy.cpp:535
8 XUL js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:509
9 XUL js::jit::DoCallFallback js/src/vm/Interpreter.cpp:594

Olli, can you take a look here?
Flags: needinfo?(bugs)
The two crashes I see in the last week are in mozilla::dom::MessageBroadcaster_Binding::getChildAt(), like the original crash.
Component: General → DOM
All three are also cross compartment calls, so presumably that's related.
bug 888600 landed already 61.

Peterv might have the webidl + MM setup better in mind.
Flags: needinfo?(bugs) → needinfo?(peterv)
Most probably. At least window.messageManager.getChildAt(100); in Scratchpad (browser) crashes.
Assignee: nobody → bugs
Attachment #9034083 - Flags: review?(peterv)
Attachment #9034083 - Flags: review?(peterv) → review+
Flags: needinfo?(peterv)
Pushed by
MessageBroadcaster.getChildAt should be out-of-bounds safe, r=peterv
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
Please request Beta approval on this when you get a chance.
Flags: needinfo?(bugs)
Comment on attachment 9034083 [details] [diff] [review]

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 888600

User impact if declined: Crash if some privileged Js code passes invalid index to MessageBroadcaster.getChildAt

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: (

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): 

String changes made/needed:
Flags: needinfo?(bugs)
Attachment #9034083 - Flags: approval-mozilla-beta?
Comment on attachment 9034083 [details] [diff] [review]

[Triage Comment]
Simple null check crash fix. Approved for 65.0b9.
Attachment #9034083 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

I successfully reproduced the issue on Firefox Nightly 66.0a1 (2018-12-11) under macOS 10.12 using the information found in Comment 6 and some help from Olli.

The issue is not reproducible anymore on Firefox Beta 65.0b9 and latest Nightly 66.0a1 (2019-01-08) under macOS 10.12, Windows 10 (x64) and Ubuntu 18.04 (x64).

Flags: qe-verify+
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.