1579357 - Right-clicking a Malformed Blob URI Crashes Tab

Status: VERIFIED FIXED

(Core :: DOM: File, defect, P2)

Description

[bnbdr]

Attachment: crash.html

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

right-click on malformed blob-url link (see attached file).

Actual results:

tab crash, crash dump code caused stack-overflow(exhaustion), opened post-mortem debugger.

Comment 1

[Johann Hofmann [:johannh]]

Huh, that doesn't look great, this is the crash report: https://crash-stats.mozilla.org/report/index/b1efec75-c7c9-480e-be75-be8550190906#tab-details

I don't know how to associate it with an existing bug, though.

Baku, can you take a look at this, please?

Comment 2

[Frederik Braun [:freddy]]

The PoC URL is data: URL, not a blob URL. This also crashes with other incomplete URL schemes, like ftp: , moz-icon:, etc.

Comment 3

[Andrea Marchesini [:baku]]

Attachment: Bug 1579357 - Check the arguments in BasePrincipal XPCOM methods, r?jkt

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c9b564c14e4f
Check the arguments in BasePrincipal XPCOM methods, r=jkt

Comment 5

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/c9b564c14e4f

Comment 6

[Cristian Fogel [:cfogel]]

Confirmed issue with 71.0a1 (2019-09-06) on Windows 10.
Fix verified with 71.0b8 on Windows 10, macOS 10.13.6, Ubuntu 18.04.