268475 - Crash [@ JS_GetScriptedCaller]

Status: VERIFIED INVALID

(Core :: Security: CAPS, defect)

Description

[timeless]

cx->fp == 0

 	js3250.dll!JS_GetScriptedCaller(JSContext * cx=0x02de5540, JSStackFrame *
fp=0x00000000)  Line 673	C
>	caps.dll!nsScriptSecurityManager::ReportError(JSContext * cx=0x02de5540, const
nsAString & messageTag={...}, nsIURI * aSource=0x02fa16f0, nsIURI *
aTarget=0x0309fb90)  Line 1396	C++
 	caps.dll!nsScriptSecurityManager::CheckSameOrigin(JSContext * cx=0x02de5540,
nsIURI * aTargetURI=0x0309fb90)  Line 561 + 0x1e	C++
 	websrvcs.dll!ChangePrincipal(nsIDOMDocument * aDocument=0x00000000)  Line 114	C++
 	websrvcs.dll!nsHTTPSOAPTransportCompletion::HandleEvent(nsIDOMEvent *
aEvent=0x0309fb90)  Line 522	C++
 	xmlextras.dll!nsXMLHttpRequest::NotifyEventListeners(nsIDOMEventListener *
aHandler=0x02f8de70, nsISupportsArray * aListeners=0x00000001, nsIDOMEvent *
aEvent=0x030207e0)  Line 814	C++
 	xmlextras.dll!nsXMLHttpRequest::RequestCompleted()  Line 1372	C++
 	xmlextras.dll!nsXMLHttpRequest::OnStopRequest(nsIRequest * request=0x02e4dee8,
nsISupports * ctxt=0x00000000, unsigned int status=0x00000000)  Line 1318	C++
 	necko.dll!nsHttpChannel::OnStopRequest(nsIRequest * request=0x030ba970,
nsISupports * ctxt=0x00000000, unsigned int status=0x00000000)  Line 3760	C++
 	necko.dll!nsInputStreamPump::OnStateStop()  Line 505	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *
stream=0x02ee3480)  Line 342	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::EventHandler(PLEvent *
plevent=0x02dc8b2c)  Line 119	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x02dc8b2c)  Line 693	C
 	xpcom_core.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x01066650)  Line 628	C
 	xpcom_core.dll!nsEventQueueImpl::ProcessPendingEvents()  Line 395	C++
 	gkwidget.dll!nsWindow::DispatchPendingEvents()  Line 3721	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=0x00000104, unsigned
int wParam=0x00000054, long lParam=0x20140001, long * aRetValue=0x0012fce0) 
Line 4092	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x00c42186, unsigned int
msg=0x00000104, unsigned int wParam=0x00000054, long lParam=0x02fc5f54)  Line
1355 + 0x10	C++
 	user32.dll!77d43a50() 	
 	user32.dll!77d43b1f() 	
 	user32.dll!TranslateMessage()  + 0xef	
 	user32.dll!GetMessageW()  + 0x125	
 	user32.dll!DispatchMessageW()  + 0xb	
 	appcomps.dll!nsAppStartup::Run()  Line 221	C++
 	mozilla.exe!main1(int argc=0x0012f738, char * * argv=0x02fa16f0, nsISupports *
nativeApp=0x0309fb90)  Line 1322	C++
 	mozilla.exe!main(int argc=0x00000001, char * * argv=0x003f7b80)  Line 1813 +
0x16	C++
 	mozilla.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!TermsrvAppInstallMode()  + 0x269	

fwiw, this is just caps trying to say:
+	mData	0x02fa1550 "Security Error: Content at
file:///r:/mozilla/extensions/webservices/soap/tests/soapheadlinenews.html may
not load data from http://www.soapclient.com/xml/SQLDataSoap.WSDL."	unsigned short *

Comment 1

[timeless]

Attachment: handle case

Comment 2

[Mike Shaver (:shaver emeritus)]

Comment on attachment 165202 [details] [diff] [review]
handle case

Sure, please add a comment the .h documenting this helpful sugar. r=shaver

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 165202 [details] [diff] [review]
handle case

No.  This jsdbgapi.h entry point is not meant to be used from random native
code.  If it were, we'd rewrite the loop to start at fp.  The name "Caller"
means that this native function should be called from a callee.

/be

Comment 4

[timeless]

user error