289991 - [FIX]Crash related to PrivilegeManager

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect, P1)

Description

[Gérard Talbot]

I've cornered a crash which is caused either by
	netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
or	netscape.security.PrivilegeManager.revertPrivilege("UniversalBrowserWrite");

Mozilla 1.8b2 build 2005041106 under XP Pro SP2 here.

1 TalkbackID incident: 5020066 
(there are 3 others talkbackid but I did not get the talkback id)

Reduced testcase coming.

Comment 1

[Gérard Talbot]

Attachment: Reduced testcase

Load this testcase, then unload the page by going to another url.

On an unload event, the testcase execute these instructions:

       
netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
	window.locationbar.visible = originalLocationbar ;
	window.menubar.visible = originalMenubar ;
	window.personalbar.visible = originalPersonalbar ;
	window.statusbar.visible = originalStatusbar ;
	window.toolbar.visible = originalToolbar ;
netscape.security.PrivilegeManager.revertPrivilege("UniversalBrowserWrite");

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

This is a silly mistake in the patch for bug 289643.  In this one case we
forget to set the our param on successful return, and then all heck breaks
lose.

The other change in this diff is just a whitespace change that I meant to do in
bug 289643 and forgot...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Patch checked in.  Gerard, thanks for the excellent testcase.  Made it possible
to find people willing to help debug remotely, if nothing else... ;)

Comment 4

[Boris Zbarsky [:bzbarsky]]

*** Bug 289925 has been marked as a duplicate of this bug. ***

Comment 5

[timeless]

*** Bug 290014 has been marked as a duplicate of this bug. ***