307854 - crash in table layout code, involves XBL [@ nsCellMap::GetCellInfoAt] [@ BasicTableLayoutStrategy::Initialize] [@ BasicTableLayoutStrategy::AssignNonPctColumnWidths]

Status: RESOLVED DUPLICATE of bug 288790

(Core :: Layout: Tables, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050908
Firefox/1.6a1

Steps to reproduce:
1. Install XForms (get the XPI from the mac-xpi subdirectory of the directory
from which you got your nightly build).
2. Load the testcase.

Result: Crash while status bar counter says 2900.

Filing as security-sensitive because
(1) The crash looks exploitable based on stack traces.
(2) Some users install XForms.
(3) The crash might not actually involve XForms.
(4) Testcase is not simplified and includes code from bug 306663.

Comment 1

[Jesse Ruderman]

Attachment: testcase (not reduced)

Comment 2

[Jesse Ruderman]

Attachment: Apple crash report with stack trace

Corresponds to	TB9206231M.  I don't know whether it is significant that the
second item on the stack differs between Talkback and Apple.

Comment 3

[Jesse Ruderman]

I've seen all kinds of addresses on the tops of these stacks: 0, 28, 0x02641758,
0x032db448 (SIGILL!), 0x2c696e74, 0x7ffffffc.  That makes me pretty sure the
crash is exploitable.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Is this just an XTF issue?  There are known problems with XTF and table
pseudo-elements (problems == "the two don't coexist") that I mentioned at some
point in review comments on the XTF frame construction code and that never got
addressed.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Fix for the crash in the testcase

The patch fixes the problem in this test case, but I think
the actual problem is somewhere else. 
We're using XBL for <xforms:output>'s layout, not XTF...

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: test case without xforms

This will crash eventually.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Hmm... Can we reduce that testcase?

Comment 8

[Bernd Mielke]

taking

Comment 9

[Bernd]

the testcase without xforms does crash with dpalpha 2 but is wfm with current
trunk under winxp. So i guess thats Boris leaf patch.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Note that leaf frames landed on the 1.8 branch too, at this point.

Comment 11

[Bernd Mielke]

Jesse, whats the policy on closing such a bug as a WFM?

Comment 12

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050915
Firefox/1.6a1

I can still reproduce using the original testcase (with xforms installed).  It
still crashes while the counter says "2900".

I can still reproduce using Smaug's testcase in comment 6.  It crashes while the
status bar counter says "5100".

Comment 13

[Bernd]

Martijn, do you see any chance to derandomize this?

Comment 14

[Martijn Wargers (dead)]

Attachment: Testcase3

This crashes every time for me when clicking in the document.

Comment 15

[Bernd]

Martijn, thanks that look like someting one could work on

Comment 16

[Martijn Wargers (dead)]

Attachment: testcase4 (not minimised)

Yet another testcase. This testcase gives the same stacktrace, but follows a
different codepath to trigger the bug.
It might be interesting, because I think the testcase could be in essence
simpler than the previous one. 
But it currently still depends on the xforms xbl code.

Comment 17

[Martijn Wargers (dead)]

Attachment: testcase4, minimised

This testcase gives for me also a crash at
BasicTableLayoutStrategy::AssignNonPctColumnWidths, and it's simpler than
testcase3.

Comment 18

[Bernd]

Martijn, it seems to me that this bug is a dupe of the bug that you filed (bug
288790), Boris did fix this today. At least my debug build with that patch does
not crash anymore. But be warned too often my WFM is bogus.

Comment 19

[Jesse Ruderman]

All testcases in this bug WFM with my opt build (checkout an hour or two ago). 
I'm going to mark this as a dup, but leave it as security-sensitive until bug
306663 is made public.

*** This bug has been marked as a duplicate of 288790 ***