327066 - document.createEvent('TextEvent') crashes

Status: RESOLVED FIXED

(Core :: DOM: Events, defect, P1)

Description

[Christian Schmidt]

Steps to reproduce (WARNING! This will crash your browser):
1. Click on above URL
2. Crash and burn

TB IDs from a recent 1.8 nightly: TB15134809G, TB15134839Y, TB15134942E

Also happens with FF 1.5.0.1.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

This is a null pointer dereference in the event code, it's not exploitable, so clearing the security group flag. This is a regression from bug 238773. I have a fix.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

This is a diff -w (to account for some whitespace inconsistancies below the patch). Presumably, the old code set aEvent early, whereas this moved code doesn't bother (and insteads sets mEvent). This patch simply uses mEvent, which is set to aEvent if that isn't null, and a new event otherwise.

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 211787 [details] [diff] [review]
Fix

r+sr=jst

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Non-diff -w

For the record, this is what I just checked in.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 211787 [details] [diff] [review]
Fix

This is a pretty trivial null-defense fix...

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 211787 [details] [diff] [review]
Fix

approved for 1.8.0 branch, a=dveditz

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branches, though I neglected to mention my a= in the checkin comment.

Comment 9

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060302 Firefox/1.5.0.1, no crash with js event in URL bar.