336744 - Crash when window gets destroyed during popuphiding event

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

This is similar to bug 336739, but now with the popuphiding event (that's why I also made this bug security sensitive).

This also crashes Mozilla1.7.

Talkback ID: TB18335801Z
nsPopupSetFrame::OpenPopup   nsPopupSetFrame::DestroyPopup   nsPopupBoxObject::HidePopup   XPCWrappedNative::CallMethod

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes within 1 sec)

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

taking for now

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

Better to use only objects which are guaranteed to be alive.
And PresShell should not die while dispatching an event.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

checked in.

Comment 5

[Daniel Veditz [:dveditz]]

On a trunk debug build (before fix) this crashes trying to release an already-deleted object (after we've already been doing stuff with that object for a while). Definitely a security risk involved.

QA note: The testcase on this bug doesn't crash me on an optimized 1.8.0.10 or 1.8.1.3, but does in a debug build (slightly different place, but still a deleted object). The branch fix will have to be verified in a debug build

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for branches

just the change that mPresContext is used in branches, trunk has
GetPresContext()

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 259120 [details] [diff] [review]
for branches

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 8

[Marcia Knous [:marcia]]

verified fixed on the 1.8 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4pre) Gecko/2007050804 BonEcho/2.0.0.4pre. No crash with Testcase in Comment 1. Adding branch verified keyword.

Comment 9

[Marcia Knous [:marcia]]

verified fixed on the 1.8.0 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.12pre) Gecko/20070508 Firefox/1.5.0.12pre. No crash with
Testcase in Comment 1. Adding branch verified keyword.

Comment 10

[Bob Clary [:bc] (inactive)]

crash test landed
http://hg.mozilla.org/mozilla-central/rev/c9211196a28e