360866 - ASSERTION: Calling SetPropertyAsSupports on a frame. Prepare to crash and be exploited any time some random website decides to exploit you: '!frame', file nsBoxObject.cpp, line 372

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Mats Palmgren (inactive)]

STEPS TO REPRODUCE
1. start a Firefox trunk debug build (a few hours old) on MacOSX
2. quit (Cmd+Q)

ACTUAL RESULT
###!!! ASSERTION: Calling SetPropertyAsSupports on a frame.  Prepare to crash and be exploited any time some random website decides to exploit you: '!frame', file nsBoxObject.cpp, line 372

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/xul/base/src/nsBoxObject.cpp&rev=1.65&mark=369-372#361

The assertion does not occur in a Camino debug build on the same box.

Comment 1

[Mats Palmgren (inactive)]

Attachment: Stack

Comment 2

[Boris Zbarsky [:bzbarsky]]

What's the javascript stack there?  The is, which exact script is running (which exact binding destructor)?

Comment 3

[Mats Palmgren (inactive)]

I'll let you know if you teach me how to find out such things...

Comment 4

[Boris Zbarsky [:bzbarsky]]

To get the JS stack, make sure the xpconnect library is loaded, then, do:

  call DumpJSStack()

in gdb.

That should tell us what we want.  If it doesn't work for some reason, then in frame #11 of your stack you could look up the mBindingURI of that binding...  That might be a start.

Comment 5

[Mats Palmgren (inactive)]

(gdb) call DumpJSStack()
0 [native frame]
1 () ["chrome://global/content/bindings/textbox.xml":126]
    this = [object XULElement @ 0x2f248a10 (native @ 0x2f23df40)]
2 [native frame]

Comment 6

[Mats Palmgren (inactive)]

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/toolkit/content/widgets/textbox.xml&rev=1.40&mark=126-132#126

Comment 7

[Boris Zbarsky [:bzbarsky]]

Wait.  Is this trunk from today?  If so, this looks like bug 360836 -- CallQI not nulling out the out param.  Update nsISupportsImpl.cpp?

That said, I just realized that this code leaks in debug builds if aValue is an honest refcounted object...  :(

Comment 8

[Mats Palmgren (inactive)]

This build is from today, just before bug 360836:

# cvs stat xpcom/glue/nsISupportsImpl.cpp 
===================================================================
File: nsISupportsImpl.cpp       Status: Needs Patch

   Working revision:    3.1
   Repository revision: 3.2     /cvsroot/mozilla/xpcom/glue/nsISupportsImpl.cpp,v
   Sticky Tag:          (none)
   Sticky Date:         (none)
   Sticky Options:      (none)


I will update and rebuild...

Comment 9

[Mats Palmgren (inactive)]

Updating nsISupportsImpl.cpp fixed it.
I filed bug 360873 on the potential leak.

Comment 10

[timeless]

is this bug security sensitive?

Comment 11

[Mats Palmgren (inactive)]

I don't think so. It was trunk-only and it was fixed by bug 360836.