371370 - live connect blowing the document causes trouble, probably use after free

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[georgi - hopefully not receiving bugspam]

Attachment: testcase

live connect blowing the document causes trouble, probably use after free

window.vv=document.applets[0];
alert('wait1');

then the applet blowing the document via document.open() causes either
a java crash or mozilla crash. on debug builds |this| is screwed to
0xdddddddd on optimized 2.0.1 looks like null dereference at first
sight.

bugzilla attachments do not allow applet names, so attaching java
source.

Comment 1

[georgi - hopefully not receiving bugspam]

Attachment: fil4.java

Comment 2

[georgi - hopefully not receiving bugspam]

may need several reloads on debug 2.0latest.

trunk build causes valgrind to exit with something like internal error.

Comment 3

[chris hofmann]

georgi,  is this a problem on the trunk?

Comment 4

[georgi - hopefully not receiving bugspam]

don't crash anymore with current trunk.

just get assertions (known in another bug)
WARNING: Moving XPConnect wrappedNative to new scope, but can't fixup __proto__: file /opt/joro/firefox-cvs/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 1211
###!!! ASSERTION: QueryInterface needed: 'query_result.get() == mRawPtr', file ../../dist/include/xpcom/nsCOMPtr.h, line 594

Comment 5

[georgi - hopefully not receiving bugspam]

this may be different problem, but latest branch has some problems with this testcase.

load it, close the alert.
in location bar hit enter to reload it.
at this point there should be alert "wait1" and orange java picture in conent.
right click on the java picture, close the alert.
result is either SEGV or internal java error.

Comment 6

[georgi - hopefully not receiving bugspam]

original report is almost sure "use after free", marking [sg:critical?]

this seems fixed on trunk, though comment #5 indicates similar problems exist. let me know if i should fork comment #5 in another bug

Comment 7

[Johnny Stenback (:jst)]

georgi, or anyone else, care to attach a compiled class file of the testcase? My java isn't finding necessary classes etc to compile it.

Comment 8

[georgi - hopefully not receiving bugspam]

Attachment: compiled fil4.class

compiled fil4.class

Comment 9

[georgi - hopefully not receiving bugspam]

>My java isn't finding necessary classes etc to compile it.

jst, if you have |javac|, probably you can compile stuff containing liveconnect this way:

javac -classpath /path/to/java/plugin.jar file.java

Comment 10

[georgi - hopefully not receiving bugspam]

java seems broken on linux trunk i386 (all of java).

on 3.0, the testcase doesn't crash, though i still get assertion:
###!!! ASSERTION: QueryInterface needed: 'query_result.get() == mRawPtr', file ../../dist/include/xpcom/nsCOMPtr.h, line 594
###!!! ASSERTION: QueryInterface needed: 'query_result.get() == mRawPtr', file ../../dist/include/xpcom/nsCOMPtr.h, line 594

Comment 11

[Johnathan Nightingale [:johnath]]

dveditz - is this still sg:critical(?) given that it's for a release we no longer support? I understand keeping it sec-sensitive for people like linux distros who might still be supporting it - just wondering where it should show up in security bug counts.

Comment 12

[georgi - hopefully not receiving bugspam]

to verify this bug:

1. save "compiled fil4.class" as "fil4.class"
2. save and open "testcase" in the directory of [1]

currently the result is complete hang for me on linux.

Comment 13

[Jesse Ruderman]

Marking as WFM to reflect trunk status, and setting branch flag to reflect branch status.