Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2007-05-31 14:40:29 PDT

I get 100% cpu on trunk also. You mean that shouldn't happen?

Comment 2 Vlad Sukhoy 2007-05-31 14:42:21 PDT

if the UI is still responsive, then it is not so bad. On branches the UI stop working, and that is equivalent to "denial of service".

Comment 3 Vlad Sukhoy 2007-05-31 14:44:21 PDT

Oh, indeed, the UI gets unresponsive on trunk too.

Comment 4 Olli Pettay [:smaug] (reviewing overload) 2007-05-31 14:47:17 PDT

On linux (trunk/1.8) I get endless loop of JS's "too much recursion"s
(which as such isn't Security-Sensitive, IMO). 
bug 382568 and bug 355548 are crashers.

Comment 5 Vlad Sukhoy 2007-05-31 14:50:31 PDT

IMO, it is security sensitive because it suggests a pattern to exploit things in a way similar to those.
Should we file a metabug or whatever to keep these guys together?

Comment 6 Vlad Sukhoy 2007-06-07 14:09:55 PDT

Created attachment 267625 [details]
a (better) testcase for mutation events in scrollable frame

Ok, this testcase does crash 1.8 and 1.8.0 on MacOS for me it was just a matter of skipping a couple of legitimate mutation events and doing nasty stuff on the vulnerable one.

Comment 7 Vlad Sukhoy 2007-06-07 14:12:52 PDT

Crashes on Linux too. Severity elevated, title adjusted...

Comment 8 Olli Pettay [:smaug] (reviewing overload) 2007-06-11 00:53:52 PDT

Created attachment 267939 [details] [diff] [review]
proposed patch

Just don't propagate any mutation events from native anonymous content.
IsAnonymousForEvents() is needed because XUL has its own implementation
for IsNativeAnonymous().
This fixes also Bug 382568.

Comment 9 Olli Pettay [:smaug] (reviewing overload) 2007-06-11 01:09:51 PDT

attachment 267939 [details] [diff] [review] fixes also bug 382700.
Note, I didn't change nsGenericDOMDataNode::HandleDOMEvent to
check nativeness, because it doesn't implement SetNativeAnonymous
properly and native anon text nodes are AFAIK always inside native
anonymous elements.
(This all ofc works properly on trunk.)

Comment 10 Daniel Veditz [:dveditz] 2007-06-22 10:58:26 PDT

Comment on attachment 267939 [details] [diff] [review]
proposed patch

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers

Comment 11 Olli Pettay [:smaug] (reviewing overload) 2007-06-25 00:42:07 PDT

Checked in to branches

Comment 12 juan becerra [:juanb] 2007-08-23 10:15:13 PDT

Verified on Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.13pre) Gecko/20070810 Firefox/1.5.0.13pre

Fx15012 crashed but Fx15013pre did not.