392336 - Crash [@xpcom_core!nsQueryInterface::operator]

Status: RESOLVED DUPLICATE of bug 306911

(Core :: Layout, defect)

Description

[Paul Nickerson]

Attachment: Generated Testcase

This bug has been automatically processed, reduced, and uploaded by Paul's Automated Pen-Tester alpha. It still may require more work.

Firefox version:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070812 BonEcho/2.0.0.6

Details:
eax=02747898 ebx=002a1806 ecx=00033018 edx=0274a918 esi=00033034 edi=00000000
eip=002a1793 esp=00033000 ebp=00033010 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** WARNING: Unable to verify checksum for C:\mozilla\mozilla\firefox-release\dist\bin\xpcom_core.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\mozilla\mozilla\firefox-release\dist\bin\xpcom_core.dll - 
xpcom_core!nsQueryInterface::operator()+0x6:
002a1793 ff742408        push    dword ptr [esp+8]    ss:0023:00033008=0003301c


Stack trace (using release build - debug build didnt crash):
xpcom_core!nsQueryInterface::operator()
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsPrintSettings::GetPrintPageDelay
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsPrintSettings::GetPrintPageDelay
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsPrintSettings::GetPrintPageDelay
firefox!nsRect::nsRect
firefox!nsRect::nsRect
firefox!nsRect::nsRect


A hash of the backtrace has been used to distinguish this from other bugs already reported by the tester. However, the automated pen-tester is still in development and this may not be the case. Also, I haven't added stack hashes to bugs that were not uploaded by the tester, so this bug may very well exist on bugzilla already.

Comment 1

[Paul Nickerson]

[STACKHASH:6C386EFE4C25E9D975A5218EB0FB6E4]

Comment 2

[Paul Nickerson]

Unless anybody hash any objections or criticisms, this is what the finished bug that the pen-tester uploads will look like (except that I'm adding version specification). Of course, this sad, pathetic-looking backtrace is usually more complete, but the pentester checks if the debug build crashes and uses this if it doesnt.

Comment 3

[Martijn Wargers (dead)]

Talkback ID: TB34970663E
nsQueryInterface::operator()  [mozilla/xpcom/build/nsCOMPtr.cpp, line 47]
nsGrid::GetScrollBox  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 1499]
nsGridRowLayout::GetParentGridPart  [mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp, line 91]
nsGridRowLayout::GetGrid  [mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp, line 181]
nsGridRowLayout::GetGrid  [mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp, line 124]
nsGridRowLeafLayout::GetPrefSize  [mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp, line 85]
nsBoxFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 950]
nsListItemFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsListItemFrame.cpp, line 74]
nsGrid::GetPrefRowHeight  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 990]
nsGrid::GetPrefRowSize  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 593]
nsGridRowLeafLayout::GetPrefSize  [mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp, line 92]
nsBoxFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 950]
nsListItemFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsListItemFrame.cpp, line 74]
nsGrid::GetPrefRowHeight  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 990]
nsGrid::GetPrefRowSize  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 593]
nsGridRowLeafLayout::GetPrefSize  [mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp, line 92]
nsBoxFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 950]
nsListItemFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsListItemFrame.cpp, line 74]
nsGrid::GetPrefRowHeight  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 990]
nsGrid::GetPrefRowSize  [mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 593]
nsGridRowLeafLayout::GetPrefSize  [mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp, line 92]
nsBoxFrame::GetPrefSize  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 950]
etc

This was fixed somehow between 2005-11-15 and 2005-11-24:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-11-15+04&maxdate=2005-11-24+09&cvsroot=%2Fcvsroot
I suspect this was fixed by bug 306911.

Comment 5

[Daniel Veditz [:dveditz]]

This is a stack overflow, shouldn't be exploitable. I agree w/Martijn that the crash I get looks like bug 306911... we'll know for sure after we try the patch.