Closed
Bug 441566
Opened 18 years ago
Closed 17 years ago
DOM modification using JavaScript causes Access Violation [@ nsCSubstring::Assign]
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: u315569, Unassigned)
References
(
URL
)
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(1 file)
|
243 bytes,
text/html
|
Details |
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
This sample code crashes FireFox when loaded immediately after startup:
<BODY onload="go()"><SCRIPT>
function go() {
o=document.createElement('b');
document.body.parentNode.replaceChild(o,document.body);
o.innerHTML= '<dl></dl>x<base><style><frameSet><img>';
}
</SCRIPT></BODY>
However, if I open a few tabs first and browse a few sites, it does not crash FireFox.
Reproducible: Always
Steps to Reproduce:
Load this URL:
* http://skypher.com/SkyLined/Repro/FireFox/AccessViolation 5c82123d.html
Actual Results:
FireFox crashes because of an Access Violation
The crash is not entirely predictable, which leads me to believe it could be use of uninitialised memory or reuse of deleted memory, which would be exploitable.
|
||
Comment 1•18 years ago
|
||
I am not able to get the test case you provided to crash my Firefox 2.0.0.14. I tried both the sample code you pasted in comment 0 and the link you provided above. Do you have any add-ons installed in the copy of Firefox you were testing on?
I have as clean an install as is possible on Vista 64-bit. As I mentioned, if you browse to another site first, it does not crash for me either. Can you try on another machine? If you are unable to repro at all, I'll see if I can't get you another repro to try, but don't hold your breath.
|
||
Updated•18 years ago
|
Product: Firefox → Core
QA Contact: general → general
|
||
Comment 3•18 years ago
|
||
Indeed, it only crashes Firefox 2 if you set the page to load at start-up. Weird.
Talkback ID: TB46896221H
nsCSubstring::Assign [mozilla/xpcom/string/src/nsTSubstring.cpp, line 393]
nsImageFrame::GetDocumentCharacterSet [mozilla/layout/generic/nsImageFrame.cpp, line 1902]
nsImageFrame::LoadIcon [mozilla/layout/generic/nsImageFrame.cpp, line 1871]
nsImageFrame::LoadIcons [mozilla/layout/generic/nsImageFrame.cpp, line 1961]
nsImageFrame::Init [mozilla/layout/generic/nsImageFrame.cpp, line 301]
nsCSSFrameConstructor::InitAndRestoreFrame [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6967]
nsCSSFrameConstructor::ConstructHTMLFrame [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5650]
nsCSSFrameConstructor::ConstructFrameInternal [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7910]
nsCSSFrameConstructor::ConstructFrame [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7786]
nsCSSFrameConstructor::ProcessInlineChildren [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13548]
nsCSSFrameConstructor::ConstructInline [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13356]
nsCSSFrameConstructor::ConstructFrameByDisplayType [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6813]
nsCSSFrameConstructor::ConstructFrameInternal [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7974]
nsCSSFrameConstructor::ConstructFrame [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7786]
nsCSSFrameConstructor::ProcessInlineChildren [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13548]
nsCSSFrameConstructor::ConstructInline [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13356]
etc..
Again, the same fix range as bug 441559 and bug 441561:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-01-29+06&maxdate=2006-02-02+09&cvsroot=%2Fcvsroot
Status: UNCONFIRMED → NEW
Component: General → Layout
Ever confirmed: true
QA Contact: general → layout
Summary: DOM modification using JavaScript causes Access Violation → DOM modification using JavaScript causes Access Violation [@ nsCSubstring::Assign]
Version: unspecified → 1.8 Branch
|
||
Comment 4•17 years ago
|
||
In a debug build I get
###!!! ASSERTION: Frame still alive after content removed from document!: 'mContent->GetDocument()', file c:/dev/ff2/mozilla/layout/generic/nsImageFrame.cpp, line 1899
before the crash (accessing 0x00000024).
nsCSubstring::Assign() Line 393 C++
nsACString_internal::Assign() Line 230 C++
nsACString_internal::operator=() Line 416 C++
nsImageFrame::GetDocumentCharacterSet() Line 1902 C++
nsImageFrame::SpecToURI() Line 1916 C++
nsImageFrame::LoadIcon() Line 1869 C++
nsImageFrame::LoadIcons() Line 1955 C++
nsImageFrame::Init() Line 299 C++
nsCSSFrameConstructor::InitAndRestoreFrame() Line 6967 C++
nsCSSFrameConstructor::ConstructHTMLFrame() Line 5649 C++
nsCSSFrameConstructor::ConstructFrameInternal() Line 7904 C++
nsCSSFrameConstructor::ConstructFrame() Line 7785 C++
nsCSSFrameConstructor::ProcessInlineChildren() Line 13548 C++
nsCSSFrameConstructor::ConstructInline() Line 13355 C++
nsCSSFrameConstructor::ConstructFrameByDisplayType() Line 6807 C++
nsCSSFrameConstructor::ConstructFrameInternal() Line 7974 C++
nsCSSFrameConstructor::ConstructFrame() Line 7785 C++
nsCSSFrameConstructor::ProcessInlineChildren() Line 13548 C++
nsCSSFrameConstructor::ConstructInline() Line 13355 C++
nsCSSFrameConstructor::ConstructFrameByDisplayType() Line 6807 C++
nsCSSFrameConstructor::ConstructFrameInternal() Line 7974 C++
nsCSSFrameConstructor::ConstructFrame() Line 7785 C++
nsCSSFrameConstructor::ProcessChildren() Line 12218 C++
nsCSSFrameConstructor::ConstructDocElementFrame() Line 4625 C++
nsCSSFrameConstructor::ReconstructDocElementHierarchy() Line 8042 C++
nsCSSFrameConstructor::WipeContainingBlock() Line 13695 C++
nsCSSFrameConstructor::ContentInserted() Line 9580 C++
PresShell::ContentInserted() Line 5644 C++
nsDocument::ContentInserted() Line 2517 C++
nsHTMLDocument::ContentInserted() Line 1214 C++
nsFragmentObserver::Notify() Line 3310 C++
nsFragmentObserver::BeginUpdate() Line 3262 C++
nsDocument::BeginUpdate() Line 2299 C++
CSSLoaderImpl::InsertSheetInDoc() Line 1138 C++
CSSLoaderImpl::LoadInlineStyle() Line 1568 C++
nsStyleLinkElement::UpdateStyleSheet() Line 325 C++
nsHTMLStyleElement::BindToTree() Line 221 C++
nsGenericElement::BindToTree() Line 1974 C++
nsGenericHTMLElement::BindToTree() Line 1429 C++
doInsertChildAt() Line 2820 C++
nsGenericElement::InsertChildAt() Line 2787 C++
nsContentOrDocument::InsertChildAt() Line 2959 C++
nsGenericElement::doReplaceOrInsertBefore() Line 3555 C++
nsGenericElement::InsertBefore() Line 3073 C++
nsHTMLSpanElement::InsertBefore() Line 57 C++
nsGenericElement::AppendChild() Line 587 C++
nsHTMLSpanElement::AppendChild() Line 57 C++
nsGenericHTMLElement::SetInnerHTML() Line 976 C++
nsHTMLSpanElement::SetInnerHTML() Line 117 C++
nsGenericHTMLElementTearoff::SetInnerHTML() Line 218 C++
XPTC_InvokeByIndex() Line 102 C++
XPCWrappedNative::CallMethod() Line 2169 C++
XPCWrappedNative::SetAttribute() Line 1968 C++
XPC_WN_GetterSetter() Line 1479 C++
js_Invoke() Line 1386 C
js_InternalInvoke() Line 1480 C
js_InternalGetOrSet() Line 1551 C
js_SetProperty() Line 3726 C
js_Interpret() Line 3721 C
js_Invoke() Line 1405 C
js_InternalInvoke() Line 1480 C
JS_CallFunctionValue() Line 4367 C
nsJSContext::CallEventHandler() Line 1500 C++
nsJSEventListener::HandleEvent() Line 186 C++
nsEventListenerManager::HandleEventSubType() Line 1655 C++
nsEventListenerManager::HandleEvent() Line 1762 C++
nsGlobalWindow::HandleDOMEvent() Line 1732 C++
DocumentViewerImpl::LoadComplete() Line 1017 C++
nsDocShell::EndPageLoad() Line 4872 C++
nsWebShell::EndPageLoad() Line 671 C++
nsDocShell::OnStateChange() Line 4787 C++
nsDocLoader::FireOnStateChange() Line 1210 C++
nsDocLoader::doStopDocumentLoad() Line 844 C++
nsDocLoader::DocLoaderIsEmpty() Line 741 C++
nsDocLoader::OnStopRequest() Line 665 C++
nsLoadGroup::RemoveRequest() Line 732 C++
nsDocument::UnblockOnload() Line 5197 C++
nsBindingManager::ProcessAttachedQueueEvent::~ProcessAttachedQueueEvent()
nsBindingManager::ProcessAttachedQueueEvent::`scalar deleting destructor'()
DestroyPLEvent() Line 1406 C++
PL_DestroyEvent() Line 727 C
PL_HandleEvent() Line 699 C
|
|
||
Comment 6•17 years ago
|
||
Fixed between FF2 and 3, "WFM".
Status: NEW → RESOLVED
Closed: 17 years ago
Flags: wanted1.9.0.x-
Flags: wanted1.8.1.x+
Resolution: --- → WORKSFORME
|
|
||
Comment 7•17 years ago
|
||
|
Assignee | |
Updated•15 years ago
|
Crash Signature: [@ nsCSubstring::Assign]
|
||
Updated•10 years ago
|
Group: core-security → core-security-release
|
|
||
Updated•10 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•