481377 - Mixed content dialog is broken ###!!! ASSERTION: This is unsafe: 'nsContentUtils::IsSafeToRunScript()'

Status: NEW

(Core :: Graphics: ImageLib, defect)

Description

[[e-mail]]

The mixed content dialog can be triggered for example by parsing an <input type="image" src="http://..."> in a document served from an https:// URL.

I don't know whether it's because it's unsafe to run script while inserting a node into a document, but for instance the following stack then ensues:

gklayout!DocumentViewerImpl::PermitUnload+0xac
docshell!nsDocShell::InternalLoad+0x1801
docshell!nsDocShell::LoadURI+0xad9
embedcomponents!nsWindowWatcher::OpenWindowJSInternal+0x1c9e
embedcomponents!nsWindowWatcher::OpenWindow+0x37d
embedcomponents!nsPromptService::DoDialog+0x149
embedcomponents!nsPromptService::AlertCheck+0x28c
embedcomponents!nsPrompt::AlertCheck+0x3a
pipboot!nsSecurityWarningDialogs::AlertDialog+0x2e8
pipboot!nsSecurityWarningDialogs::ConfirmMixedMode+0x45
pipboot!nsSecureBrowserUIImpl::ConfirmMixedMode+0x12f
pipboot!nsSecureBrowserUIImpl::TellTheWorld+0x104
pipboot!nsSecureBrowserUIImpl::UpdateSecurityState+0x5d
pipboot!nsSecureBrowserUIImpl::OnStateChange+0x14bb
docshell!nsDocLoader::FireOnStateChange+0x1c9
docshell!nsDocLoader::doStopURLLoad+0x81
docshell!nsDocLoader::OnStopRequest+0x356
necko!nsLoadGroup::RemoveRequest+0x234
imglib2!imgRequestProxy::RemoveFromLoadGroup+0x44
imglib2!imgRequestProxy::OnStopRequest+0xfd
imglib2!imgRequest::NotifyProxyListener+0x2da
imglib2!imgLoader::LoadImage+0x96d
gklayout!nsContentUtils::LoadImage+0x150
gklayout!nsImageLoadingContent::LoadImage+0x30e
gklayout!nsImageLoadingContent::LoadImage+0x167
gklayout!nsHTMLInputElement::BindToTree+0xec
gklayout!nsGenericElement::doInsertChildAt+0x473
gklayout!nsGenericElement::InsertChildAt+0x55
gklayout!nsINode::AppendChildTo+0x26
gklayout!SinkContext::Node::Add+0xc2

This may not be a problem on the first visit because the image is uncached, but it's definitely a problem on a refresh (e.g. click Recalculate).

I imagine that this might be a problem for other state change listeners too.

Comment 1

[Boris Zbarsky [:bzbarsky]]

So there are several things going on here:

1) Known imagelib bug with notifying load end synchronously.  I believe this is
   already filed.
2) We start loads at unsafe times.  We've discussed moving them to a different
   time; not sure whether this is filed.
3) The secure browser UI spins the event loop at an unsafe time.  Not sure
   whether this is filed.  It probably should be.

Comment 2

[[e-mail]]

(In reply to comment #1)
> 3) The secure browser UI spins the event loop at an unsafe time.  Not sure
>    whether this is filed.  It probably should be.
How does it know that it's an unsafe time? All it knows is that someone called OnStateChange. Aren't there JS handlers that listen to those calls too?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yes.  Necko callbacks generally happen at unsafe times.  JS that spins the event loop in those will end up with buggy behavior (e.g. weirdly out of order notifications, etc).  That's just life as currently designed.

Comment 4

[Boris Zbarsky [:bzbarsky]]

In any case, addressing #1 or #2 would resolve this.