48709 - crash when remembering grant right to javascript

Status: VERIFIED DUPLICATE of bug 32960

(Core :: Security, defect, P3)

Description

[Devoti Paolo]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; m18) Gecko/20000811
BuildID:    2000081108

open the attached page and when asked to grant the rights leave checked the
"remember grants" and click yes crash

Reproducible: Always
Steps to Reproduce:
1.open the attached page
2.grant the rights leave checked the "remember grants" and click yes

Actual Results:  crash

Expected Results:

Comment 1

[Devoti Paolo]

Attachment: sample page

Comment 2

[Devoti Paolo]

more info
open the attached page from an ungranted location, a local drive should be fine

Comment 3

[Devoti Paolo]

MOZILLA caused an invalid page fault in
module CAPS.DLL at 015f:600916e6.
Registers:
EAX=02303f50 CS=015f EIP=600916e6 EFLGS=00010246
EBX=00000001 SS=0167 ESP=0068e998 EBP=0068e9a4
ECX=0068ed18 DS=0167 ESI=02302dd0 FS=2aaf
EDX=00000000 ES=0167 EDI=008a24b0 GS=0000
Bytes at CS:EIP:
ff 52 3c 81 06 00 03 00 00 eb 22 66 83 7d 0c 01
Stack dump:
02300310 00000010 02303f30 0068e9f4 60d688cc 02303f50 00000004 02302dd0 60d4193d
02303f30 00000001 0068e9f4 008a2610 60d6b804 0068e9fc 0068eb90 

Comment 4

[Devoti Paolo]

To trigger the bug have the attachment saved on a local drive
full circle ID TB15659078Y

Comment 5

[leger]

Adding crash keyword.

Comment 6

[Phil Schwartau]

Reassigning to Security for a look -

Comment 7

[Mitchell Stoltz (not reading bugmail)]

I'm not precisely sure what's causing the crash here. I just found a crasher bug 
in the capabilities-saving code which may be related, but the larger issue here 
is that the included testcase won't work at all just yet. Although 
netscape.security.PrivilegeManager.enablePrivilege looks like a LiveConnect call 
to Netscape's Java security manager, it's actually a call to the Mozilla 
(Javascript) security manager. Java never sees this EnablePrivilege call if the 
call comes from Javascript. Jeff Dyer is working on this problem, and there's an 
open bug. If you've found a crash or other bug apart from trying to enable Java 
privileges from Javascript, please reopen this bug.


*** This bug has been marked as a duplicate of 32960 ***

Comment 8

[John Unruh]

Verified dupe.