497448 - Crash [@ CallQueryInterface<nsIContent,nsIDOMElement>] with bindings, script, observes, etc and content policy installed

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which usually crashes within 20 seconds or so, when you hava a content policy installed in your profile.

You have a content policy installed when you have Adblock Plus installed:
https://addons.mozilla.org/en-US/firefox/addon/1865

You can also follow the directions in bug 439316:
- copy the file in that bug in the Components directory of where Firefox is installed.
- Create a file .autoreg file (an empty file) in your profile (use bash mv command to rename under windows)

http://crash-stats.mozilla.com/report/index/86df7519-0594-449e-bcbc-2f6052090610?p=1
0  	ntdll.dll  	ntdll.dll@0xe514  	
1 	kernel32.dll 	kernel32.dll@0x2541 	
2 	xul.dll 	google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:562
3 	xul.dll 	google_breakpad::ExceptionHandler::HandlePureVirtualCall 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:506
4 	mozcrt19.dll 	_purecall 	obj-firefox/memory/jemalloc/crtsrc/purevirt.c:47
5 	xul.dll 	CallQueryInterface<nsIContent,nsIDOMElement> 	obj-firefox/dist/include/nsISupportsUtils.h:203
6 	xul.dll 	xul.dll@0x8f2197 	
7 		@0x2 	
8 		@0x62 

This regressed between 2008-06-22 and 2008-06-23:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-06-22+05%3A00%3A00&enddate=2008-06-23+08%3A00%3A00
I think a regression from bug 344258.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase2

Ok, this is a testcase that also crashes with this same stacktrace after 10s or so, but doesn't seem to have the need for a content policy, so it crashes directly, without the need for the Adblock Plus extension.

Comment 2

[Martijn Wargers (dead)]

The !exploitable tool says this:
Exploitability Classification: PROBABLY_EXPLOITABLE
Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls Code Flow starting at gklayout!CallQueryInterface<nsIContent,nsIDOMElement>+0x0000000000000067 (Hash=0x7b706479.0x53120335)

So marking security sensitive for now.

Comment 3

[Brandon Sterne (:bsterne)]

Martijn, can you retest to see if this crash is still reproducible.  I wasn't able to see the crash on trunk or a 1.9.2 build.

Comment 4

[Brandon Sterne (:bsterne)]

Thanks for confirming.  I did reproduce the crash, by the way, in Firefox 3.5 but not in 3.5.7.