546845 - crash when I try to select a row or to sort a column in a tree [@ nsScriptSecurityManager::CheckPropertyAccessImpl]

Status: RESOLVED DUPLICATE of bug 371694

(Core :: Security: CAPS, defect)

Description

[armand bendanan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

Since the 3.5.8 version
Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)
And now the new 3.6 version

My specific XUL application crash firefox every time ...

Reproducible: Always




Vista gives me the following text, I don't know if it can helps :

Problem signature:
  Problem Event Name:	APPCRASH
  Application Name:	firefox.exe
  Application Version:	1.9.2.3667
  Application Timestamp:	4b5102f0
  Fault Module Name:	xul.dll
  Fault Module Version:	1.9.2.3667
  Fault Module Timestamp:	4b5101ce
  Exception Code:	c0000005
  Exception Offset:	0010f46c
  OS Version:	6.0.6002.2.2.0.768.3
  Locale ID:	1036
  Additional Information 1:	3990
  Additional Information 2:	1580ffaf440b5fae3d9e35e1cf400f25
  Additional Information 3:	a571
  Additional Information 4:	a75f79fee6969898b94ca7bc726e6940

Comment 1

[Matthias Versen [:Matti]]

https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 2

[armand bendanan]

Attachment: this is a gnome crash file.

After having launch firefox-bin directly on linux.
I don't know how to produce a core dump ...

Comment 3

[armand bendanan]

(In reply to comment #1)
> https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Ok, I got a stacktrace but with linux only :(
My crash ID is here :
http://crash-stats.mozilla.com/report/index/bp-39b2eb41-957a-45a6-968f-90cbf2100218

Comment 4

[timeless]

Signature	nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int, nsAXPCNativeCallContext*, JSContext*, JSObject*, nsISupports*, nsIURI*, nsIClassInfo*, char const*, int, void**)
UUID	39b2eb41-957a-45a6-968f-90cbf2100218
Time 	2010-02-18 18:04:18.823719
Uptime	59
Product	Firefox
Version	3.5.8
Build ID	20100202153512
Branch	1.9.1
OS	Linux
OS Version	0.0.0 Linux 2.6.18-53.el5 #1 SMP Wed Oct 10 16:34:02 EDT 2007 i686 GNU/Linux
CPU	x86
CPU Info	AuthenticAMD family 1 model 107 stepping 2
Crash Reason	SIGSEGV
Crash Address	0xdfa380
User Comments	this is the same bug as in vista but here in linux BUG report : 546845
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsScriptSecurityManager::CheckPropertyAccessImpl 	caps/src/nsScriptSecurityManager.cpp:814
1 	libxul.so 	nsScriptSecurityManager::CanAccess 	caps/src/nsScriptSecurityManager.cpp:3139
2 	libxul.so 	XPC_WN_DoubleWrappedGetter 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:222
3 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1386
4 	libmozjs.so 	js_InternalInvoke 	js/src/jsinterp.cpp:1447
5 	libmozjs.so 	js_InternalGetOrSet 	js/src/jsinterp.cpp:1510
6 	libmozjs.so 	js_NativeGet 	js/src/jsscope.h:367
7 	libmozjs.so 	js_GetPropertyHelper 	js/src/jsobj.cpp:4333
8 	libmozjs.so 	js_Interpret 	js/src/jsinterp.cpp:4449
9 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1394
10 	libmozjs.so 	js_InternalInvoke 	js/src/jsinterp.cpp:1447
11 	libmozjs.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5188
12 	libxul.so 	nsJSContext::CallEventHandler 	dom/src/base/nsJSEnvironment.cpp:2107
13 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:247
14 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1098
15 	libxul.so 	nsEventListenerManager::HandleEvent 	content/events/src/nsEventListenerManager.cpp:1206
16 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventDispatcher.cpp:236
17 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:300
18 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:514
19 	libxul.so 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6323
20 	libxul.so 	PresShell::HandleEventWithTarget 	layout/base/nsPresShell.cpp:6228
21 	libxul.so 	nsEventStateManager::CheckForAndDispatchClick 	content/events/src/nsEventStateManager.cpp:4073
22 	libxul.so 	nsEventStateManager::PostHandleEvent 	content/events/src/nsEventStateManager.cpp:3036
23 	libxul.so 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6344
24 	libxul.so 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6211
25 	libxul.so 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6071
26 	libxul.so 	nsViewManager::HandleEvent 	view/src/nsViewManager.cpp:1400
27 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1359
28 	libxul.so 	HandleEvent 	view/src/nsView.cpp:168
29 	libxul.so 	nsWindow::DispatchEvent 	widget/src/gtk2/nsWindow.cpp:577
30 	libxul.so 	nsWindow::OnButtonReleaseEvent 	widget/src/gtk2/nsWindow.cpp:2981
31 	libxul.so 	button_release_event_cb 	widget/src/gtk2/nsWindow.cpp:5555

Comment 5

[Daniel Veditz [:dveditz]]

(In reply to comment #0)
> My specific XUL application crash firefox every time ...

Can you construct a test XUL page that will crash Firefox? Is it privileged XUL or unprivileged?

I notice this crash was on the 1.9.1 branch. Some of this code was revamped for Firefox 3.6, do you crash there as well? (1.9.2 branch)

Comment 6

[armand bendanan]

(In reply to comment #5)
> (In reply to comment #0)
> > My specific XUL application crash firefox every time ...
> Can you construct a test XUL page that will crash Firefox?

YES, I will attach the files.

> Is it privileged XUL or unprivileged?

I don't know ...

Comment 7

[armand bendanan]

Attachment: this is the jsp file that contains the XUL tree element

Comment 8

[armand bendanan]

Attachment: This is the javascript that core dump firefox 3.5.7 AND 3.6

To core dump Firefox, you have to click on a column header of the tree

Comment 9

[armand bendanan]

The JSP and JS files are served by a apache tomcat engine

Comment 10

[armand bendanan]

This has produced a crach.
ID de plantage : bp-2c8e2d67-ef14-4f7e-bdb5-ec9c92100327
http://crash-stats.mozilla.com/report/index/2c8e2d67-ef14-4f7e-bdb5-ec9c92100327

Comment 11

[armand bendanan]

Hi Daniel,
Did you inspect my code?
Did you find some errors in my code?
Do you have any explanation?
Best

Comment 13

[Daniel Veditz [:dveditz]]

Is your problem fixed in a Firefox 4 beta? Because if it's not then this was marked a duplicate of the wrong bug.