604841 - "ABORT: who sent the notification then" with QI to imgIDecoderObserver

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ABORT: who sent the notification then?: 'aContainer', 
file content/svg/content/src/nsSVGFilters.cpp, line 5644

The assertion is in nsSVGFEImageElement::OnStartContainer.

Comment 1

[Boris Zbarsky [:bzbarsky]]

I thought we disallowed QI to non-classinfo interfaces from untrusted script for DOM objects...  Or did we just disallow implicit conversion to/from those interfaces through XPConnect?

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

http://mxr.mozilla.org/mozilla-central/source/dom/base/nsDOMClassInfo.cpp#526

Comment 3

[Boris Zbarsky [:bzbarsky]]

Bah!

In that case, we need to either move this interface off this node (onto a helper object) or add some sanity-checking to the impl.....

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I really think we should consider stopping this madness for FF4. We're just gonna play whack'a'mole otherwise.

jst and I discussed a couple of alternatives, and peterv might even have a patch.

It would be a risky change this late in the game, but it might be less risky than the whack'a'mole...

Comment 5

[Jesse Ruderman]

After my fuzzer got lucky and found bug 604262, I taught it to take an object and try QI'ing it to every interface.  It then quickly found bug 604556, bug 604807, and this bug (bug 604841).

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

So what's the plan here? Comment #4 sounds like there is a plan...

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This is fixed by Bug 605271.

Comment 8

[(no longer active)]

I think fixing this without bug 605271 will be too hackish and risky this late in the game...

Comment 9

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I'd actually like to fix this one by just noscripting imgIDecoderObserver.  Some of the imglib xpcshell tests use it, but no product code does.

Post 2.0 though, for sure.

Comment 10

[(no longer active)]

(In reply to comment #9)
> I'd actually like to fix this one by just noscripting imgIDecoderObserver. 
> Some of the imglib xpcshell tests use it, but no product code does.
> 
> Post 2.0 though, for sure.

You mean doing that post 2.0?

Comment 11

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yes.

Comment 12

[(no longer active)]

OK, renoming to see if we still need to block on this.

Comment 13

[Boris Zbarsky [:bzbarsky]]

Fixed with WebIDL bindings.