608662 - Crash [@ nsDSURIContentListener::CheckFrameOptions(nsIRequest*) ] [@ nsDocument::CheckFrameOptions() ][@ nsDSURIContentListener::CheckFrameOptions ]

Status: RESOLVED FIXED

(Firefox :: General, defect)

Description

[Alice0775 White]

Build Identifier: 
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101031 Firefox/4.0b8pre ID:20101031041924

Setup external editor and view page source on add-ons page,
then browser crashes

It crashes regardless of the kind of the editor.

bp-1c91ed3e-638f-4da1-ba06-737892101031
bp-01b238ee-4536-48e8-8bb7-cf6522101031
bp-97b2af64-a22f-4440-a5f9-b9d572101031

3.6.x also crashes.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13pre) Gecko/20101027 Namoroka/3.6.13pre ID:20101027043052
bp-d1b411df-0963-4597-a57f-7a74f2101031
bp-0cd12177-c86d-47cd-a90a-8818f2101031
bp-63e4f4b0-6617-4f0f-a1f2-fee0e2101031

Reproducible: Always

Steps to Reproduce:
1. Start Minefield with new profile
2. Setup external editor with about:config.
view_source.editor.external, true
view_source.editor.path, C:\windows\system32\notepad.exe

3. Open URL ( https://addons.mozilla.org )
4. View Page Source (Ctrl + U)


Actual Results:
 Crash with Crash reports

Expected Results:
 No crash.

Comment 1

[Alice0775 White]

Regression window for m-c:
Works:
http://hg.mozilla.org/mozilla-central/rev/ded4af44f4aa
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101014 Firefox/4.0b8pre ID:20101014154607
Fails:
http://hg.mozilla.org/mozilla-central/rev/83a06cce6b14
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101014 Firefox/4.0b8pre ID:20101014164613
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ded4af44f4aa&tochange=83a06cce6b14
Candidate Bug:
c5494ee56c47	Brandon Sterne — Bug 561051 - make CSP frame-ancestors and X-Frame-Options work with viewSourceChannels, a=jst


Regression window for 3.6.x:
Works:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/02c086d3f933
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.9pre) Gecko/20100816 Namoroka/3.6.9pre ID:20100816042026
Fails:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fe2f80c3a6b6
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.9pre) Gecko/20100817 Namoroka/3.6.9pre ID:20100817042026
Pushlog:
http://hg.mozilla.org/releases/mozilla-1.9.2/pushloghtml?fromchange=02c086d3f933&tochange=fe2f80c3a6b6
Candidate Bug:
6405b19fc58f	Brandon Sterne — Bug 586891 - Make X-Frame-Options work with view-source: channel, r=dwitte, a=LegNeato

FYI, Firefox3.5.x does not crash.

Comment 2

[Alice0775 White]

The browser crashes on Linux too.

bp-f21b86a6-3b50-4b60-b1d3-5b83e2101101
http://hg.mozilla.org/mozilla-central/rev/f4ea6992e1c6
Mozilla/5.0 (X11; Linux i686; rv:2.0b8pre) Gecko/20101101 Firefox/4.0b8pre ID:20101101025859

bp-fafc58c6-05e9-46ca-8fb5-bcdea2101101
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/b3d441310e5c
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13pre) Gecko/20101101 Firefox/3.6.13pre ID:20101101034551

Comment 3

[Brandon Sterne (:bsterne)]

Attachment: fix

We can just return early and allow the load if mDocShell doesn't have a DOMWindow associated with it since there is nothing to click in such a window.

Comment 4

[Sheila Mooney]

Apparently this is a trivial fix and we have a patch ready. Not technically a blocker but we are waiting for approval for 2.0.

Comment 5

[Brandon Sterne (:bsterne)]

http://hg.mozilla.org/mozilla-central/rev/f10a8525994d

Comment 6

[Brandon Sterne (:bsterne)]

Attachment: 1.9.2 patch

Comment 7

[LegNeato]

Comment on attachment 488544 [details] [diff] [review]
1.9.2 patch

a=LegNeato on 1.9.2.13

Comment 8

[Brandon Sterne (:bsterne)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/236dc9757717

Comment 9

[Brandon Sterne (:bsterne)]

This regressed on 1.9.2 due to the checking of bug 581226 which moved a bunch of X-Frame-Options code from nsDocument to nsDSURIContentListener, but which did not have the null check that the patch in this bug added.  I'm marking this not-fixed for 1.9.2 and I'll make a patch to re-fix it momentarily.  We'll need to get this in before we go to build in 2 days.

Comment 10

[Brandon Sterne (:bsterne)]

Attachment: 1.9.2 patch redux

Refix this on 1.9.2 after bug 581226 checkin.

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 491874 [details] [diff] [review]
1.9.2 patch redux

Approved for 1.9.2.13, a=dveditz

Comment 12

[Reed Loden [:reed]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/10fd22d17902