Last Comment Bug 664821 - Compartment mismatch in nsFrameMessageManager::ReceiveMessage
: Compartment mismatch in nsFrameMessageManager::ReceiveMessage
Status: RESOLVED FIXED
[qa-]
:
Product: Core
Classification: Components
Component: IPC (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla7
Assigned To: Josh Matthews [:jdm] (on vacation until Dec 5)
:
: Bill McCloskey (:billm)
Mentors:
Depends on: 644325
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-16 13:33 PDT by Josh Matthews [:jdm] (on vacation until Dec 5)
Modified: 2011-09-22 15:18 PDT (History)
8 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed


Attachments
Use WrapNative correctly and wrap objects array to avoid compartment errors. (3.79 KB, patch)
2011-06-16 13:46 PDT, Josh Matthews [:jdm] (on vacation until Dec 5)
mrbkap: review+
Details | Diff | Splinter Review
Use WrapNative correctly and wrap objects array to avoid compartment errors. (3.89 KB, patch)
2011-06-23 16:28 PDT, Josh Matthews [:jdm] (on vacation until Dec 5)
mrbkap: review+
jst: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-16 13:33:56 PDT
There are two problems:
1. we're misusing WrapNative, causing compartment errors when using the global message manager
2. in bootstrapped addons, we're creating the objects array in a sandbox, so the compartment is not the chrome one. Wrapping is required.
Comment 1 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-16 13:46:08 PDT
Created attachment 539884 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.
Comment 2 :Ehsan Akhgari 2011-06-22 11:36:54 PDT
Landed on inbound.
Comment 3 Mounir Lamouri (:mounir) 2011-06-23 02:28:34 PDT
Pushed:
http://hg.mozilla.org/mozilla-central/rev/831fabb406a1
Comment 4 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-23 08:16:56 PDT
Comment on attachment 539884 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

This is a correctness issue that can bite bootstrapped addons, causing a crash. This patch fixes that crash.
Comment 6 :Ms2ger (⌚ UTC+1/+2) 2011-06-23 09:00:36 PDT
Comment on attachment 539884 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

Clearing a-m-a? for now.
Comment 7 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-23 16:28:43 PDT
Created attachment 541539 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

I am ashamed that you had to review the previous patch which was blatantly wrong. Then again, you did r+ it :)
Comment 8 Blake Kaplan (:mrbkap) 2011-06-23 16:35:08 PDT
Comment on attachment 541539 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

Er, oops!
Comment 9 :Ehsan Akhgari 2011-06-24 11:15:21 PDT
Landed on inbound.
Comment 10 Marco Bonardo [::mak] 2011-06-25 03:28:31 PDT
http://hg.mozilla.org/mozilla-central/rev/11e15aabd2c1
Comment 11 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-28 10:47:19 PDT
Comment on attachment 541539 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

This is a correctness issue that can bite bootstrapped addons, causing a crash. This patch fixes that crash.
Comment 12 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-06-30 14:46:31 PDT
http://hg.mozilla.org/releases/mozilla-aurora/rev/727ffd26278d
Comment 13 Ioana (away) 2011-08-29 02:41:07 PDT
Can anyone please help me with the name of an add-on this issue reproduced with and some STRs? 

Thank you
Comment 14 Josh Matthews [:jdm] (on vacation until Dec 5) 2011-08-29 07:32:42 PDT
http://starkravingfinkle.org/blog/2011/03/cloud-printer-print-from-firefox-mobile/ I received the crash with the cloud printing addon.
Comment 15 Ioana (away) 2011-08-30 05:03:27 PDT
This issue has been verified as fixed on:
Mozilla /5.0 (Android;Linux armv7l;rv:7.0) Gecko/20110824 Firefox/7.0 Fennec/7.0
Device: LG Optimus 2X (Android 2.2).
The add-on from comment #14 was installed and used and no crash reproduced.

Shouldn't this issue also be verified on desktop? Just in case, can anyone please help me with the name of an add-on this issue reproduced with on desktop?
Comment 16 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-09-22 15:18:58 PDT
qa-: no QA fix verification needed

Note You need to log in before you can comment on or make changes to this bug.