Closed Bug 664821 Opened 14 years ago Closed 14 years ago

Compartment mismatch in nsFrameMessageManager::ReceiveMessage

Categories

(Core :: IPC, defect)

Product:
Core
Component:
IPC
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla7
Tracking Flags:
Tracking Status
firefox7 --- fixed

People

(Reporter: jdm, Assigned: jdm)

References

Details

(Whiteboard: [qa-])

Attachments

(1 file, 1 obsolete file)

Use WrapNative correctly and wrap objects array to avoid compartment errors.
3.89 KB, patch
mrbkap
: review+
jst
: approval-mozilla-aurora+
Details | Diff | Splinter Review
There are two problems: 1. we're misusing WrapNative, causing compartment errors when using the global message manager 2. in bootstrapped addons, we're creating the objects array in a sandbox, so the compartment is not the chrome one. Wrapping is required.
Attachment #539884 - Flags: review?(mrbkap) → review+
Keywords: checkin-needed
Landed on inbound.
Keywords: checkin-needed
Pushed: http://hg.mozilla.org/mozilla-central/rev/831fabb406a1
Assignee: nobody → josh
Status: NEW → RESOLVED
Closed: 14 years ago
OS: Mac OS X → All
Hardware: x86 → All
Resolution: --- → FIXED
Target Milestone: --- → mozilla7
Version: unspecified → Trunk
Comment on attachment 539884 [details] [diff] [review] Use WrapNative correctly and wrap objects array to avoid compartment errors. This is a correctness issue that can bite bootstrapped addons, causing a crash. This patch fixes that crash.
Attachment #539884 - Flags: approval-mozilla-aurora?
Comment on attachment 539884 [details] [diff] [review] Use WrapNative correctly and wrap objects array to avoid compartment errors. Clearing a-m-a? for now.
Attachment #539884 - Flags: approval-mozilla-aurora?
I am ashamed that you had to review the previous patch which was blatantly wrong. Then again, you did r+ it :)
Attachment #541539 - Flags: review?(mrbkap)
Attachment #539884 - Attachment is obsolete: true
Comment on attachment 541539 [details] [diff] [review] Use WrapNative correctly and wrap objects array to avoid compartment errors. Er, oops!
Attachment #541539 - Flags: review?(mrbkap) → review+
Keywords: checkin-needed
Landed on inbound.
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/11e15aabd2c1
Status: REOPENED → RESOLVED
Closed: 14 years ago → 14 years ago
Resolution: --- → FIXED
Comment on attachment 541539 [details] [diff] [review] Use WrapNative correctly and wrap objects array to avoid compartment errors. This is a correctness issue that can bite bootstrapped addons, causing a crash. This patch fixes that crash.
Attachment #541539 - Flags: approval-mozilla-aurora?
Attachment #541539 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Depends on: 644325
Can anyone please help me with the name of an add-on this issue reproduced with and some STRs? Thank you
http://starkravingfinkle.org/blog/2011/03/cloud-printer-print-from-firefox-mobile/ I received the crash with the cloud printing addon.
This issue has been verified as fixed on: Mozilla /5.0 (Android;Linux armv7l;rv:7.0) Gecko/20110824 Firefox/7.0 Fennec/7.0 Device: LG Optimus 2X (Android 2.2). The add-on from comment #14 was installed and used and no crash reproduced. Shouldn't this issue also be verified on desktop? Just in case, can anyone please help me with the name of an add-on this issue reproduced with on desktop?
qa-: no QA fix verification needed
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: