Compartment mismatch in nsFrameMessageManager::ReceiveMessage

RESOLVED FIXED in Firefox 7

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jdm, Assigned: jdm)

Tracking

Trunk
mozilla7
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox7 fixed)

Details

(Whiteboard: [qa-])

Attachments

(1 attachment, 1 obsolete attachment)

Assignee

Description

8 years ago
There are two problems:
1. we're misusing WrapNative, causing compartment errors when using the global message manager
2. in bootstrapped addons, we're creating the objects array in a sandbox, so the compartment is not the chrome one. Wrapping is required.
Attachment #539884 - Flags: review?(mrbkap) → review+
Assignee

Updated

8 years ago
Keywords: checkin-needed

Comment 2

8 years ago
Landed on inbound.
Keywords: checkin-needed
Pushed:
http://hg.mozilla.org/mozilla-central/rev/831fabb406a1
Assignee: nobody → josh
Status: NEW → RESOLVED
Closed: 8 years ago
OS: Mac OS X → All
Hardware: x86 → All
Resolution: --- → FIXED
Target Milestone: --- → mozilla7
Version: unspecified → Trunk
Assignee

Comment 4

8 years ago
Comment on attachment 539884 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

This is a correctness issue that can bite bootstrapped addons, causing a crash. This patch fixes that crash.
Attachment #539884 - Flags: approval-mozilla-aurora?
Comment on attachment 539884 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

Clearing a-m-a? for now.
Attachment #539884 - Flags: approval-mozilla-aurora?
Assignee

Comment 7

8 years ago
I am ashamed that you had to review the previous patch which was blatantly wrong. Then again, you did r+ it :)
Attachment #541539 - Flags: review?(mrbkap)
Assignee

Updated

8 years ago
Attachment #539884 - Attachment is obsolete: true
Comment on attachment 541539 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

Er, oops!
Attachment #541539 - Flags: review?(mrbkap) → review+
Assignee

Updated

8 years ago
Keywords: checkin-needed

Comment 9

8 years ago
Landed on inbound.
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/11e15aabd2c1
Status: REOPENED → RESOLVED
Closed: 8 years ago8 years ago
Resolution: --- → FIXED
Assignee

Comment 11

8 years ago
Comment on attachment 541539 [details] [diff] [review]
Use WrapNative correctly and wrap objects array to avoid compartment errors.

This is a correctness issue that can bite bootstrapped addons, causing a crash. This patch fixes that crash.
Attachment #541539 - Flags: approval-mozilla-aurora?
Attachment #541539 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Assignee

Updated

8 years ago
Depends on: 644325

Comment 13

8 years ago
Can anyone please help me with the name of an add-on this issue reproduced with and some STRs? 

Thank you
Assignee

Comment 14

8 years ago
http://starkravingfinkle.org/blog/2011/03/cloud-printer-print-from-firefox-mobile/ I received the crash with the cloud printing addon.

Comment 15

8 years ago
This issue has been verified as fixed on:
Mozilla /5.0 (Android;Linux armv7l;rv:7.0) Gecko/20110824 Firefox/7.0 Fennec/7.0
Device: LG Optimus 2X (Android 2.2).
The add-on from comment #14 was installed and used and no crash reproduced.

Shouldn't this issue also be verified on desktop? Just in case, can anyone please help me with the name of an add-on this issue reproduced with on desktop?
qa-: no QA fix verification needed
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.