70220 - Failure in GtkMozEmbedChrome::OpenStream can cause future gtk_moz_embed_append_data to crash.

Status: RESOLVED FIXED

(Core Graveyard :: Embedding: GTK Widget, defect)

Description

[Michael Fleming]

(I've seen this happen in nautilus)

1) Application calls gtk_moz_embed_open_stream
2) Failure occurs in GtkMozEmbedChrome::OpenStream after mDoingStream is set to
TRUE (in my case, the failure is in "  docShell =
do_QueryInterface(contentItem);"
3) Subsequent call to gtk_moz_embed_append_data calls
GtkMozEmbedChrome::AppendToStream.
4) GtkMozEmbedChrome::mStreamListener is still uninitialized, so useage of that
in AppendToStream causes crash.

Requested Fix:

1) GtkMozEmbedChrome::OpenStream should set mDoingStream to FALSE on failure
2) AppendToStream and CloseStream should return if mDoingStream is FALSE
3) gtk_moz_embed_open_stream should return error code instead of void.

(I'll try to submit a patch in a bit)

Comment 1

[Håkan Waara]

Marking NEW...

Comment 2

[Michael Fleming]

Incidentally, it appears that this case can happen any time
gtk_moz_embed_open_stream is called prior to the control being realized.

Given that, perhaps some additional checking should be done there.

Comment 3

[Christopher Blizzard (:blizzard)]

Yeah, I agree.

Comment 4

[Christopher Blizzard (:blizzard)]

Attachment: patch

Comment 5

[Stuart Parmenter]

r=pavlov

Comment 6

[Brendan Eich [:brendan]]

rs=[e-mail]

Comment 7

[Christopher Blizzard (:blizzard)]

Checked in.