752221 - Crash in XPCNativeScriptableInfo::GetFlags()

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Arthur Gerkis]

Attachment: PoC triggering the crash

There is a crash in XPCNativeScriptableInfo::GetFlags() when adopting nodes.
 
Test-case was tested on own Firefox 15.0a1 opt-build (db1f131884de) - crashes with stack-buffer-overflow. Also was tested on try-build 15.0a1 (http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-6d976534074e/try-linux64-debug/) - there is a regular crash.

Comment 1

[Arthur Gerkis]

Attachment: ASan log, opt-build crash

Comment 2

[Arthur Gerkis]

Attachment: ASan log, try-build crash

Comment 3

[Christian Holler (:decoder)]

Confirmed this. On a regular debug build, this shows up as a near-null crash: https://crash-stats.mozilla.com/report/index/c459471d-caa2-4785-bf5f-e960f2120505

However, if ASan previously reported this as stack-based memory safety violation then it's probably not a simple null deref.

Comment 4

[Bobby Holley (:bholley)]

Loading the testcase here in a current debug build doesn't trigger a crash for me. Is this reproducible on trunk? We've recently fixed various bugs related to adoptNode and such.

Comment 5

[Arthur Gerkis]

Yep, I cannot reproduce this one on build 264f0a7a878c anymore.

Comment 6

[Bobby Holley (:bholley)]

Resolving WFM. Please reopen if anyone can reproduce.