775197 - Opening window with iframe crashes debug build

Status: RESOLVED INVALID

(Core :: Security: CAPS, defect)

Description

[(not reading bugmail) Nick Desaulniers [:\n]]

Attachment: crashing page

6/28 good http://hg.mozilla.org/mozilla-central/rev/bf8f2961d0cc
6/29 bad http://hg.mozilla.org/mozilla-central/rev/4a8e0d5fc954

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=bf8f2961d0cc&tochange=4a8e0d5fc954

Assertion failure: equal, at /Users/ndesaulniers/Work/services-central/dom/base/nsJSEnvironment.cpp:1421

https://crash-stats.mozilla.com/report/index/5823e2df-ac14-4f06-b9c9-28b582120718

Components.utils.import("resource://gre/modules/Services.jsm"); Services.wm.getMostRecentWindow("navigator:browser").open("file:///Users/ndesaulniers/Work/services-central/tos.html", "aitc_tos_window",       "chrome,height=400,width=640");

except modify the path to the attached html file to recreate.

I'm trying to open a window with chrome privileges, then use JS to modify the DOM of the newly opened window.  I'm trying to dynamically set an iframe's src attribute but that causes a crash.  Creating the iframe statically in the HTML also causes the crash (see attachment).

Comment 1

[Jason Smith [:jsmith]]

Nick - Can you paste a link to your crash report here? You can get that by going to about:crashes, finding and clicking the link for the time of when your crash occurred, and copying and pasting the URL here.

Comment 2

[(not reading bugmail) Nick Desaulniers [:\n]]

https://crash-stats.mozilla.com/report/index/bp-5823e2df-ac14-4f06-b9c9-28b582120718
https://crash-stats.mozilla.com/report/index/bp-4eae7610-3f82-4ef8-b750-96bec2120718
https://crash-stats.mozilla.com/report/index/bp-38a2bf65-dfc4-4336-9b96-df5602120718
https://crash-stats.mozilla.com/report/index/3810923b-16e4-422a-80ac-60a9c2120718
https://crash-stats.mozilla.com/report/index/e482b003-5894-4c39-baf4-8464e2120718
https://crash-stats.mozilla.com/report/index/67041854-28bf-4d82-9715-cb1d72120718

Comment 3

[Ed Lee :Mardak]

I can reproduce the crash on a debug build (https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-07-18-mozilla-central-debug/firefox-17.0a1.en-US.debug-mac.dmg):

Components.utils.import("resource://gre/modules/Services.jsm"); Services.wm.getMostRecentWindow("navigator:browser").open("https://bug775197.bugzilla.mozilla.org/attachment.cgi?id=643473", "aitc_tos_window", "chrome,height=400,width=640");

My report: https://crash-stats.mozilla.com/report/index/48291ffd-e482-4660-aca6-e98392120718
Nick's report: https://crash-stats.mozilla.com/report/index/5823e2df-ac14-4f06-b9c9-28b582120718

Both seem to have the same stack:

Firefox 17.0a1 Crash Report [@ XUL@0xe044a8 | XUL@0x9a6d13 | XUL@0x9a7689 | XUL@0x9aa937 | XUL@0x9a2f1e | XUL@0x116b5a8 | XUL@0x116c0db | XUL@0x11793ed | XUL@0x211f896 | XUL@0x209ac36 | XUL@0x1cb4cd3 | XUL@0x1c50592 | CoreFoundation@0x1213e ]

Comment 4

[Bobby Holley (:bholley)]

I think this is because you're trying to load untrusted content into a chrome iframe (not the safest thing to do), which we current don't handle very well. I'm working on this over in bug 774633.

Comment 5

[(not reading bugmail) Nick Desaulniers [:\n]]

The actual source will be where the Apps In The Cloud (AITC) Privacy Policy and Terms of Service are hosted.  Cat.com was just an example.  Also, I'm denied access to 774633.  Can you CC me on it please?

Comment 6

[Bobby Holley (:bholley)]

(In reply to Nick Desaulniers [:\n] from comment #5)
> The actual source will be where the Apps In The Cloud (AITC) Privacy Policy
> and Terms of Service are hosted.  Cat.com was just an example.

When I say "untrusted content" I mean "web content". The issue is that you're passing "chrome" to the window open call.

> Also, I'm denied access to 774633.  Can you CC me on it please?

ok.

Comment 7

[(not reading bugmail) Nick Desaulniers [:\n]]

Looks like this crashes for privileged pages too.

Comment 8

[Alex Keybl [:akeybl]]

Does this crash only occur with debug builds? How common of a user issue would this be?

Comment 9

[Bobby Holley (:bholley)]

I don't get the principal equality assertion mentioned in comment 0, so I'm guessing that was fixed by bug 774633. I do, however, get a fatal CSS assertion: 

http://pastebin.mozilla.org/1807916

Unassigning myself. Please let me know if anyone can reproduce a dom-related assertion here.

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

Adding qawanted and verifyme to answer comment 9.  If not reproducible and fixed by bug 774633 we can untrack this bug.

Comment 11

[u279076]

Juan, can you check if this bug is reproducible before and after bug 774633 was fixed? Thanks

Comment 12

[juan becerra [:juanb]]

I was not able to reproduce this bug on debug builds prior or post bug 774633.

Comment 13

[u279076]

(In reply to juan becerra [:juanb] from comment #12)
> I was not able to reproduce this bug on debug builds prior or post bug
> 774633.

Thanks Juan.

Alex, based on Juan's testing, QA can neither confirm nor deny that bug 774633 fixed this bug. How did you want to proceed with this bug?

Comment 14

[Alex Keybl [:akeybl]]

This isn't reproducible in QA or a top crash, so no need to track.

Comment 15

[u279076]

As per comment 13 and 14 I'm dropping qawanted and verifyme as well. We should probably drop the reproducible keyword as well if we can't find steps that reliably reproduce this crash.