789843 - Access after free in nsCSSStyleSheet::ParseSheet

Status: RESOLVED DUPLICATE of bug 781032

(Core :: CSS Parsing and Computation, defect)

Description

[Tim Taubert [:ttaubert] (inactive)]

Attachment: null out mNameSpaceMap before creating the new css parser

While working on another bug I had browser_styleeditor_reopen.js crash reliably:

https://tbpl.mozilla.org/?tree=Try&rev=5805ebce61e4

That's the same crash as some of the comments in bug 707891. It's reproducible using a debug build on my Linux 64bit machine. Debugging with Valgrind brought up the following:

http://pastebin.mozilla.org/1812606

The culprit I found was that we do:

> nsCSSParser parser(loader, this);
> // ...
> mInner->mNameSpaceMap = nullptr;

This causes parser->mNameSpaceMap to continue pointing to the old nameSpaceMap which is now in an invalid state because its members have been freed. If I'm not mistaken all we have to do is to make sure we null out mNameSpaceMap before creating the new parser so that the constructor can just set it to nullptr and create it when needed. This fixes the crash locally though I'm not at all familiar with the code to say if that has any unwanted side-effects...

Comment 1

[Boris Zbarsky [:bzbarsky]]

Isn't this a duplicate of bug 781032?

Comment 2

[Tim Taubert [:ttaubert] (inactive)]

Yes, sorry.

Comment 3

[Boris Zbarsky [:bzbarsky]]

No need to be sorry!  _I'm_ sorry you had to spend time on this.  :(