893537 - Crash when removing srcdoc attribute from iframe

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[James Kitchener (:jkitch)]

Attachment: manual testcase

There appears to be a crash related to removing the srcdoc attribute from an iframe.

Steps to reproduce:

1. Compile/run a debug build of Nightly.
2. Load the attached testcase
3. Reload the page

Result
Null-deref crash in content/base/src/nsContentUtils:6111

>    if (aForceOwner) {
>      nsAutoCString uriStr;
>      aURI->GetSpec(uriStr);
>      if(!uriStr.EqualsLiteral("about:srcdoc")) {
>        nsCOMPtr<nsIURI> ownerURI;
>        nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI)); //offending line
>        MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
>      }
>    }

Comment 1

[Boris Zbarsky [:bzbarsky]]

Fwiw, I can't reproduce so far...

Comment 2

[James Kitchener (:jkitch)]

Attachment: fix + test

I've identified the cause.  nsSHEntry instances are reused when the nsIWebNavigation::LOAD_FLAGS_REPLACE_HISTORY flag is set.  Before this patch, mIsSrcdocEntry wasn't touched by the Create() function, so the previous srcdoc status is inherited by the new entry, causing it to be wrongly flagged as a srcdoc entry.

Because the URI is correctly updated to the new URI, the exception to deal with srcdoc entries in nsContentUtils::SetUpChannelOwner() isn't triggered, resulting in the crash.

The attached patch resets mIsSrcdocEntry whenever the nsSHEntry instance is reused.

Regarding the original testcase: The testcase needs to be run from a local disk as https/the mixed content blocker appears to be affecting the outcome.   The browser must also be a debug build.  (It may also need Windows, I haven't tried other platforms).

Comment 3

[James Kitchener (:jkitch)]

Attachment: fix + test

Removed some commented out, legacy test code.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 776318 [details] [diff] [review]
fix + test

r=me

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/964be82efbf3

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/964be82efbf3