997450 - crash in nsGlobalWindow::SetNewDocument(nsIDocument*, nsISupports*, bool)

Status: RESOLVED DUPLICATE of bug 996069

(Core :: DOM: Core & HTML, defect)

Description

[Brad Lassey [:blassey] (use needinfo?)]

This bug was filed from the Socorro interface and is 
report bp-426ce711-dd36-48fd-8e88-a5a442140416.
=============================================================

STR
* have bugzilla.js installed
* load https://bugzilla.mozilla.org/buglist.cgi?f1=cf_tracking_e10s&order=Bug%20Number&list_id=9912795&o1=substring&resolution=---&query_format=advanced&v1=%2B
* click on "open All in tabs"

boom!

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

The problem here seems to be that there's an extension running code in a sandbox with an extended principal. This sandbox calls window.open (presumably on the content window). This creates an about:blank content viewer, which tries to set the newly-minted window's to the subject principal, a.k.a. the sandbox's extended principal.

We need to either notice in window.open that this is going to happen or replace the RELEASE_ASSERT with an if check and deal with it (and maybe use a null principal if our given principal is going to be an extended principal?).

Comment 2

[Josh Matthews [:jdm]]

This sounds remarkably like bug 996069.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Yep.