Bugzilla@Mozilla – Bug 588929
Use after free - nsBarProp
Last modified: 2010-12-22 20:56:05 PST
Summon comment box
Reproduced on 4.0b5pre and 3.6.8. The repro contains this: w = open(1, 1, 1); o = w.locationbar; w.close(); s = ''; setInterval('s += o.visible', 50); http://crash-stats.mozilla.com/report/index/1b83dc24-cdb7-4435-838d-643822100819
Created attachment 467523 [details] testcase
this signature shows up in the wild around 10-25 times a day as well. mostly with people on http://www.hulu.com/watch and a few video sites. I mostly see this on 3.6.x releases where active daily user are 1 million+ http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsBarProp%3A%3AGetVisibleByFlag&date=08%2F19%2F2010%2013%3A43%3A59&range_value=1&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsBarProp%3A%3AGetVisibleByFlag%28int*%2C%20unsigned%20int%29
Just FYI, this is a "regression" from <tbogard@aol.net> 2000-02-08 05:38.
Created attachment 467554 [details] [review] patch This is the simplest fix I could think of. And better to make those nsBarProp methods not throw.
Other, not quite as simple would be to have a weak reference (not raw) to DOMWindow, and get browserchrome from it.
Is this related to bug 575102?
If this gets reviewed and can land today it will make 3.6.9/3.5.12. If not, it will have to wait for the next release. Please ask for landing approval when/if it gets ready today. Thanks!
http://hg.mozilla.org/mozilla-central/rev/7de93c31c0f2
Created attachment 475069 [details] [review] for 1.9.2
Created attachment 475070 [details] [review] for 1.9.1
Comment on attachment 475069 [details] [review] for 1.9.2 Approved for 1.9.2.11, a=dveditz for release-drivers
Comment on attachment 475070 [details] [review] for 1.9.1 Approved for 1.9.1.14, a=dveditz for release-drivers
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/fad1fb5ed6c0 http://hg.mozilla.org/releases/mozilla-1.9.2/rev/5f928f65382d