See testcase, when clicking on the black image in the iframe, Mozilla crashes. Also happens on branch, so marking security sensitive for now. http://crash-stats.mozilla.com/report/index/d5efc47d-3b9c-11dc-b20b-001a4bd43e5c 0 nsImageDocument::RestoreImage() 1 nsImageDocument::RestoreImageTo(int,int) 2 nsImageDocument::HandleEvent(nsIDOMEvent *) 3 nsEventListenerManager::HandleEventSubType(nsListenerStruct *,nsIDOMEventListener *,nsIDOMEvent *,nsISupports *,unsigned int) 4 nsEventListenerManager::HandleEvent(nsPresContext *,nsEvent *,nsIDOMEvent * *,nsISupports *,unsigned int,nsEventStatus *) 5 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor &,unsigned int) 6 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor &,unsigned int,nsDispatchingCallback *) 7 nsEventDispatcher::Dispatch(nsISupports *,nsPresContext *,nsEvent *,nsIDOMEvent *,nsEventStatus *,nsDispatchingCallback *) 8 PresShell::HandleEventInternal(nsEvent *,nsIView *,nsEventStatus *) 9 PresShell::HandleEventWithTarget(nsEvent *,nsIFrame *,nsIContent *,nsEventStatus *)

Oops! The testcase is crashing directly now.

It is a null pointer crash what I get.

Er, no, I got the null pointer crash when I tested the testcase you sent to me. The testcase here does cause a SSensitive crash.

Hmm, bug 389663 seems to be the same, in some part?

In part, except my patch caused the crash to trigger in normal situations.

Add a test at least for the null-deref, please, if it's not obvious how to get from that to the security-sensitive crash?

Because of bug 389663, I'll check in only the null-check fixes part of the patch.

Comment on attachment 274977 [details] [diff] [review] only null-deref fixes a1.9=dbaron

Verified fixed, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007080805 Minefield/3.0a8pre

The 1.8 branch seems to be only the null deref crash, and bug 389663 seems to be post 1.8. Is there a more dangerous crash on the 1.8 branch that I'm not seeing?