Closed Bug 295666 Opened 19 years ago Closed 19 years ago

throw {toString: window.alert.call} causes crash [@ js_GetProperty]

Tracking

()

Status:

VERIFIED FIXED

Milestone:

mozilla1.8beta3

People

(Reporter: guninski, Assigned: brendan)

Details

(Keywords: crash, js1.5, testcase, Whiteboard: [cb] no progress for 1.8b3? (defer?))

Crash Data

Attachments

(2 files)

testcase for the crash 19 years ago georgi - hopefully not receiving bugspam 196 bytes, text/html		Details
fix 19 years ago Brendan Eich [:brendan] 1.87 KB, patch	shaver : review+ brendan : approval1.8b3+	Details \| Diff \| Splinter Review

georgi - hopefully not receiving bugspam

Reporter

Description

•

19 years ago

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

throw {toString: window.alert.call} causes crash.

testcase to follow.

Reproducible: Always

Steps to Reproduce:
testcases to follow.
Actual Results:  
crash

Expected Results:  
no crash

georgi - hopefully not receiving bugspam

Reporter

Comment 1

•

19 years ago

Attached file testcase for the crash — Details

PikeUK

Comment 2

•

19 years ago

TB6164870Q

->Core: JS Engine

Assignee: nobody → general

Severity: normal → critical

Component: General → JavaScript Engine

OS: Linux → All

Product: Firefox → Core

QA Contact: general → general

Summary: throw {toString: window.alert.call} causes crash → throw {toString: window.alert.call} causes crash [@ js_GetProperty]

Version: unspecified → Trunk

PikeUK

Comment 3

•

19 years ago

Reproduced in:

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050525 Firefox/1.0+

Keywords: crash, testcase

timeless

Comment 4

•

19 years ago

Incident ID: 6164870
Stack Signature	js_GetProperty 721110f1
Product ID	FirefoxTrunk
Build ID	2005051906
Trigger Time	2005-05-27 00:42:40.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	JS3250.DLL + (0002ccb5)
URL visited	
User Comments	
Since Last Crash	126586 sec
Total Uptime	126586 sec
Trigger Reason	Stack overflow
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 2734
Stack Trace 	
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 2734]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3797]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3797]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3220]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1450]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_XDRObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802]
js_DefaultValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]

georgi - hopefully not receiving bugspam

Reporter

Comment 5

•

19 years ago

according to dveditz:

On the branch the above crashes in nsScriptSecurityManager::GetScriptPrincipal
(http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=6
+157147)

On the trunk javascript appears to get stuck in infinite recursion, blows the
stack:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=61
+56893

That testcase ought to be spun into its own bug.

Boris Zbarsky [:bzbarsky]

Comment 6

•

19 years ago

This recurses completely inside the JS engine.... should we be doing some
stack-limit checks here?

Status: UNCONFIRMED → NEW

Ever confirmed: true

Flags: blocking1.8b3?

Brendan Eich [:brendan]

Assignee

Comment 7

•

19 years ago

Yes, of course we should be checking -- d'oh.  Taking.

/be

Assignee: general → brendan

Flags: blocking1.8b3?

Flags: blocking1.8b3+

Flags: blocking-aviary1.1+

Keywords: js1.5

Priority: -- → P3

Target Milestone: --- → mozilla1.8beta3

Chris Beard

Updated

•

19 years ago

Whiteboard: [cb] no progress for 1.8b3? (defer?)

Chris Beard

Comment 8

•

19 years ago

need a patch in the next day if it's going to make 1.8b3

Brendan Eich [:brendan]

Assignee

Comment 9

•

19 years ago

Attached patch fix — Details — Splinter Review

I'd like to check this in today, get on with other bugs.

/be

Attachment #188348 - Flags: review?(shaver)

Attachment #188348 - Flags: approval1.8b3+

Mike Shaver (:shaver -- probably not reading bugmail closely)

Comment 10

•

19 years ago

Comment on attachment 188348 [details] [diff] [review]
fix

r=shaver.

Attachment #188348 - Flags: review?(shaver) → review+

Brendan Eich [:brendan]

Assignee

Comment 11

•

19 years ago

Fixed.

/be

Status: NEW → RESOLVED

Closed: 19 years ago

Resolution: --- → FIXED

Bob Clary [:bc] (inactive)

Updated

•

19 years ago

Flags: testcase?

Bob Clary [:bc] (inactive)

Comment 12

•

19 years ago

Checking in regress-295666.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-295666.js,v  <--  regress-295666.js
initial revision: 1.1

Flags: testcase? → testcase+

Bob Clary [:bc] (inactive)

Comment 13

•

18 years ago

verified fixed 1.9 20060818

Status: RESOLVED → VERIFIED

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ js_GetProperty]

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

throw {toString: window.alert.call} causes crash [@ js_GetProperty]

Categories

(Core :: JavaScript Engine, defect, P3)

Tracking

()

People

(Reporter: guninski, Assigned: brendan)

References

Details

(Keywords: crash, js1.5, testcase, Whiteboard: [cb] no progress for 1.8b3? (defer?))

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Updated

Comment 8

Comment 9

Comment 10

Comment 11

Updated

Comment 12

Comment 13

Updated

Attachment

General

Description

File Name

Content Type