308111 - browser crash when searching large e4x tree [@ GetProperty]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Aaron Boodman]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4

Searches using foo.bar.(baz == 'hotdog') over large trees crashes DPb1. 

Reproducible: Always

Steps to Reproduce:
1. Open attached file in FFb1
2. Say yes to security confirmation


Actual Results:  
FF crashes.

Expected Results:  
Printed out the name of each item in the tree, followed by ": 1" (because the
match it is perforing should produce one result).

It stops crashing if you make the source input significantly smaller (about a
quarter the size worked forme).

Comment 1

[Aaron Boodman]

Attachment: testcase

Comment 2

[timeless]

Incident ID: 9264453
Stack Signature	GetProperty() 1392ea8b
Product ID	FirefoxTrunk
Build ID	2005091006
Trigger Time	2005-09-11 23:52:28.0
Platform	MacOSX
Operating System	Darwin 8.2.0
Module	libmozjs.dylib.1.0.0 + (00070d74)
URL visited	
User Comments	
Since Last Crash	515 sec
Total Uptime	93976 sec
Trigger Reason	SIGBUS: Bus Error: (signal 10)
Source File, Line No.
/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsxml.c, line 4002
Stack Trace 	
GetProperty() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsxml.c, line 4002]
GetProperty() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsxml.c, line 4001]
js_FilterXMLList() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsxml.c, line 7871]
js_Interpret() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsinterp.c, line
5068]
js_Invoke() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsinterp.c, line
1183]
js_InternalInvoke() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsinterp.c, line
1261]
JS_CallFunctionValue() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/js/src/jsapi.c, line 4024]
nsJSContext::CallEventHandler() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1430]
nsJSEventListener::HandleEvent()   nsEventListenerManager::HandleEventSubType()
 [/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 848]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1766]
nsGlobalWindow::HandleDOMEvent() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 1523]
DocumentViewerImpl::LoadComplete() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/layout/base/nsDocumentViewer.cpp,
line 842]
nsDocShell::EndPageLoad()   nsWebShell::EndPageLoad() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/docshell/base/nsWebShell.cpp,
line 496]
nsDocShell::OnStateChange()   nsDocLoader::FireOnStateChange() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 848]
nsDocLoader::doStopDocumentLoad() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 839]
nsDocLoader::DocLoaderIsEmpty() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 741]
nsDocLoader::OnStopRequest() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 662]
nsLoadGroup::RemoveRequest() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 848]
nsDocument::DoUnblockOnload() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 388]
nsDocument::HandleOnloadBlockerEvent() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 5142]
PL_HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/xpcom/threads/plevent.c,
line 689]
PL_ProcessPendingEvents() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/xpcom/threads/plevent.c,
line 623]
CoreFoundation.368.12.0 + 0x23c8c (0x9074bc8c)
CoreFoundation.368.12.0 + 0x231bc (0x9074b1bc)
CoreFoundation.368.12.0 + 0x22c3c (0x9074ac3c)
HIToolbox.221.0.0 + 0x8ac0 (0x93129ac0)
HIToolbox.221.0.0 + 0xed768 (0x9320e768)
HIToolbox.221.0.0 + 0xed51c (0x9320e51c)
HIToolbox.221.0.0 + 0xed47c (0x9320e47c)
nsMacMessagePump::GetEvent()   nsMacMessagePump::DoMessagePump()  
nsAppShell::Run() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/widget/src/mac/nsAppShell.cpp,
line 114]
nsAppStartup::Run()   XRE_main() 
[/builds/tinderbox/Fx-Trunk/Darwin_7.9.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 2311]
_start()   start()

Comment 3

[Brendan Eich [:brendan]]

Attachment: js shell version of testcase

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix one of the bugs biting here, and possibly elsewhere

Oops, js_MarkLocalRoots marked only the top local root scope!

There's another bug peculiar to filtering predicate expressions.  Patch for
that soon, I hope.

/be

Comment 5

[Brendan Eich [:brendan]]

Attachment: diff -w version of last patch

Comment 6

[Brendan Eich [:brendan]]

The patch might fix crashes Bob is seeing trying to test the patch for bug 280769.

/be

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 195954 [details] [diff] [review]
fix one of the bugs biting here, and possibly elsewhere

r=mrbkap

Comment 8

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 195954 [details] [diff] [review]
fix one of the bugs biting here, and possibly elsewhere

sr=shaver

Comment 9

[Brendan Eich [:brendan]]

Attachment: complete fix

diff -w version next.

/be

Comment 10

[Brendan Eich [:brendan]]

Attachment: diff -w version of last patch

I thought about relayering js_Interpret so common-case calls go through another
level that allocates the stack frame, but that penalizes those cases even worse
than adding two branch-tests.  So to make up for that, I copied NS_*LIKELY
macros from nscore.h into jstypes.h.

/be

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 196094 [details] [diff] [review]
diff -w version of last patch

r=mrbkap

Comment 12

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 196094 [details] [diff] [review]
diff -w version of last patch

sr=shaver

Comment 13

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 14

[Brendan Eich [:brendan]]

Comment on attachment 196094 [details] [diff] [review]
diff -w version of last patch

We can let this bake, but E4X testing is required to find it, and the testcase
is here (thanks, Aaron!), and this patch fixes it.

/be

Comment 15

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 16

[Bob Clary [:bc] (inactive)]

Checking in regress-308111.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-308111.js,v  <--  regress-308111.js
initial revision: 1.1
done

Comment 17

[Bob Clary [:bc] (inactive)]

no crash firefox 1.5 rc2 winxp/linux

Comment 18

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060818 win/mac*/linux