Closed Bug 517833 Opened 15 years ago Closed 14 years ago

Stack exhaustion crash: recursion protection isn't working for DOM Mutation Events

Categories

(Core :: XPConnect, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: pvnick, Unassigned)

Details

(Keywords: crash, testcase)

Attachments

(3 files)

Attached file testcase
Probably not exploitable, but I saw it write to some weird places.
Attached file stack - it's a biggun!
bclary: when you get a chance can you run valgrind against this one just to make sure it's simple recursion and not scary
Keywords: qawanted
Summary: Crash [@ XPCConvert::NativeInterface2JSObject] - Stack overflow → Crash [@ XPCConvert::NativeInterface2JSObject] - Stack exhaustion
Jonas, have you seen this before?
Why isn't our normal recursion-protection helping us here? Seems like another case of doing something in an event handler that causes the event to fire again. Rinse, repeat.
I didn't see any scary valgrindy stuff on Mac 10.5 for 1.9.{0..3}
Keywords: qawanted
Assignee: general → nobody
Component: JavaScript Engine → XPConnect
QA Contact: general → xpconnect
Group: core-security
Keywords: crash, testcase
Summary: Crash [@ XPCConvert::NativeInterface2JSObject] - Stack exhaustion → Stack exhaustion crash: recursion protection isn't working for DOM Mutation Events
Attached file testcase 2
I can't reproduce the crash.
WFM
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: