557228 - Error console crashes Firefox when out of memory

Status: RESOLVED WONTFIX

(Toolkit Graveyard :: Error Console, defect)

Description

[Lostmon Lords]

User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB6.4; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8; Tablet PC 2.0) chromeframe/5.0.366.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

Firefox hang in with a malformed page , and wen try to view error console firefox crash due to a uncaught excepcion

Reproducible: Always

Steps to Reproduce:
1.open the sample PoC with firefox
2.wait until page load ( very slow )
3.press crtl+shift+j
Actual Results:  
Firefox hangs & crash with posible memory corruption traces.

Expected Results:  
view javascript errors

Firefox 3.6.2 & 3.6.3 hangs & crash with posible memory corruption traces it´s  also posible 
A remote code execution , i do several test and debugs , but i don´t have found the RCE.


Command:  MOV DX,WORD PTR DS:[EAX*2+EDI]
Hex dump: 66:8B1447
Moves contents of 16-bit memory at location [EAX*2+EDI] to the 16-bit register DX. Flags are not affected.

Comment 1

[Lostmon Lords]

Attachment: Traces on debug

trace with JiT debugger.

Comment 2

[Rob Campbell [:rc] (:robcee)]

->toolkit::error console

do you have a stack trace in about:crashes to point us to?

Comment 3

[Lostmon Lords]

Attachment: test case for this issue

Test case , open it and press ctrl+shift+j wen load , or open your error console
and them open the test case.

Comment 4

[Lostmon Lords]

http://crash-stats.mozilla.com/report/index/bp-ddb1419a-1eb2-447b-b39f-38bf42100405

Comment 5

[Rob Campbell [:rc] (:robcee)]

confirmed here on OS X 10.6.3

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 ID:20100401064631

Didn't get a crash stack though. Thanks for filing this.

Comment 6

[Lostmon Lords]

Flock Browser 2.5 crashes too on similar situation http://www.flock.com/

Comment 7

[Tracy Walker [:tracy]]

Seeing same stack on Win 7: http://crash-stats.mozilla.com/report/index/bp-164b34d3-6bea-4e96-880e-7dfdb2100405

Hang and eventual crash on 10.6, but no reporter catching the crash there.

Comment 8

[Jesse Ruderman]

The testcase is just code that asks the JS engine to fill up memory, and the crash is just operator new saying we're out of memory.

Avoiding OOM crashes is bug 427099, bug 516518, bug 70821, or bug 482143.  We're generally not bothering to fix the crash locations one at a time.

Comment 9

[Rob Campbell [:rc] (:robcee)]

I figured it was just hammering the console with text, and the stack trace indicated it was failing on new operator.

We can leave this open until that's fixed in the other referenced bugs.

thanks Jesse.

Comment 10

[Brian Grinstead [:bgrins]]

The Error Console has been removed in favor of the Browser Console (see Bug 1278368), and the component is going to be removed.  If this bug is also relevant in the Browser Console, please reopen and move this into Firefox -> Developer Tools: Console.

Comment 11

[Zack Weinberg (:zwol)]

I am mass-reopening and re-componenting every single one of the Toolkit:Error Console bugs that appear to have been closed without anyone even *glancing* at whether they were relevant to the Browser Console.

If you want to close a whole bunch of old bugs -- FOR ANY REASON -- it is YOUR RESPONSIBILITY to check EVERY SINGLE ONE OF THEM and make sure they are no longer valid.  Do not push that work onto the bug reporters.

(It's okay to close bugs that haven't been touched in years when they don't have enough information for you to figure out whether the problem is still relevant to the current software - the reporter probably isn't coming back to clarify.  But that is the ONLY situation where it is okay.)

(I'm going to have to do this in two steps because of the way the "change several bugs at once" form works.  Apologies for the extra bugspam.)

Comment 12

[Brian Grinstead [:bgrins]]

The Error Console feature was removed entirely from the tree in Bug 1278368 and the bugzilla component is now being removed. We’ve migrated bugs that seem to also affect the Browser Console into the devtools component, please move this over if it was missed.