1168375 - Crash at js::ObjectGroup::compartment JSObject::compartment js::GCMarker::processMarkStackTop js::GCMarker::drainMarkStack js::gc::GCRuntime::drainMarkStack

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter stack

Bughunter found a high exploitable crash in js::ObjectGroup::compartment JSObject::compartment js::GCMarker::processMarkStackTop js::GCMarker::drainMarkStack js::gc::GCRuntime::drainMarkStack on http://www.eea.europa.eu/themes/water/interactive/bathing/state-of-bathing-waters

so far not able to reproduce but still trying.

Comment 1

[Jon Coppeard (:jonco)]

Possible duplicate of bug 1167860.

Comment 2

[Andrew McCreight [:mccr8]]

It looks like we're spinning a nested event loop during nsXMLHttpRequest::Send().  Is that expected?

Comment 3

[Andrea Marchesini [:baku]]

If it's a sync XHR yes. Or if it's a worker XHR, yes again.

Comment 4

[Andrew McCreight [:mccr8]]

Can you try reproducing this now that bug 1167860 has been fixed?  Or if you can't reproduce it at all, maybe we should just close this as incomplete.

Comment 5

[Carsten Book [:Tomcat]]

(In reply to Andrew McCreight [:mccr8] from comment #4)
> Can you try reproducing this now that bug 1167860 has been fixed?  Or if you
> can't reproduce it at all, maybe we should just close this as incomplete.

yes working on it

Comment 6

[Carsten Book [:Tomcat]]

seems this is now fixed by  bug 1167860  (thanks jonco)