1288123 - [WARNING MAY CRASH BROWSER] URL parsing causes crash

Status: RESOLVED DUPLICATE of bug 1288482

(Core :: Networking, defect)

Description

[Daniel Browning]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36

Steps to reproduce:

Create an html page with the following contents, access it, then "reload this page" one time.

<script>document.write('<a href="http://foo/bar/%2e%2e%2e%2e%2e%2e%2e%2e">baz</a>');</script>


Actual results:

It crashes for version 46+ on OS X, including FirefoxNightly 50.0a1 (2016-07-15). Older versions and other platforms work. (45 on OS X works, 47 on Linux works, etc.)

Process:               firefox [38048]
Path:                  /Applications/NightlyDebug.app/Contents/MacOS/firefox
Identifier:            org.mozilla.nightlydebug
Version:               47.0.2 (4716.7.2)
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           firefox [38048]
User ID:               25628395

Date/Time:             2016-07-20 08:00:17.778 -0700
OS Version:            Mac OS X 10.11.5 (15F34)
Report Version:        11
Anonymous UUID:        4F065409-6410-EED7-4352-470B9B7EA9DD

Sleep/Wake UUID:       1B10C1A4-591F-4DAC-AD77-30B47ECCF792

Time Awake Since Boot: 400000 seconds
Time Since Wake:       2900 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000213393047
Exception Note:        EXC_CORPSE_NOTIFY

VM Regions Near 0x213393047:
    mapped file            000000019de00000-000000019e082000 [ 2568K] r--/rwx SM=COW  
--> 
    STACK GUARD            0000700000000000-0000700000001000 [    4K] ---/rwx SM=NUL  stack guard for thread 62

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_platform.dylib      	0x00007fff83382360 _platform_strncmp + 320
1   XUL                           	0x00000001052a5db7 0x105093000 + 2174391
2   XUL                           	0x00000001086e0f64 0x105093000 + 56942436
3   XUL                           	0x00000001051b695a 0x105093000 + 1194330
4   XUL                           	0x00000001051b1b9d 0x105093000 + 1174429
5   XUL                           	0x000000010866a5ae 0x105093000 + 56456622
6   XUL                           	0x000000010623009f 0x105093000 + 18469023
7   XUL                           	0x00000001062fb175 0x105093000 + 19300725
[...]


Expected results:

No crash.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: linux_asan_log.txt

Comment 2

[Andrew McCreight [:mccr8]]

Unfortunately, this bug crashes on Nightly, due to the URL in comment 0.

Comment 3

[Andrew McCreight [:mccr8]]

I'm marking comment 0 obsolete so it would instacrash people.

Comment 4

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Comment 5

[Tyson Smith [:tsmith]]

Closing bug because the description is triggering a crashs and we cannot change the description.

Comment 6

[Daniel Veditz [:dveditz]]

Marking comment 0 obsolete didn't stop the crashes (javascript can unhide the comment so the contents must be still in the page).