133897 - JavaScript overflow crash [@js_EmitTree()]

Status: VERIFIED DUPLICATE of bug 96526

(Core :: JavaScript Engine, defect)

Description

[Oliver Seiler]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.9+)
Gecko/20020327
BuildID:    2002032708

URL causes immediate overflow and crash in javascript DLL. IE6 has no problems
with it. According to a friend this happens with Communicator 4.7 on Redhat 6.2
as well, though I have no idea if it's the same cause. Saving the source for
that URL (very large script consisting of lots of if/elses) and trying to view
locally has same problem. Tried this with version from Mar 17th as well, with
identical results.

Reproducible: Always
Steps to Reproduce:
1. Go to URL
2. Weep

Actual Results:  Wept. Very consistent.

Expected Results:  Not crashed. Try it with IE.

Easy enough to reproduce; let me know if I'm the only one, and I can get more
details (can't do it right now, since I'm writing this in Mozilla and don't want
to cause it to crash).

Comment 1

[Oliver Seiler]

Attachment: dump of HTML from the given URL, for posterity

Just in case Eveready changes their site, this is the offending HTML source
that causes the crash. Causes crash even if viewed locally.

Comment 2

[Phil Schwartau]

cc'ing Brendan on this -

Confirming crash with recent debug Mozilla build on WinNT. We crash
due to stack overflow in js_EmitTree(). I'd attach a stack trace, 
but it's just js_EmitTree() over and over.


The cause is a function which begins like this:

function validId(){
    if(IDText.value==""){
        alert("You must enter a valid battery #")
        IDText.focus()
        return false
    }
    else if(IDText.value=="x522"){  
        //Checks for id entry                                   
        parent.main.location.href="../batteryinfo/product_offerings/etc..."
        return true
    }
    else if(IDText.value=="x91"){ 

                  etc.
                  etc.


There are 763 if...else clauses in this function.

Comment 3

[Phil Schwartau]

Reassigning to Kenton -

Comment 4

[Phil Schwartau]

Attachment: Standalone JS testcase. Just load this to crash.

Comment 5

[Phil Schwartau]

NOTE: the script successfully loads in both NN4.7 and IE6

Comment 6

[Brendan Eich [:brendan]]

*** This bug has been marked as a duplicate of 96526 ***

Comment 7

[Phil Schwartau]

Marking Verified Duplicate. The offending function has been added
to the testcase for the other bug: 

          mozilla/js/tests/js1_5/Regress/regress-96526.js