193710 - Simple javascript crashes Mozilla (window.onerror)

Status: RESOLVED FIXED

(Core :: DOM: Events, defect, P1)

Description

[Mason]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3b) Gecko/20030210
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3b) Gecko/20030210

I will attach a small HTML file which consistently crashes Mozilla. It is zipped
because the crash does not occur when the file is read over the network.
Download the zipped HTML file and open it locally.

Disclaimer: I know nothing about javascript. I was working on a test case for
bug 167499.

Reproducible: Always

Steps to Reproduce:
1. Download crash.zip
2. Open crash.html locally
3.

Comment 1

[Mason]

Attachment: Zipped HTML file

Comment 2

[Michael Lefevre]

confirming on win2k with 1.3b.

stack coming up...

Comment 3

[Michael Lefevre]

Attachment: stacktrace

stacktrace from biesi

#3  0x405f5846 in abort () from /lib/libc.so.6
#4  0x400b20ee in JS_Assert (s=0x400bc72d "sh", file=0x400bc5a0
"/home/chb/mozilla/js/src/jsinterp.c", ln=405)
    at /home/chb/mozilla/js/src/jsutil.c:173

Relevant code:
    /* We can assert because js_FreeStack always balances js_AllocStack. */
    sh = cx->stackHeaders;
    JS_ASSERT(sh);   <---- This fails

Comment 4

[Michael Lefevre]

biesi's stack was linux, so platform -> all

and just in case - my crash was TB17262290M

Comment 5

[Boris Zbarsky [:bzbarsky]]

Is the JS error handling stuff trying to reenter itself and failing?  It doesn't
matter what I put in the onError handler as long as it triggers an error....

Comment 6

[Brendan Eich [:brendan]]

Rev 1.29 of dom/src/events/nsJSEventListener.cpp introduced a bad call to
JS_PopArguments, but a void* formal parameter type precluded the compiler from
catching the bug.  JS_PopArguments' second actual param should be stackPtr, not
&stackPtr.

/be

Comment 7

[Mason]

http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/dom/src/events/nsJSEventListener.cpp#1.29
Fixing bug 52120. Make mozilla pass the expected arguments to window.onerror
r=[e-mail], sr=[e-mail]

http://lxr.mozilla.org/mozilla/source/dom/src/events/nsJSEventListener.cpp#183

Comment 8

[Johnny Stenback (:jst)]

Attachment: Fix error pointed out by brendan.

Comment 9

[Johnny Stenback (:jst)]

Comment on attachment 114698 [details] [diff] [review]
Fix error pointed out by brendan.

Requesting reviews and approval, trivial fix for a crasher bug.

Comment 10

[Brendan Eich [:brendan]]

Comment on attachment 114698 [details] [diff] [review]
Fix error pointed out by brendan.

sr=[e-mail]

/be

Comment 11

[Phil Schwartau]

Setting default QA -

Comment 12

[joakim_46]

Confirming it with build 2003021008 under Windows XP SP1.

Talkback ID: TB17270779W

Comment 13

[Johnny Stenback (:jst)]

FIXED.

Comment 14

[Mason]

Johnny,

Can you take a look at bug 167499, it looks similar to this bug? I've included a
testcase as well. Can someone check whether the fix to this bug also fixed bug
167499?

Comment 15

[Boris Zbarsky [:bzbarsky]]

*** Bug 167499 has been marked as a duplicate of this bug. ***

Comment 16

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/afc662d52ab1