Recursive submission crash [@ nsScriptSecurityManager::GetFramePrincipal ]

RESOLVED FIXED in mozilla1.4beta

Status

()

Core
HTML: Form Submission
P3
normal
RESOLVED FIXED
16 years ago
14 years ago

People

(Reporter: Vladimir Ermakov, Unassigned)

Tracking

({crash, testcase})

Trunk
mozilla1.4beta
x86
Windows XP
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

16 years ago
If the action of the form is to submit the form, the browser crashes after
several  iterations. IE doesnt crash.
(Reporter)

Comment 1

16 years ago
Created attachment 114906 [details]
testcase - crasher

Comment 2

16 years ago
build 2003021905: TB17344026M.
Keywords: stackwanted, testcase
Whiteboard: TB17344026M

Comment 3

16 years ago
Created attachment 115009 [details]
Stack for talkback incident

Updated

16 years ago
Keywords: stackwanted
Summary: Recursive submission crash → Recursive submission crash [@ nsScriptSecurityManager::GetFramePrincipal ]
Whiteboard: TB17344026M

Comment 4

16 years ago
yeah, is a bug but is not critical i think. did anyone encountered this on a
real world page or was just experimenting at home? if there is a realworld
testcase please provide the url. the testcase is incontestable, but is not
something that one would use in real life. put a counter there and count the
iterations, and try to figure out after how many iterations it crashes. (you can
display an alert every let's say 20 iters and so on).
Severity: critical → normal
Priority: -- → P3
Target Milestone: --- → mozilla1.4beta
(Reporter)

Comment 5

16 years ago
Created attachment 115390 [details]
test with counter
(Reporter)

Comment 6

16 years ago
crashing on submission 326.

Comment 7

14 years ago
Still reproducible with Mozilla 1.7 Beta. Top of talkback stack looks like this:

nsScriptSecurityManager::CheckPropertyAccessImpl
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 580]
nsScriptSecurityManager::CanAccess
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 2523]
XPCWrappedNative::CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 1696]
XPC_WN_GetterSetter
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1320]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 943]
js_InternalInvoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1036]
js_InternalGetOrSet
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1079]
js_GetProperty
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2673]
js_Interpret
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2794]
js_Execute
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1157]

Comment 8

14 years ago
FF Linux 20040401 doesn't crash, JS console shows: Error: too much recursion.
Maybe related to fix for bug 192414.
Depends on: 220408
Fixed by bug 220408.

Updated

14 years ago
Status: NEW → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsScriptSecurityManager::GetFramePrincipal ]
You need to log in before you can comment on or make changes to this bug.