Closed Bug 194102 Opened 21 years ago Closed 20 years ago

Recursive submission crash [@ nsScriptSecurityManager::GetFramePrincipal ]

Categories

(Core :: DOM: Core & HTML, defect, P3)

x86
Windows XP
defect

Tracking

()

RESOLVED FIXED
mozilla1.4beta

People

(Reporter: vladimire, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

If the action of the form is to submit the form, the browser crashes after
several  iterations. IE doesnt crash.
Attached file testcase - crasher
Severity: normal → critical
build 2003021905: TB17344026M.
Whiteboard: TB17344026M
Keywords: stackwanted
Summary: Recursive submission crash → Recursive submission crash [@ nsScriptSecurityManager::GetFramePrincipal ]
Whiteboard: TB17344026M
yeah, is a bug but is not critical i think. did anyone encountered this on a
real world page or was just experimenting at home? if there is a realworld
testcase please provide the url. the testcase is incontestable, but is not
something that one would use in real life. put a counter there and count the
iterations, and try to figure out after how many iterations it crashes. (you can
display an alert every let's say 20 iters and so on).
Severity: critical → normal
Priority: -- → P3
Target Milestone: --- → mozilla1.4beta
Attached file test with counter
crashing on submission 326.
Still reproducible with Mozilla 1.7 Beta. Top of talkback stack looks like this:

nsScriptSecurityManager::CheckPropertyAccessImpl
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 580]
nsScriptSecurityManager::CanAccess
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 2523]
XPCWrappedNative::CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 1696]
XPC_WN_GetterSetter
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1320]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 943]
js_InternalInvoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1036]
js_InternalGetOrSet
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1079]
js_GetProperty
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2673]
js_Interpret
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2794]
js_Execute
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1157]
FF Linux 20040401 doesn't crash, JS console shows: Error: too much recursion.
Maybe related to fix for bug 192414.
Depends on: 220408
Fixed by bug 220408.
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsScriptSecurityManager::GetFramePrincipal ]
Component: HTML: Form Submission → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: