recursive location="javascript:..." exits without crashing [@ RelExpr] (was [@ js_EmitTree ])

RESOLVED WORKSFORME

Status

()

Core
DOM: Core & HTML
--
critical
RESOLVED WORKSFORME
14 years ago
13 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Windows XP
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

14 years ago
The following code causes Firebird 07/30 to exit but does not bring up talkback
or the WinXP crash dialog:

<a href="javascript:(function(){location=document.links[0].href})()">die</a>

IE, Opera, and Netscape treat it like a normal javascript infinite loop.  (Opera
does not hang but uses 100% CPU.)
(Reporter)

Comment 1

14 years ago
Created attachment 129003 [details]
demo

Comment 2

14 years ago
confirming using 2003073004 on Win2k: TB22377699Y.
Keywords: crash, stackwanted
Whiteboard: TB22377699Y

Comment 3

14 years ago
ignore comment 2, this was a TB ID from bug 214761.
Whiteboard: TB22377699Y

Comment 4

14 years ago
2003080504 on Win2k: TB22542415Z
Hope it'll show up tomorrow on:
http://ftp25moz.newaol.com/pub/data/crash-data/detailed-crash-analysis-all.html
Whiteboard: TB22542415Z
Created attachment 129959 [details]
stack

stack trace

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030817 Mozilla
Firebird/0.6.1+

Comment 6

14 years ago
similar stack in bug 207545 and bug 197052.
Keywords: stackwanted
Summary: recursive location="javascript:..." exits without crashing → recursive location="javascript:..." exits without crashing [@ js_EmitTree ]
Whiteboard: TB22542415Z

Comment 7

14 years ago
Created attachment 145135 [details]
stack trace from 1.7 beta

I get a slightly different stack from 1.7 beta on winXP. The top of it looks
like this: 

RelExpr [mozilla/js/src/jsparse.c, line 2420]
EqExpr [mozilla/js/src/jsparse.c, line 2384]
BitAndExpr [mozilla/js/src/jsparse.c, line 2372]
BitXorExpr [mozilla/js/src/jsparse.c, line 2359]
BitOrExpr [mozilla/js/src/jsparse.c, line 2346]
AndExpr [mozilla/js/src/jsparse.c, line 2335]
OrExpr [mozilla/js/src/jsparse.c, line 2324]
CondExpr [mozilla/js/src/jsparse.c, line 2284]
AssignExpr [mozilla/js/src/jsparse.c, line 2230]
Expr [mozilla/js/src/jsparse.c, line 2202]
Statement [mozilla/js/src/jsparse.c, line 1900]
Statements [mozilla/js/src/jsparse.c, line 998]
js_CompileTokenStream [mozilla/js/src/jsparse.c, line 452]
CompileTokenStream [mozilla/js/src/jsapi.c, line 3004]
JS_CompileUCScriptForPrincipals [mozilla/js/src/jsapi.c, line 3085]
JS_EvaluateUCScriptForPrincipals [mozilla/js/src/jsapi.c, line 3537]
nsJSContext::EvaluateString [mozilla/dom/src/base/nsJSEnvironment.cpp, line
918]
nsJSThunk::EvaluateScript [mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line
288]
nsJSChannel::InternalOpen [mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line
536]
nsJSChannel::AsyncOpen [mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line
513]
nsDocumentOpenInfo::Open [mozilla/uriloader/base/nsURILoader.cpp, line 227]
nsURILoader::OpenURI [mozilla/uriloader/base/nsURILoader.cpp, line 828]
(Reporter)

Updated

14 years ago
Summary: recursive location="javascript:..." exits without crashing [@ js_EmitTree ] → recursive location="javascript:..." exits without crashing [@ RelExpr] (was [@ js_EmitTree ])

Comment 8

14 years ago
(In reply to comment #1)
> Created an attachment (id=129003)
> demo
> 

Confirming crash using:

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040330
Microsoft Windows 2000 Pro 5.00.2195 SP4

talkbackid: TB8918Q

Comment 9

13 years ago
WFM on even somewhat older Seamonkey and Firefox:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040810

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040814
Firefox/0.9.1+

Can be resolved fixed? If so, what fixed it?

For the record, I'm running XP SP 1 (not 2, no)
No crash here:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040823
Firefox/0.9.1+
(Reporter)

Comment 11

13 years ago
WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040825
Firefox/0.9.1+

But I get this in my JS console:

Error: too much recursion
Source File: chrome://browser/content/browser.js
Line: 3118

which is slightly scary -- code in a web page is causing an exception in chrome
javaScript.

Comment 12

13 years ago
Probably fixed with bug 226507 and bug 192414.

Comment 13

13 years ago
ignore my last comment 12, the dates don't match: comment 7 shows 1.7beta was
crashing.
(Reporter)

Comment 14

13 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041022 Firefox/1.0

Now I get

Error: too much recursion
Source File: javascript:(function(){location=document.links[0].href})()
Line: 1

WFM.
(Reporter)

Updated

13 years ago
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ RelExpr] [@ js_EmitTree ]
You need to log in before you can comment on or make changes to this bug.