214712 - recursive location="javascript:..." exits without crashing [@ RelExpr] (was [@ js_EmitTree ])

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

The following code causes Firebird 07/30 to exit but does not bring up talkback
or the WinXP crash dialog:

<a href="javascript:(function(){location=document.links[0].href})()">die</a>

IE, Opera, and Netscape treat it like a normal javascript infinite loop.  (Opera
does not hang but uses 100% CPU.)

Comment 1

[Jesse Ruderman]

Attachment: demo

Comment 2

[Olivier Cahagne]

confirming using 2003073004 on Win2k: TB22377699Y.

Comment 3

[Olivier Cahagne]

ignore comment 2, this was a TB ID from bug 214761.

Comment 4

[Olivier Cahagne]

2003080504 on Win2k: TB22542415Z
Hope it'll show up tomorrow on:
http://ftp25moz.newaol.com/pub/data/crash-data/detailed-crash-analysis-all.html

Comment 5

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: stack

stack trace

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030817 Mozilla
Firebird/0.6.1+

Comment 6

[Olivier Cahagne]

similar stack in bug 207545 and bug 197052.

Comment 7

[Asa Dotzler [:asa]]

Attachment: stack trace from 1.7 beta

I get a slightly different stack from 1.7 beta on winXP. The top of it looks
like this: 

RelExpr [mozilla/js/src/jsparse.c, line 2420]
EqExpr [mozilla/js/src/jsparse.c, line 2384]
BitAndExpr [mozilla/js/src/jsparse.c, line 2372]
BitXorExpr [mozilla/js/src/jsparse.c, line 2359]
BitOrExpr [mozilla/js/src/jsparse.c, line 2346]
AndExpr [mozilla/js/src/jsparse.c, line 2335]
OrExpr [mozilla/js/src/jsparse.c, line 2324]
CondExpr [mozilla/js/src/jsparse.c, line 2284]
AssignExpr [mozilla/js/src/jsparse.c, line 2230]
Expr [mozilla/js/src/jsparse.c, line 2202]
Statement [mozilla/js/src/jsparse.c, line 1900]
Statements [mozilla/js/src/jsparse.c, line 998]
js_CompileTokenStream [mozilla/js/src/jsparse.c, line 452]
CompileTokenStream [mozilla/js/src/jsapi.c, line 3004]
JS_CompileUCScriptForPrincipals [mozilla/js/src/jsapi.c, line 3085]
JS_EvaluateUCScriptForPrincipals [mozilla/js/src/jsapi.c, line 3537]
nsJSContext::EvaluateString [mozilla/dom/src/base/nsJSEnvironment.cpp, line
918]
nsJSThunk::EvaluateScript [mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line
288]
nsJSChannel::InternalOpen [mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line
536]
nsJSChannel::AsyncOpen [mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line
513]
nsDocumentOpenInfo::Open [mozilla/uriloader/base/nsURILoader.cpp, line 227]
nsURILoader::OpenURI [mozilla/uriloader/base/nsURILoader.cpp, line 828]

Comment 8

[Anders Pedersen]

(In reply to comment #1)
> Created an attachment (id=129003)
> demo
> 

Confirming crash using:

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040330
Microsoft Windows 2000 Pro 5.00.2195 SP4

talkbackid: TB8918Q

Comment 9

[Jan Moesen]

WFM on even somewhat older Seamonkey and Firefox:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040810

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040814
Firefox/0.9.1+

Can be resolved fixed? If so, what fixed it?

For the record, I'm running XP SP 1 (not 2, no)

Comment 10

[Robert Accettura [:raccettura]]

No crash here:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040823
Firefox/0.9.1+

Comment 11

[Jesse Ruderman]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040825
Firefox/0.9.1+

But I get this in my JS console:

Error: too much recursion
Source File: chrome://browser/content/browser.js
Line: 3118

which is slightly scary -- code in a web page is causing an exception in chrome
javaScript.

Comment 12

[Olivier Cahagne]

Probably fixed with bug 226507 and bug 192414.

Comment 13

[Olivier Cahagne]

ignore my last comment 12, the dates don't match: comment 7 shows 1.7beta was
crashing.

Comment 14

[Jesse Ruderman]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041022 Firefox/1.0

Now I get

Error: too much recursion
Source File: javascript:(function(){location=document.links[0].href})()
Line: 1

WFM.