234013 - Browser Security Test crashes Mozilla [@ nsJSContext::ScriptEvaluated]

Status: RESOLVED WORKSFORME

(SeaMonkey :: General, defect)

Description

[Michele Della Guardia]

User-Agent:       
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040207 Firefox/0.8

Running browser security test crashes Mozilla browser during the test.

Reproducible: Always
Steps to Reproduce:
1. Go to www.scanit.be/bcheck
2. Allow popups from that site
3. Run "Test Mozilla bugs" or "All available test"
Actual Results:  
Mozilla crashes. I tried with Mozilla 1.6 and Firefox 0.8

Expected Results:  
I expected to complete the tests.

I'm using these plugins :
Java(TM) Plug-in 1.4.2_02-b03
Helix DNA Plugin
Shockwave Flash 6.0 r79
Acrobat Reader plugin

Comment 1

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040211

no crash, but silently aborting first of the mozilla-specific tests. Browser
weas working normally.
I had all pop-ups enabled, as they told me at first try they are needing this.
I´m seeing two warnings and two errors in the JS console:
I´ve cut some time-protected session ID string ... from the URLs.

Warning: assignment to undeclared variable popup
Source File: http://bcheck.scanit.be/bcheck/.../main.php?whichtests=specific
Line: 127
Error: uncaught exception: Permission denied to get property Window.focus

Warning: assignment to undeclared variable win
Source File: http://bcheck.scanit.be/bcheck/.../test-moz91043.php
Line: 27

Error: uncaught exception: [Exception... "Component returned failure code:
0x80004005 (NS_ERROR_FAILURE) [nsIControllers.removeController]"  nsresult:
"0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://navigator/content/navigator.js :: Shutdown :: line 721"  data: no]

Comment 2

[Michele Della Guardia]

> Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040211
> no crash, but silently aborting first of the mozilla-specific tests. Browser
> weas working normally.

Maybe this kind of bug was partially fixed in the 1.7a version ?

> I had all pop-ups enabled, as they told me at first try they are needing this.
> I´m seeing two warnings and two errors in the JS console:

My browser crashed so I wasn't able to get any error message.

Comment 3

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

I had JS console installed and started, and it was really nice to see 27 error
messages and 14 info messages, telling me, what Firefox denied to do in these 30
tests. Result: overwhelming zero vulnerabilities found.

Can you retest Firefox with Plug-Ins disabled?
To disable plugins, open Tools->Options->Downloads
Click the button 'Plug-Ins...' in the box 'File Types'
A new box opens, showing extensions, plug-in names, and a symbol, checked or
unchecked. Click on that sysmbol to enable or disable a plugin.

I didn´t find my Java plugin there, so I couldn´t disable it. But I don´t think,
that Java had been tested, as normally Java comes up and stays until I close the
browser.

Comment 4

[WD]

No crash here with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6)
Gecko/20040206 Firefox/0.8

Although a couple of the tests caused my Quicktime 6.0 plugin to crash.  (though
had no ill effects on the browser)

Comment 5

[Michele Della Guardia]

I tested it again without plugins.
Now the browser can complete without problems any Mozilla and Opera tests, but
still crashes if I run IE specific tests.
Is it normal ?

Comment 6

[Mats Palmgren (inactive)]

Confirming crash, 2004-02-12-08 trunk Linux

Comment 7

[Mats Palmgren (inactive)]

Attachment: Stack

Comment 8

[Boris Zbarsky [:bzbarsky]]

I'm getting a sligtly different stack ending in:

#0  0x00000060 in ?? ()
#1  0x41432903 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*)
(this=0x8a6cb18, 
    aRequest=0x8b2e228)
    at /home/bzbarsky/mozilla/debug/mozilla/content/base/src/nsScriptLoader.cpp:574
#2  0x414326cb in nsScriptLoader::ProcessScriptElement(nsIDOMHTMLScriptElement*,
nsIScriptLoaderObserver*) (this=0x8a6cb18, aElement=0x8da6700, aObserver=0x8da6704)
    at /home/bzbarsky/mozilla/debug/mozilla/content/base/src/nsScriptLoader.cpp:520

So it looks like we're somehow jumping out into random memory....

Note that before this crash I see:

###!!! ASSERTION: JSContext still in threadjscontextstack!:
'!tls->GetJSContextStack() || !tls->GetJSContextStack()->
DEBUG_StackHasJSContext(aJSContext)', file
/home/bzbarsky/mozilla/debug/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 1079

which is likely the problem.

Comment 9

[Mats Palmgren (inactive)]

WFM, "All available test" runs to end without crashing, trunk and 1.8 branch
debug builds and Minefield nightly 20070513, all on Linux.

Comment 10

[Mats Palmgren (inactive)]

WFM, trunk/branches on all three tier-1 platforms.

-> WORKSFORME