288659 - crash if I browse the homepage with bad javascripts.

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Fred Chien]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-TW; rv:1.7.6) Gecko/20050318 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-TW; rv:1.7.6) Gecko/20050318 Firefox/1.0.2

To execute these javascripts code:

var cl = new Array(null,"z","x","d","c","a","a","b","a");
for (i=1;i<=cl.length;i++) {
document.write(cl[i]);
}

or 

var cl = new Array(null,"z","x","d","c","a","a","b","a");

for (i=1;i=cl.length;i++) {
document.write(cl[i]);
}

Reproducible: Didn't try

Steps to Reproduce:
1. just run the code.

Actual Results:  
Firefox have no response and even crush.

Expected Results:  
Just fix it.
The Bug makes firefox be not safe.

Comment 1

[Fred Chien]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-TW; rv:1.7.6)
Gecko/20050318 Firefox/1.0.2
> Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-TW; rv:1.7.6)
Gecko/20050318 Firefox/1.0.2
> 
> To execute these javascripts code:
> 
> var cl = new Array(null,"z","x","d","c","a","a","b","a");
> for (i=1;i<=cl.length;i++) {
> document.write(cl[i]);
> }
> 
> or 
> 
> var cl = new Array(null,"z","x","d","c","a","a","b","a");
> 
> for (i=1;i=cl.length;i++) {
> document.write(cl[i]);
> }
> 
> Reproducible: Didn't try
> 
> Steps to Reproduce:
> 1. just run the code.
> 
> Actual Results:  
> Firefox have no response and even crush.
> 
> Expected Results:  
> Just fix it.
> The Bug makes firefox be not safe.

sorry, I have some wrong in my report.
I will modify it:

firefox only crush or had no response with:
for (i=1;i=cl.length;i++)

And the code is running rightly(I posted the wrong before):
for (i=1;i<=cl.length;i++)

Comment 2

[Daniel Veditz [:dveditz]]

I cannot reproduce your crash. The code creates an infinite loop ("i=cl.length"
is an assignment, always returning true since cl.length is non-zero), but after
a short while of high CPU usage (the loop) a confirm dialog comes up announcing
that a script is causing the application to "run slowly" and giving you the
opportunity to cancel it.

I get no crash.