Closed Bug 295666 Opened 20 years ago Closed 19 years ago

throw {toString: window.alert.call} causes crash [@ js_GetProperty]

Tracking

()

Status:

VERIFIED FIXED

Milestone:

mozilla1.8beta3

People

(Reporter: guninski, Assigned: brendan)

Details

(Keywords: crash, js1.5, testcase, Whiteboard: [cb] no progress for 1.8b3? (defer?))

Crash Data

Attachments

(2 files)

testcase for the crash 20 years ago georgi - hopefully not receiving bugspam 196 bytes, text/html		Details
fix 19 years ago Brendan Eich [:brendan] 1.87 KB, patch	shaver : review+ brendan : approval1.8b3+	Details \| Diff \| Splinter Review

georgi - hopefully not receiving bugspam

Reporter

Description

•

20 years ago

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4 Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4 throw {toString: window.alert.call} causes crash. testcase to follow. Reproducible: Always Steps to Reproduce: testcases to follow. Actual Results: crash Expected Results: no crash

georgi - hopefully not receiving bugspam

Reporter

Comment 1

•

20 years ago

Attached file testcase for the crash — Details

PikeUK

Comment 2

•

20 years ago

TB6164870Q ->Core: JS Engine

Assignee: nobody → general

Severity: normal → critical

Component: General → JavaScript Engine

OS: Linux → All

Product: Firefox → Core

QA Contact: general → general

Summary: throw {toString: window.alert.call} causes crash → throw {toString: window.alert.call} causes crash [@ js_GetProperty]

Version: unspecified → Trunk

PikeUK

Comment 3

•

20 years ago

Reproduced in: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050525 Firefox/1.0+

Keywords: crash, testcase

timeless

Comment 4

•

20 years ago

Incident ID: 6164870 Stack Signature js_GetProperty 721110f1 Product ID FirefoxTrunk Build ID 2005051906 Trigger Time 2005-05-27 00:42:40.0 Platform Win32 Operating System Windows 98 4.10 build 67766446 Module JS3250.DLL + (0002ccb5) URL visited User Comments Since Last Crash 126586 sec Total Uptime 126586 sec Trigger Reason Stack overflow Source File, Line No. c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 2734 Stack Trace js_GetProperty [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 2734] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3797] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3797] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3220] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175] fun_call [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c, line 1450] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1218] js_InternalGetOrSet [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1318] js_XDRObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3802] js_DefaultValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 3175]

georgi - hopefully not receiving bugspam

Reporter

Comment 5

•

20 years ago

according to dveditz: On the branch the above crashes in nsScriptSecurityManager::GetScriptPrincipal (http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=6 +157147) On the trunk javascript appears to get stuck in infinite recursion, blows the stack: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=61 +56893 That testcase ought to be spun into its own bug.

Boris Zbarsky [:bzbarsky]

Comment 6

•

20 years ago

This recurses completely inside the JS engine.... should we be doing some stack-limit checks here?

Status: UNCONFIRMED → NEW

Ever confirmed: true

Flags: blocking1.8b3?

Brendan Eich [:brendan]

Assignee

Comment 7

•

20 years ago

Yes, of course we should be checking -- d'oh. Taking. /be

Assignee: general → brendan

Flags: blocking1.8b3?

Flags: blocking1.8b3+

Flags: blocking-aviary1.1+

Keywords: js1.5

Priority: -- → P3

Target Milestone: --- → mozilla1.8beta3

Chris Beard

Updated

•

19 years ago

Whiteboard: [cb] no progress for 1.8b3? (defer?)

Chris Beard

Comment 8

•

19 years ago

need a patch in the next day if it's going to make 1.8b3

Brendan Eich [:brendan]

Assignee

Comment 9

•

19 years ago

Attached patch fix — Details — Splinter Review

I'd like to check this in today, get on with other bugs. /be

Attachment #188348 - Flags: review?(shaver)

Attachment #188348 - Flags: approval1.8b3+

Mike Shaver (:shaver emeritus)

Comment 10

•

19 years ago

Comment on attachment 188348 [details] [diff] [review] fix r=shaver.

Attachment #188348 - Flags: review?(shaver) → review+

Brendan Eich [:brendan]

Assignee

Comment 11

•

19 years ago

Fixed. /be

Status: NEW → RESOLVED

Closed: 19 years ago

Resolution: --- → FIXED

Bob Clary [:bc] (inactive)

Updated

•

19 years ago

Flags: testcase?

Bob Clary [:bc] (inactive)

Comment 12

•

19 years ago

Checking in regress-295666.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-295666.js,v <-- regress-295666.js initial revision: 1.1

Flags: testcase? → testcase+

Bob Clary [:bc] (inactive)

Comment 13

•

18 years ago

verified fixed 1.9 20060818

Status: RESOLVED → VERIFIED

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ js_GetProperty]

You need to log in before you can comment on or make changes to this bug.

Bugzilla

throw {toString: window.alert.call} causes crash [@ js_GetProperty]

Categories

(Core :: JavaScript Engine, defect, P3)

Tracking

()

People

(Reporter: guninski, Assigned: brendan)

References

Details

(Keywords: crash, js1.5, testcase, Whiteboard: [cb] no progress for 1.8b3? (defer?))

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Updated

Comment 8

Comment 9

Comment 10

Comment 11

Updated

Comment 12

Comment 13

Updated

Attachment

General

Description

File Name

Content Type