314059 - crash [@ XMLToXMLString] (jsxml.c line 2867)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Aiko]

This is similar to bug 311580, it creates a huge XML object and tries to stringify it. Open the attached testcase, then press the button (or, in the JS shell, type 'body'). This probably crashes. I suck at using WinDbg (and debugging C in general), but it points to this line:

     if (ns->prefix && !IS_EMPTY(ns->prefix)) {

where ns is an invalid but non-null pointer, causing an access violation.

Btw., thank you for the Bugzilla permissions. I'll leave this report unconfirmed until somebody else can reproduce it.

(Build id: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051027 Firefox/1.6a1)

Comment 1

[Aiko]

Attachment: testcase

Comment 2

[Bob Clary [:bc] (inactive)]

confirm on branch and trunk/winxp

Comment 3

[Sébastien Auger]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051027 Firefox/1.5

I am confirming too.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

This has r=brendan. We are int-tagging the marks, but not int-detagging them to use them.

Comment 5

[Brendan Eich [:brendan]]

One-line patch to a bug that leaves a dangling pointer being used for loads but not stores.  Probably not exploitable, easily fixed, E4X polish bug.  Should ride along if there is an rc2.

/be

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Checked into trunk.

Comment 7

[Sébastien Auger]

(In reply to comment #5)
> One-line patch to a bug that leaves a dangling pointer being used for loads but
> not stores.  Probably not exploitable, easily fixed, E4X polish bug.  Should
> ride along if there is an rc2.
> 
> /be
> 

We absolutely need a RC2 I crashed a lot these past 2 days. It started with 20051016 daily. TB11144987H

I'm trying to figure out what caused this and maybe open a bug. I was too busy at College.

Comment 8

[Asa Dotzler [:asa]]

moving out to the 1.8 rc2 ride-along candidate list. We'll consider taking this if we do an RC2.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Checked into MOZILLA_1_8_BRANCH.

Comment 10

[Bob Clary [:bc] (inactive)]

tested with firefox 1.5 rc2 on winxp/linux

testcase: no crash, out of memory in js console

Comment 11

[Bob Clary [:bc] (inactive)]

can't really add to the automatic tests since it requires a user action after the out of memory error which I can't catch.