Note: There are a few cases of duplicates in user autocompletion which are being worked on.

Javascript library jsMath causes Firefox to crash [@ ClaimScope][@ WillDeadLock]

RESOLVED FIXED in mozilla1.9alpha1

Status

()

Core
JavaScript Engine
P1
critical
RESOLVED FIXED
12 years ago
6 years ago

People

(Reporter: Jamie Thingelstad, Assigned: mrbkap)

Tracking

({crash, fixed1.8.1, verified1.8.0.2})

Trunk
mozilla1.9alpha1
crash, fixed1.8.1, verified1.8.0.2
Points:
---
Bug Flags:
blocking1.8.1 +
blocking1.8.0.2 +
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [rft-dl], crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

The jsMath javascript library worked fine with Firefox 1.5. However, when using it in Firefox 1.5.0.1 it causes Firefox to crash immediately. You can see this at http://www.roadsignmath.com/. The jsMath library itself can be found at http://www.math.union.edu/~dpvc/jsMath/. (I have notified the author of this issue as well.)

Reproducible: Always

Steps to Reproduce:
1. Go to any page that uses the jsMath library.
2.
3.

Actual Results:  
Browser crashes.

Expected Results:  
Should have loaded the page.

Comment 1

12 years ago
please reinstall firefox with talkback and then crash again, run talkback.exe,
and copy the incident id to this bug.
Keywords: stackwanted
(Reporter)

Comment 2

12 years ago
(In reply to comment #1)
> please reinstall firefox with talkback and then crash again, run talkback.exe,
> and copy the incident id to this bug.
> 

Check out TB14651859H, TB14651716M, TB14645808Y, TB14645140W.

Comment 3

12 years ago
Incident ID: 14645140  Stack Signature    ClaimScope a3077c61 Product ID         Firefox15 Build ID           2006011112 Trigger Time       2006-02-01 21:40:03.0 Platform           Win32 Operating System   Windows NT 5.1 build 2600 Module             js3250.dll + (00028064) URL visited        http://www.roadsignmath.com/ User Comments      just opened up site. Since Last Crash   3158 sec Total Uptime       3158 sec Trigger Reason     Access violation Source File, Line No. c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 453 Stack Trace  ClaimScope  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 453] js_LockScope  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 1055] js_LockObj  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 1207] js_LookupProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2615] js_LookupHiddenProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2367] call_resolve  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsfun.c, line 818] js_LookupPropertyWithFlags  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2710] js_LookupProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2615] js_FindProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2824] js_FindIdentifierBase  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2855] js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 2619] js_Execute  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424] JS_EvaluateUCScriptForPrincipals  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4103] nsJSContext::EvaluateString  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1061] nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6296] nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6667] nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151] main  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]  Incident ID: 14645808  Stack Signature    WillDeadlock c1d7eafa Product ID         Firefox15 Build ID           2006011112 Trigger Time       2006-02-01 22:20:41.0 Platform           Win32 Operating System   Windows NT 5.1 build 2600 Module             js3250.dll + (00028175) URL visited        http://www.roadsignmath.com/ User Comments Since Last Crash   651 sec Total Uptime       3931 sec Trigger Reason     Access violation Source File, Line No. c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 275 Stack Trace  WillDeadlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 275] js_LockScope  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 1055] js_LockObj  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jslock.c, line 1207] js_LookupProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2615] js_LookupHiddenProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2367] call_resolve  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsfun.c, line 818] js_LookupPropertyWithFlags  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2710] js_LookupProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2615] js_FindProperty  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2824] js_FindIdentifierBase  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2855] js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 2619] js_Execute  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424] JS_EvaluateUCScriptForPrincipals  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4103] nsJSContext::EvaluateString  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1061] nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6296] nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6667] nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151] main  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61] kernel32.dll + 0x16d4f (0x7c816d4f)
Assignee: nobody → general
Component: General → JavaScript Engine
Keywords: stackwanted → crash
Product: Firefox → Core
QA Contact: general → general
Summary: Javascript library jsMath causes Firefox to crash → Javascript library jsMath causes Firefox to crash [@ ClaimScope][@ WillDeadLock]
Version: unspecified → 1.8 Branch
Created attachment 210471 [details]
testcase

I haven't been able to minimise it much, but I definetely crashe almost every time  after the alert with current trunk build.

Updated

12 years ago
Status: UNCONFIRMED → NEW
Ever confirmed: true
Ria found a regression range between 2005-12-14 13 and 20051214 22.
So I guess this could be a regression from bug 320172.

Comment 6

12 years ago
This seems to be related to the window.eval() call that is in the jsMath.Script.Uncompress() routine in the jsMath.js file.  If I change "window.eval" to "eval" in that routine, Firefox doesn't crash.
(Assignee)

Comment 7

12 years ago
Created attachment 210540 [details] [diff] [review]
Fix

*sigh*, we needed to js_PutCallObject in the return path from the inline call to avoid references to popped fp's coming back and biting us in the ass.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #210540 - Flags: review?(brendan)
(Assignee)

Comment 8

12 years ago
Comment on attachment 210540 [details] [diff] [review]
Fix

Brendan says r=him
Attachment #210540 - Flags: review?(brendan)
Attachment #210540 - Flags: review+
Attachment #210540 - Flags: branch-1.8.1?(brendan)
Attachment #210540 - Flags: approval1.8.0.2?
(Assignee)

Comment 9

12 years ago
Fix checked into trunk. Can someone contact the authors of the site and tell them that the workaround in comment 6 should work?
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Flags: blocking1.8.1?
Flags: blocking1.8.0.2?
Resolution: --- → FIXED
(Assignee)

Comment 10

12 years ago
*** Bug 325721 has been marked as a duplicate of this bug. ***
(Assignee)

Updated

12 years ago
OS: Windows XP → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9alpha
Version: 1.8 Branch → Trunk
(Assignee)

Comment 11

12 years ago
*** Bug 325647 has been marked as a duplicate of this bug. ***
*** Bug 325779 has been marked as a duplicate of this bug. ***
Flags: blocking1.8.1?
Flags: blocking1.8.1+
Flags: blocking1.8.0.2?
Flags: blocking1.8.0.2+
Comment on attachment 210540 [details] [diff] [review]
Fix

Sure for 1.8.0.2 -- for 1.8.1 we can wait till the entire js engine is uplifted to 1.7 if you like, or land it now to reduce the merge diff later.

/be
Attachment #210540 - Flags: branch-1.8.1?(brendan)
Attachment #210540 - Flags: branch-1.8.1+
Attachment #210540 - Flags: approval1.8.0.2?
Attachment #210540 - Flags: approval1.8.0.2+

Comment 14

12 years ago
I could use some help with creating a reduced testcase.
Flags: testcase?
(Assignee)

Comment 15

12 years ago
Fix checked into the 1.8 branches.
Keywords: fixed1.8.0.2, fixed1.8.1

Updated

12 years ago
Whiteboard: [rft-dl]

Comment 16

12 years ago
v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060301 Firefox/1.5.0.1, no crash with testcase, but I do see a hang as the page tries to load.  Is that expected?  Better than a crash I guess.
Keywords: fixed1.8.0.2 → verified1.8.0.2

Comment 17

12 years ago
Ok, it wasn't a hang, the page just doesn't load.  I think something else running on my machine caused a temporary hang, but it's NOT the testcase (the page just doesn't finish rendering, throbber forever).

Updated

11 years ago
Flags: in-testsuite? → in-testsuite-
verified for Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1b2) Gecko/20060818 BonEcho/2.0b2 no crash on testcase and Url
Crash Signature: [@ ClaimScope] [@ WillDeadLock]
You need to log in before you can comment on or make changes to this bug.