328249 - E4X crash due to infinite recursion in js_IsXMLName

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Brendan Eich [:brendan]]

Blake generously offered to dive between this bullet and the president, in slow-mo yelling "guuuuuuhnnnnnnnnnnnn!", or was that "eeeeeeeeeeeeeefoooooooorrrrrrrrrrrrrxxxxxxxxxxxxxxxxxxxxxxxx!"?

/be

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

*** Bug 328254 has been marked as a duplicate of this bug. ***

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Our cycle detection wasn't handling lists, causing us to miss the "easy" case described here. Lists of length 1 are special in that you can do stuff on them that acts like you're doing it to its only element, therefore CheckCycle needs to deal.

Note that we catch the case where kids->length > 1 before we ever get near the CheckCycle code.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 212961 [details] [diff] [review]
Fix 

I was a collaborator on this fix, but sure, r=me.

BTW, E4X sucks.

/be

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 212961 [details] [diff] [review]
Fix 

approved for 1.8.9 branch, a=dveditz for drivers

Comment 9

[Daniel Veditz [:dveditz]]

> 1.8.9 branch

1.8.0, I mean

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branches.

Comment 11

[Bob Clary [:bc] (inactive)]

Checking in regress-328249.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-328249.js,v  <--  regress-328249.js
initial revision: 1.1
done

I don't see a crash in today's ff trunk on winxp, but a current debug shell does appear to crash. I'll know more when I do a full test run.

Comment 12

[Dave Liebreich [:davel]]

Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates) since in-testsuite+ indicates a test case exists in the js test library.

Comment 13

[Bob Clary [:bc] (inactive)]

v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac