453412 - TM: Comerica Web Banking login fails with script error when TraceMonkey enabled

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Laurence "GreenReaper" Parry]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b1pre) Gecko/20080901033305 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b1pre) Gecko/20080901033305 Minefield/3.1b1pre

When trying to log into Comerica Web Banking with javascript.options.jit.content set to true, I found that my regular customer ID was rejected by a seemingly inapplicable javascript check. Turning it off resolved this problem.

Reproducible: Always

Steps to Reproduce:
1. Go to website
2. Enter a five digit alphanumeric code in the Customer ID box
3. Click "Login"
Actual Results:  
An alert box saying "Field value cannot contain the characters < or >. Please try again." 

Expected Results:  
The website should have logged me in, if the customer ID and password was correct, or at least told me that I needed to enter a password or that it was correct - it shouldn't have failed on the customer ID check.

http://reporter.mozilla.org/app/report/?report_id=RMO12204190346943

This javascript file with the validation function is loaded with a relative path (../../lib/validationGeneral.js):
https://webbanking.comerica.com/lib/validationGeneral.js

Comment 1

[welcometotheconcretejungle]

ha ha ha ha ha I AM THE SMARTEST KID IN THE WHOLE SCHOOL AND I AM A SOPHOMORE CAN YOU FIND ME?

Comment 2

[Brendan Eich [:brendan]]

Could someone confirm this bug? Thanks,

/be

Comment 3

[Bob Clary [:bc] (inactive)]

can not confirm with today's m-c minefield/macosx/winxp: customer id 12345, pin 12345, message: customer account closed... for content jit on or off

Comment 4

[Laurence "GreenReaper" Parry]

Continues occurring here with most recent nightly tracemonkey build, on both native Vista SP1 (Core 2 Q6600) and XP SP3 (Core T2400):

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/20080902033144 Minefield/3.1a2pre (.NET CLR 3.5.30729)

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080902033144 Minefield/3.1a2pre

Bob's reported message is only given here when javascript.options.jit.content is switched to false (a reload of the page does not appear to be necessary).

Comment 5

[Matthias Versen [:Matti]]

wfm with Seamonkey trunk ( Gecko/20080904003653 ) and TM enabled.
Core 2 Duo 5450 on vista 32bit

I get the same error message that BC gets.

Reporter: Did you try the Firefox safemode or a new, additional test profile ?

Comment 6

[Laurence "GreenReaper" Parry]

No, I didn't. However, neither -safemode nor a new profile change the situation here.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

Does this happen with any alphanumeric string, regardless of what's in the PIN box?

I can't seem to reproduce this either yet.

Comment 8

[Laurence "GreenReaper" Parry]

OK, I think I've tracked down the issue with reproduction. The problem appears to require Data Execution Prevention to be turned on for all programs. This setting seems to be interfering with the JIT (not entirely unexpected, since it controls the use of memory to execute code).

This DEP mode is also known as "OptOut" mode. It is accessible from Control Panel/System/Advanced/Performance Settings/Data Execution Prevention/"Turn on DEP for all programs and services except for those I select". Unfortunately it does not appear to be possible to temporarily disable for Firefox while testing using the Add button on this dialog - I got an error when trying to add it.

Please try using a five character string, like "atest". It did not always cause the same problem for me if I only used four characters, like "test". This makes very little sense because both of them should pass the check that the alert refers to (>4 characters is another validity check with a different error message), but then I don't know what the JIT is doing behind the scenes . . .

Comment 9

[Ryan VanderMeulen [:RyanVM]]

WFM on current trunk. When I enter username "atersta" and hit login, it complains that I haven't entered a password. When I enter a bogus password too, I get "We are unable to validate your input. Please try again, or select 'Forgot Your Password?'. If you need assistance, contact Customer Service at 888.444.9876."

Laurence, can you confirm that a current nightly build works OK?

Comment 10

[Matthias Versen [:Matti]]

wfm with Seamonkey trunk - marking as such
Please reopen if this is still an issue