459653 - Hang with DOMAttrModified and removing attributes

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase which hangs current trunk build after 100ms.

I guess it's kinda obvious that it hangs, but ideally Mozilla should just bail out with an infinite recursion error in the js console or something.

Stack from debug build of the hanging thread:
>	xpc3250.dll!nsXPTParamInfo::IsRetval()  Line 159 + 0x1 bytes	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2060 + 0x2f bytes	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x08b473b0, JSObject * obj=0x08321de0, unsigned int argc=1, long * argv=0x0bfcb12c, long * vp=0x0012e638)  Line 1477 + 0xe bytes	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x08b473b0, unsigned int argc=1, long * vp=0x0bfcb124, unsigned int flags=2)  Line 1306 + 0x1a bytes	C++
 	js3250.dll!js_Interpret(JSContext * cx=0x08b473b0)  Line 5001 + 0x16 bytes	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x08b473b0, unsigned int argc=1, long * vp=0x0bfcb118, unsigned int flags=0)  Line 1324 + 0x9 bytes	C++
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x08b473b0, JSObject * obj=0x064f1420, long fval=213335888, unsigned int flags=0, unsigned int argc=1, long * argv=0x0bade960, long * rval=0x0012f628)  Line 1381 + 0x15 bytes	C++
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x08b473b0, JSObject * obj=0x064f1420, long fval=213335888, unsigned int argc=1, long * argv=0x0bade960, long * rval=0x0012f628)  Line 5133 + 0x1f bytes	C++
 	gklayout.dll!nsJSContext::CallEventHandler(nsISupports * aTarget=0x085b40f8, void * aScope=0x064f1420, void * aHandler=0x0cb73f50, nsIArray * aargv=0x06b34694, nsIVariant * * arv=0x0012f6e0)  Line 2000 + 0x24 bytes	C++
 	gklayout.dll!nsGlobalWindow::RunTimeout(nsTimeout * aTimeout=0x06b346d8)  Line 7721 + 0xab bytes	C++
 	gklayout.dll!nsGlobalWindow::TimerCallback(nsITimer * aTimer=0x0be3ba88, void * aClosure=0x06b346d8)  Line 8056	C++
 	xpcom_core.dll!nsTimerImpl::Fire()  Line 420 + 0xe bytes	C++
 	xpcom_core.dll!nsTimerEvent::Run()  Line 514	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f848)  Line 511	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x012d4138, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 170 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 182 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x012d0490, const nsXREAppData * aAppData=0x012d0960)  Line 3265 + 0x25 bytes	C++
 	firefox.exe!NS_internal_main(int argc=1, char * * argv=0x012d0490)  Line 156 + 0x12 bytes	C++
 	firefox.exe!wmain(int argc=1, unsigned short * * argv=0x003fa348)  Line 87 + 0xd bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes	C
 	firefox.exe!wmainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Not recursion error, but "slow script" -warning, I think.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Clear mOperationCallbackTime only if aTerminated

The problem here is that AutoScriptEvaluate::~AutoScriptEvaluate()
/ScriptExecuted calls ScriptEvaluated all the time and
clears mOperationCallbackTime, even if ::JS_IsRunning(mContext) returns true.

Comment 3

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081020 Minefield/3.1b2pre