469824 - crash when using Firefox JS debugger service on cnn.com

Status: RESOLVED DUPLICATE of bug 465808

(Core :: JavaScript Engine, defect)

Description

[Bryan McQuade]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2
Build Identifier: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2

Firefox 3.1 beta 1 and 2 both crash on cnn.com when a jsdIScriptHook is registered with the jsdIDebuggerService and that scriptHook attempts to dereference a script's functionSource attribute. This crash happens 100% of the time. It seems to be related to code that gets eval()'d by cnn.com.

I have verified the crash on both Linux and on Windows XP.

This crash does not happen in Firefox 3.0 and older.

This crash happens even if I disable javascript.options.jit.content and javascript.options.jit.chrome.

Reproducible: Always

Steps to Reproduce:
1. enable jsdIDebuggerService and attach a jsdIScriptHook (see attachment for specific example)
2. navigate to cnn.com

Actual Results:  
browser crashes before page load is complete

Expected Results:  
browser should not crash

Comment 1

[Bryan McQuade]

Attachment: example jsdIScriptHook implementation that causes browser crash

You will need to enable window.dump() in order to run this example.

To use:
1. save attached file to local disk
2. navigate to the attached file using a file:// URL (e.g. file:///home/user/scriptHookCrash.html)
3. open a new tab
4. navigate to cnn.com in that new tab
5. observe crash

Comment 2

[timeless]

could you please attach a stack trace? i prefer not to run random code, and typically i can fix based on the stack trace.

also, your useragent/buildid say linux, but the os says windows...

Comment 3

[Bryan McQuade]

I have verified the crash on both Linux and on Windows XP.

crash report at:
http://crash-stats.mozilla.com/report/index/5d22a392-d700-4343-a743-39f8e2081216?p=1

Please let me know if you need any additional information.

Comment 4

[John J. Barton]

The crash is in decompile (script.functionSource).

Comment 5

[:Gijs (he/him)]

Platform/OS == All/All per comment #3.

Pretty sure crashes are supposed to be sev: cri. :-)