479499 - The testcase from bug 460706 can hang

Status: RESOLVED FIXED

(Core :: XML, defect)

Description

[Martijn Wargers (dead)]

The testcase from bug 460706, https://bugzilla.mozilla.org/attachment.cgi?id=343855 , can hang.
It doesn't happen always, if it doesn't happen for you, try reloading it a couple of times.
Marking this bug security sensitive, since bug 460706 is also security sensitive.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Testcase that automatically reloads after a couple of hundred ms. This is pretty quickly hanging in current trunk build for me.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This is a non-exploitable hang.

I'm not exactly sure how this happens, but we end up with start being past end. I think it might have to do with mExpatBuffered + start.size_forward() allowing us to jump past |end|, but I haven't proved it.

Comment 3

[Peter Van der Beken [:peterv]]

Comment on attachment 363424 [details] [diff] [review]
Proposed fix

We also use end in the block for NS_FAILED(mInternalState). It's ok to not update it there I think, we're looking for a newline in the buffer that we tried to parse. We'll just use less than the data that we do have at our disposal but since it's for error reporting that's no big deal.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/f364b7f1b082

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

I'm going to wait to enable the crashtest for this bug (and bug 460706) until I have a chance to run it.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Crashtest enabled.

Comment 8

[Johnathan Nightingale [:johnath]]

This crashtest is hanging on mozilla-central right now.  See, e.g. http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1236077322.1236085244.18044.gz

I think we should disable it, and re-open this bug.

Comment 9

[Johnathan Nightingale [:johnath]]

Backed out, re-disabling the test: 

http://hg.mozilla.org/mozilla-central/rev/c395bb2cf30a

Comment 10

[Samuel Sidler (old account; do not CC)]

Blake: Any update here? Hanging on that testcase isn't much better than crashing. :)

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Sure it is, you can't exploit a hang! :) I'll look into this as soon as I get a chance.

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Trying again... https://hg.mozilla.org/integration/mozilla-inbound/rev/e2d470f1c616

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e2d470f1c616