Last Comment Bug 582649 - Too-much-recursion crash with setUserData [@ * | XPCConvert::JSArray2Native]
: Too-much-recursion crash with setUserData [@ * | XPCConvert::JSArray2Native]
Status: RESOLVED FIXED
[sg:dos]
: crash, testcase
Product: Core
Classification: Components
Component: DOM (show other bugs)
: unspecified
: x86 Windows 7
: -- critical (vote)
: ---
Assigned To: Peter Van der Beken [:peterv] - away till Aug 1st
:
Mentors:
: 475629 (view as bug list)
Depends on: 731334
Blocks: crossfuzz
  Show dependency treegraph
 
Reported: 2010-07-28 10:06 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2012-02-28 11:08 PST (History)
7 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
.13-fixed
.16-fixed


Attachments
Testcase (crashes browser) (162 bytes, text/html)
2010-08-02 08:15 PDT, Peter Van der Beken [:peterv] - away till Aug 1st
no flags Details
v1 (2.20 KB, patch)
2010-08-02 13:19 PDT, Peter Van der Beken [:peterv] - away till Aug 1st
mrbkap: review+
Details | Diff | Splinter Review
v1 (with crashtest) (2.98 KB, patch)
2010-08-20 06:54 PDT, Peter Van der Beken [:peterv] - away till Aug 1st
peterv: review+
benjamin: approval2.0+
dveditz: approval1.9.2.11-
dveditz: approval1.9.2.13+
dveditz: approval1.9.1.14-
dveditz: approval1.9.1.16+
Details | Diff | Splinter Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2010-07-28 10:06:12 PDT
Created attachment 460910 [details]
zipped up unminimized testcase

See unminimized testcase, you need to unzip it, then open the file named 'parentframe.htm'. And you need the script grant enhanced privileges (this is to force gc).
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2010-07-28 10:08:19 PDT
This is a typical crash, that I get:
http://crash-stats.mozilla.com/report/index/4c1f136e-d445-4630-ad33-1863f2100728
0  	xul.dll  	nsXPConnect::WrapJS  	 js/src/xpconnect/src/nsXPConnect.cpp:1348
1 	xul.dll 	XPCVariant::InitializeData 	js/src/xpconnect/src/xpcvariant.cpp:392
2 	xul.dll 	XPCVariant::newVariant 	js/src/xpconnect/src/xpcvariant.cpp:148
3 	xul.dll 	XPCConvert::JSData2Native 	js/src/xpconnect/src/xpcconvert.cpp:977
4 	xul.dll 	XPCConvert::JSArray2Native 	
5 	xul.dll 	XPCVariant::InitializeData 	
6 	xul.dll 	XPCConvert::JSData2Native 	js/src/xpconnect/src/xpcconvert.cpp:977
7 	xul.dll 	XPCConvert::JSArray2Native 	
8 	xul.dll 	XPCVariant::InitializeData 


Other crashes that I got:
http://crash-stats.mozilla.com/report/index/bp-202dd796-19f0-4e83-8359-165612100728
0  	xul.dll  	nsXPCWrappedJSClass::DelegatedQueryInterface  	 js/src/xpconnect/src/xpcwrappedjsclass.cpp:645
1 	xul.dll 	nsXPCWrappedJS::QueryInterface 	js/src/xpconnect/src/xpcwrappedjs.cpp:185
2 	xul.dll 	XPCConvert::JSObject2NativeInterface 	
3 	xul.dll 	xul.dll@0xa5eabb

http://crash-stats.mozilla.com/report/index/bp-148387f3-57ca-4d81-bd43-85f592100728
0  	xul.dll  	nsXPCWrappedJSClass::DelegatedQueryInterface  	 js/src/xpconnect/src/xpcwrappedjsclass.cpp:645
1 	xul.dll 	nsXPCWrappedJS::QueryInterface 	js/src/xpconnect/src/xpcwrappedjs.cpp:185
2 	xul.dll 	XPCConvert::JSObject2NativeInterface 	
3 	xul.dll 	xul.dll@0xa5eabb

Unfortunately, I wasn't able to minimize the testcase further, thus far.
Comment 2 Benjamin Smedberg AWAY UNTIL 2-AUG-2016 [:bsmedberg] 2010-07-28 10:40:55 PDT
Is this 4.0-only, or also 3.6.x?
Comment 3 Martijn Wargers [:mwargers] (not working for Mozilla) 2010-07-28 12:44:04 PDT
The unminimized testcase only crashes on trunk, but that might perhaps only be because of the oddness of it.
Comment 4 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-02 05:11:37 PDT
For me this crashed in 3.6.x on OS X in nsCycleCollectingAutoRefCnt::get.
Comment 5 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-02 08:15:42 PDT
Created attachment 462073 [details]
Testcase (crashes browser)

This looks like it's caused by a recursive reference in an array. We recurse to death trying to wrap the array in XPConnect.
Comment 6 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-02 13:19:39 PDT
Created attachment 462151 [details] [diff] [review]
v1

Would it be ok to use the SpiderMonkey recursion checks in XPConnect?
Comment 7 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-03 11:29:48 PDT
Comment on attachment 462151 [details] [diff] [review]
v1

Brendan said "sure" on irc.
Comment 8 Jesse Ruderman 2010-08-03 17:44:46 PDT
*** Bug 475629 has been marked as a duplicate of this bug. ***
Comment 9 Olli Pettay [:smaug] 2010-08-17 04:57:47 PDT
Should the patch get approval?
Comment 10 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-20 06:54:03 PDT
Created attachment 467752 [details] [diff] [review]
v1 (with crashtest)

Fixes crash.
Comment 11 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-26 08:16:09 PDT
http://hg.mozilla.org/mozilla-central/rev/f0f25f2693cd
Comment 12 Peter Van der Beken [:peterv] - away till Aug 1st 2010-08-26 08:40:26 PDT
Comment on attachment 467752 [details] [diff] [review]
v1 (with crashtest)

Simple fix to catch recursion crash.
Comment 13 Daniel Veditz [:dveditz] 2010-09-27 10:51:54 PDT
Comment on attachment 467752 [details] [diff] [review]
v1 (with crashtest)

Approved for 1.9.2.11 and 1.9.1.14, a=dveditz for release-drivers
Comment 15 Daniel Veditz [:dveditz] 2010-10-04 10:24:41 PDT
Comment on attachment 467752 [details] [diff] [review]
v1 (with crashtest)

missed the 1.9.2.11/1.9.1.14 releases, go for next time.
Comment 16 Reed Loden [:reed] (use needinfo?) 2010-11-19 01:14:20 PST
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/00c87ede773a
Comment 17 Reed Loden [:reed] (use needinfo?) 2010-11-19 01:57:13 PST
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/7da8e189105d

Note You need to log in before you can comment on or make changes to this bug.