Closed Bug 603858 Opened 14 years ago Closed 14 years ago

setTimeout(XML,0) crashes [@ JSStackFrame::scopeChain]

Categories

(Core :: XPConnect, defect)

Product:
Core
Component:
XPConnect
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
status1.9.2 --- unaffected
status1.9.1 --- unaffected

People

(Reporter: jruderman, Assigned: mrbkap)

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(3 files)

testcase (crashes Firefox when loaded)
170 bytes, text/html
Details
stack trace
3.96 KB, text/plain
Details
Fix
990 bytes, patch
Waldo
: review+
Details | Diff | Splinter Review 
Happens on both TM and mozilla-central.
Attached file stack trace — 

    
  
Group: core-security

    
  
OS: Mac OS X → Windows XP

    
  
OS: Windows XP → Mac OS X

    
    

    
  
Doesn't crash Firefox 3.5.15pre or 3.6.12pre

          status1.9.1:
          --- → unaffected

          status1.9.2:
          --- → unaffected
Keywords: regression, 
          
            regressionwindow-wanted

    
    

    
  
On today's mozilla-central mac nightly I don't crash, I beach-ball and hang. Some kind of dead-lock? It's getting no CPU and when I try to sample the process I get a blank report. The stack trace when I force quit shows all the threads waiting for things.
Keywords: hang

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Fix
        — 
          — Splinter Review
      

    


  
We can't assume that we have a stack frame...
Assignee: nobody → mrbkap
Status: NEW → ASSIGNED

        Attachment #484375 -
        Flags: review?

    
  

        Attachment #484375 -
        Flags: review? → review?(jwalden+bmo)

    
  

        Attachment #484375 -
        Flags: review?(jwalden+bmo) → review+

    
    

    
  
Based on the stack and the fix this is a null pointer deref crash, which would mean it's not security sensitive. But dveditz, sound like you're seeing something else? Can you test again after the fix appears in a nightly?

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/99907cb0d9ce
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Group: core-security
Crash Signature: [@ JSStackFrame::scopeChain]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: