616899 - crash [@ nsTreeBodyFrame::PrefillPropertyArray(int, nsTreeColumn*)] when using the JavaScript debugger

Status: RESOLVED INVALID

(Core :: XUL, defect)

Description

[Yuhong Bao]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12

This is about a crash that has been reported to Mozilla using crash ID bp-1eee2c5f-9f1a-45aa-a474-9f2a82101126 and several other crash IDs by me. Note that this is not a duplicate of bug 615958, as the crash is at a different location. Probably a use after free bug, as I have checked using a debugger and mSlots is not null but was pointing at an invalid address. Marking as critical as it really makes using the debugger frustrating at times.

Reproducible: Always

Steps to Reproduce:
1. Keep stepping using the JavaScript debugger.
2. When it freezes, close all Firefox windows.

Actual Results:  
Crash.

Expected Results:  
Should not freeze at all.

Comment 1

[timeless]

assuming mView goes to null when this happens, bug 615958's current patch should fix this. but i'm not sure if that assumption is valid.

Comment 2

[Philip Chee]

Hey guys,

Where should this bug go? Core->XP Toolkit/Widgets:XUL?
Or wherever the JSD bugs live (jsengine?)

Comment 3

[Yuhong Bao]

(In reply to comment #1)
> assuming mView goes to null when this happens, bug 615958's current patch
> should fix this. but i'm not sure if that assumption is valid.

Indeed, I just confirmed with a debugger that it is not. In fact, the memory for the this object is filled with 0xf0de7fff

Comment 4

[Yuhong Bao]

Attachment: A crashdump of one crash

Comment 5

[Yuhong Bao]

Attachment: The correct minidumps

Sorry, last one uploaded was wrong.

Comment 6

[timeless]

xul trees are broken, it's a bug in xul trees. venkman/jsd are not doing anything wrong.

Comment 8

[Mason]

also cf. bug 666277

Comment 10

[Wayne Mery (:wsmwk)]

removing bug 615958 from blocking per comment 3

Comment 11

[SkyLined]

@Jesse: AFAIK the address 0xF0DE7FFF is used to "poison" memory, so this may be a security issue.

However, I don't remember where I got that information: do you know what part of the code uses 0xF0DE7FFF to poison memory? I ask because I am seeing crashes at this address during my own fuzzing.

Finally, I understand the JavaScript debugger is deprecated - is this still an issue?

Comment 12

[Philip Chee]

> Finally, I understand the JavaScript debugger is deprecated - is this still
> an issue?

The JSD v1 API doesn't work any more and the Venkman Javascript debugger is dead.
The current remote debugger JSD2 API can be accessed from Firefox Developer Tools.
I guess this is a WONTFIX or OBSOLETE

Comment 13

[Firefox Bug Husbandry Bot]

Moving to Core:XUL per https://bugzilla.mozilla.org/show_bug.cgi?id=1455336