647636 - [crash] with stack overflow in Firebug console

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[John J. Barton]

1. Install Firebug 1.8.0a1, http://getfirebug.com/releases/firebug/1.8
2. about:blank, Console panel, Command Editor side panel (RHS)
3. Paste:
--------------
var x = [];
var y = function(z) { z.push(3) };
x.push( [x] ); // circular reference
y( x );
console.log( x );
-------------
4. Run button

Mozilla/5.0 (Windows NT 6.1; rv:2.0) Gecko/20100101 Firefox/4.0

(I do have a bunch of other extn, but it seems unlikely they would be involved).

Comment 1

[John J. Barton]

Honza, please confirm.

This seems like the other recent stack overflow case where the JS stack overflow  blows the C++ stack.

User reports infinite loop using 1.7:
http://code.google.com/p/fbug/issues/detail?id=4324

Comment 2

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Verified, here is my crash report:
https://crash-stats.mozilla.com/report/index/26743591-f5f6-4b74-9a3a-43eb82110404

Built from http://hg.mozilla.org/releases/mozilla-2.0/rev/6be9e31d01b4
Build Platform target: i686-pc-mingw32

Honza

Comment 3

[(mostly gone) XtC4UaLL [:xtc4uall]]

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int,nsAXPCNativeCallContext*,JSContext*,JSObject*,nsISupports*,nsIURI*,nsIClassInfo*,char const*,int,void**) 	caps/src/nsScriptSecurityManager.cpp:719
1 	xul.dll 	nsScriptSecurityManager::CheckPropertyAccess(JSContext*,JSObject*,char const*,int,unsigned int) 	caps/src/nsScriptSecurityManager.cpp:642
2 	xul.dll 	nsScriptSecurityManager::CheckObjectAccess(JSContext*,JSObject*,int,JSAccessMode,unsigned __int64*) 	caps/src/nsScriptSecurityManager.cpp:625
3 	mozjs.dll 	InitExnPrivate 	js/src/jsexn.cpp:302
4 	mozjs.dll 	js_ErrorToException(JSContext*,char const*,JSErrorReport*,JSErrorFormatString const* (*)(void*,char const*,unsigned int),void*) 	js/src/jsexn.cpp:1190
5 	mozjs.dll 	ReportError 	js/src/jscntxt.cpp:1287
6 	mozjs.dll 	js_ReportErrorNumberVA(JSContext*,unsigned int,JSErrorFormatString const* (*)(void*,char const*,unsigned int),void*,unsigned int,int,char*) 	js/src/jscntxt.cpp:1639
7 	mozjs.dll 	JS_ReportErrorNumber 	js/src/jsapi.cpp:5779
8 	mozjs.dll 	JSCompartment::wrap(JSContext*,js::Value*) 	js/src/jscompartment.cpp:194
9 	mozjs.dll 	JSCompartment::wrap(JSContext*,JSObject**) 	js/src/jscompartment.cpp:364
10 	mozjs.dll 	JS_WrapObject 	js/src/jsapi.cpp:1267
11 	xul.dll 	XPCConvert::NativeInterface2JSObject(XPCLazyCallContext&,unsigned __int64*,nsIXPConnectJSObjectHolder**,xpcObjectHelper&,nsID const*,XPCNativeInterface**,int,int,unsigned int*) 	js/src/xpconnect/src/xpcconvert.cpp:1329
12 	xul.dll 	XPCConvert::NativeData2JS(XPCLazyCallContext&,unsigned __int64*,void const*,nsXPTType const&,nsID const*,unsigned int*) 	js/src/xpconnect/src/xpcconvert.cpp:487
13 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*,unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1566
14 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) 	js/src/xpconnect/src/xpcwrappedjs.cpp:588
15 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
16 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
17 	xul.dll 	jsds_ErrorHookProc 	js/jsd/jsd_xpc.cpp:585

Comment 4

[John J. Barton]

Is this another version of Bug 643360?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Seems related.

Comment 6

[Hero Wanders]

Another examples crashing FF 13.0.1 with opened Firebug 1.9.2.:

---

function problematic() {
    return function() {
        return problematic().apply(this);
    };
}

problematic()();

---

Note that when writing problematic()() instead of problematic().apply(this), Firefox's continue/stop-dialog will be shown (but trying to stop it doesn't work).

Comment 7

[Pablo]

Hi Boris

We are checking on really old bugs to see if there is any that can be closed. Most of the people in this bug have their account deactivated.
Do you think we can close it? the link to install firebug does not work anymore.

Please let me know
thanks.

Comment 8

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Firebug is deprecated for a long time, I am closing this bug report.

Honza