674854 - crash in nsScriptSecurityManager::CheckPropertyAccessImpl with Firebug

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[henryfhchan]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:8.0a1) Gecko/20110727 Firefox/8.0a1
Build ID: 20110727081800

Steps to reproduce:

in Firebug i pasted the code
var a = [];
a.push(a);


Actual results:

Browser Crash


Expected results:

A Stop Script Prompt should have occured or a script error generated

Crash Report: bp-f122538c-c12d-408f-bc1d-3db522110728 (can't be loaded for some reason)

Comment 1

[Boris Zbarsky [:bzbarsky]]

mrbkap, that stack looks like your sort of thing....

Comment 3

[Scoobidiver (away)]

It's #38 top crasher in 7.0.1.

There are strong correlations with developer or AVG add-ons in 7.0.1:
  nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int, nsAXPCNativeCallContext*, JSContext*, JSObject*, nsISupports*, nsIURI*, nsIClassInfo*, char const*, int, void**)|EXCEPTION_STACK_OVERFLOW (309 crashes)
     75% (233/309) vs.   2% (2314/97799) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     45% (140/309) vs.   7% (6802/97799) {1E73965B-8B48-48be-9C8D-68B920ABC1C4} (AVG Safe Search)
     32% (99/309) vs.   0% (191/97799) [e-mail]
     29% (90/309) vs.   0% (370/97799) {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} (iMacros for Firefox, https://addons.mozilla.org/addon/3863)
     24% (74/309) vs.   1% (892/97799) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60)

Comment 4

[jorge alves]

Got this crash by going to:

http://maps.google.com/maps?ll=33.742568,-117.820365&spn=0.004853,0.013561&sll=33.742814,-117.816672&layer=c&cid=7704649002191693046&panoid=qHPoNvOZOYBaFsE0vGCa5A&cbp=13,127.37,,0,11.85&gl=us&hq=comic+book+store+orange+county&t=h&vpsrc=0&cbll=33.742848,-117.816622&z=17

Walking around the store for a bit ended up in a crash.

report: https://crash-stats.mozilla.com/report/index/bp-f6cef720-3699-41e1-9398-81c3a2111026

browser: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111026 Firefox/10.0a1

Comment 5

[Marcia Knous [:marcia]]

Are you able to reproduce this? I tried but so far no luck.

The latest correlations showing for this signature are:

51% (522/1014) vs.   1% (1146/115639) {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} (iMacros for Firefox, https://addons.mozilla.org/addon/3863)
     52% (524/1014) vs.   2% (2716/115639) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     16% (167/1014) vs.   1% (973/115639) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60)
     17% (175/1014) vs.   3% (3507/115639) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748)
     19% (197/1014) vs.   7% (8239/115639) {1E73965B-8B48-48be-9C8D-68B920ABC1C4}
     20% (207/1014) vs.  10% (11292/115639) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
      9% (90/1014) vs.   0% (178/115639) [e-mail]
      9% (88/1014) vs.   0% (454/115639) {6AC85730-7D0F-4de0-B3FA-21142DD85326} (ColorZilla, https://addons.mozilla.org/addon/271)
     12% (125/1014) vs.   5% (6348/115639) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
     13% (128/1014) vs.   7% (7893/115639) {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
      7% (72/1014) vs.   2% (1837/115639) {DDC359D1-844A-42a7-9AA1-88A850A938A8} (DownThemAll!, https://addons.mozilla.org/addon/201)

(In reply to jorge alves from comment #4)
> Got this crash by going to:
> 
> http://maps.google.com/maps?ll=33.742568,-117.820365&spn=0.004853,0.
> 013561&sll=33.742814,-117.
> 816672&layer=c&cid=7704649002191693046&panoid=qHPoNvOZOYBaFsE0vGCa5A&cbp=13,
> 127.37,,0,11.85&gl=us&hq=comic+book+store+orange+county&t=h&vpsrc=0&cbll=33.
> 742848,-117.816622&z=17
> 
> Walking around the store for a bit ended up in a crash.
> 
> report:
> https://crash-stats.mozilla.com/report/index/bp-f6cef720-3699-41e1-9398-
> 81c3a2111026
> 
> browser: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111026
> Firefox/10.0a1

Comment 6

[Robert Kaiser]

This has been rising significantly in the last days, in parallel with https://crash-stats.mozilla.com/report/list?signature=nsScriptSecurityManager%3A%3ALookupPolicy%28nsIPrincipal*%2C%20ClassInfoData%26%2C%20int%2C%20unsigned%20int%2C%20ClassPolicy**%2C%20SecurityLevel*%29 (which is at a lower level though), but they're #11/#38 on 7 and #18/#20 on 8 in topcrash lists for yesterday, so we really should try to find out what's up here.

Comment 7

[jorge alves]

(In reply to Marcia Knous [:marcia] from comment #5)
> Are you able to reproduce this? I tried but so far no luck.

I was only able to reproduce it once, and another time a similar crash happened in an unrelated situation:
http://crash-stats.mozilla.com/report/index/bp-7907189d-6902-4c5a-95c8-9a06c2111028
http://crash-stats.mozilla.com/report/index/bp-bb69f25d-f8af-41cd-bbda-0a2742111028

Comment 8

[Marcia Knous [:marcia]]

The other signature noted in COmment 6 ranks in the top 25 for Beta 4 data.

I will work on trying to get some URLs to reproduce the crash. There are lots of mentions of Facebook in the comments.

Comment 9

[Marcia Knous [:marcia]]

Here are a sampling of URLs I culled from the month of October:

1268 \N
   1174 
    227 about:blank
    143 http://www.facebook.com/
    142 https://accounts.google.com/ServiceLoginAuth
    117 https://mail.google.com/mail/?shva=1#inbox
    114 "javascript:"""""
    102 http://www.google.com/
    102 https://mail.google.com/mail/?hl=en&tab=wm
     56 http://gmail.com/
     51 http://www.gmail.com/
     34 https://www.facebook.com/
     32 http://static.ak.facebook.com/common/referer_frame.php
     30 http://mail.google.com/mail/
     29 https://mail.google.com/mail/
     28 http://edge.jeetyetmedia.com/728x90_catchall_www_facebook_com.htm
     23 jar:file:///C:/Program%20Files/Mozilla%20Firefox/omni.jar!/chrome/browser/content/browser/aboutSessionRestore.xhtml
     23 http://www.google.de/
     23 http://www.google.co.uk/
     21 https://mail.google.com/mail/?hl=en&shva=1#inbox
     20 https://mail.google.com/mail/?shva=1
     15 http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
     15 https://s-static.ak.facebook.com/common/referer_frame.php
     15 http://gfx3.hotmail.com/mail/16.0.1877.0920/home.js
     14 http://www.google.es/
     14 http://www.facebook.com/#!/
     13 http://www.youtube.com/
     13 http://mail.google.com/mail/#inbox
     12 http://www.google.fr/
     12 http://www.google.com/ig
     11 http://www.google.com/ig?hl=en&source=iglk
     10 jar:file:///C:/Program%20Files/Mozilla%20Firefox/omni.jar!/chrome/browser/content/browser/aboutHome.xhtml
     10 http://yandex.ru/yandsearch?text=%D0%BC%D0%BE%D1%8F+%D1%81%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0+%D0%B2+%D0%BE%D0%B4%D0%BD%D0%BE%D0%BA%D0%BB%D0%B0%D1%81%D1%81%D0%BD%D0%B8%D0%BA%D0%B0%D1%85&clid=46510&lr=976
     10 http://www.google.pl/
     10 http://translate.google.com/
     10 http://static.ak.facebook.com/connect/canvas_proxy.php?version=3#behavior=p&method=setSize&params=%7B%22height%22%3A1673%2C%22width%22%3A764%2C%22frame%22%3A%22iframe_canvas%22%7D
     10 https://mail.google.com/mail
     10 http://s.glbimg.com/en/hm/media//globocom/iframe/globo_shopping.html
      9 http://mail.live.com/default.aspx
      8 http://www.google.com.br/
      8 http://www.google.co.in/
      8 https://mail.google.com/mail/u/0/?shva=1#inbox
      8 https://mail.google.com/mail/?hl=en&tab=wm#inbox
      7 javascript:''
      7 jar:file:///C:/Program%20Files%20(x86)/Mozilla%20Firefox/omni.jar!/chrome/browser/content/browser/aboutHome.xhtml
      7 http://www.google.com.tr/
      7 http://www.google.co.id/
      7 http://www.google.ca/
      7 http://platform.twitter.com/widgets/hub.html
      7 http://google.com/pagead/drt/ui
      6 javascript:false;
      6 http://www.facebook.com/widgets/livefeed.php?app_id=121498884540960&xid=los40-webplayer-livestreambox&width=425&height=340
      6 https://www.facebook.com/dialog/permissions.request
      6 https://mail.google.com/mail/?shva=1#
      6 https://mail.google.com/mail/?hl=de&tab=wm
      6 http://e.mail.ru/cgi-bin/msglist?back=1
      5 jar:file:///C:/Program%20Files%20(x86)/Mozilla%20Firefox/omni.jar!/chrome/toolkit/content/mozapps/extensions/extensions.xul
      5 http://www.yahoo.com/
      5 http://www.orkut.com.br/Home
      5 http://www.facebook.com/plugins/live_stream_box.php?api_key=e153f603f577e784efbab266cc0f0151&xid=directos_lasexta&width=300&height=515&hide_friends_tab=0&always_post_to_friends=0&via_url=&locale=en_US&sdk=edgar
      5 http://www.facebook.com/plugins/like.php?app_id=238609552831050&href=http%3A%2F%2Fwww.facebook.com%2FYahooHongKong&send=false&layout=button_count&width=100&show_faces=false&action=like&colorscheme=light&font=arial&height=21
      5 http://www.facebook.com/home.php?ref=hp
      5 http://www.europafm.com/directo/
      5 http://twitter.com/
      5 https://www.sendoutcards.com/product/buy-points-expense/#start-monthly-subscription-points
      5 https://www.facebook.com/dialog/stream.publish
      5 http://supportlocal.industry.siemens.com:6618/my/ww/de
      5 https://mail.google.com/mail/?tab=Xm
      5 https://mail.google.com/mail/?tab=cm
      5 https://mail.google.com/mail/?hl=en&shva=1
      5 https://accounts.google.com/AccountRecoveryOptionsPrompt
      5 http://mein.dbna.de/comcenter.php
      5 http://localhost/TownApp/Admin/Restaurant/Restaurant.aspx
      5 http://localhost/
      5 http://de.bestseller.com/on/demandware.store/Sites-DE-Site/de_DE/Cart-Show
      5 http://ads.doweb.fr/ads728-90.html
      5 http://192.168.1.97/frd/
      5 file:///E:/htdocs/xiami/loop/room.htm
      5 about:sessionrestore
      4 wyciwyg://3/https://mail.google.com/mail/?ui=2&view=bsp&ver=ohhl4rw8mbn4
      4 jar:file:///C:/Program%20Files%20(x86)/Mozilla%20Firefox/omni.jar!/chrome/browser/content/browser/aboutSessionRestore.xhtml
      4 http://www.tribunjambi.com/
      4 http://www.tagesschau.de/
      4 http://www.reddit.com/tb/lea0u
      4 http://www.orkut.com.br/Main#Home
      4 http://www.northshorelij.com/NSLIJ/NSLIJ+HomePage
      4 http://www.naver.com/
      4 http://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official
      4 http://underworldgangsters.com/?p=crimes
      4 http://translate.google.de/

Comment 10

[henryfhchan]

the original code might not actually be related since it cannot be reproduced

Comment 11

[henryfhchan]

url is reduced testcase.
causes chrome to throw exception "stack overflow".

Comment 12

[Boris Zbarsky [:bzbarsky]]

Is the testcase in the url only a crash with Firebug?  Because if so, it's a testcase for a totally different Firebug bug; one where once you run out of stack with Firebug running, Firebug still tries to run script and recurses inside itself.

Comment 13

[Jan Honza Odvarko [:Honza] (always need-info? me)]

According to the crash report Firebug 1.8.0b6 is installed.
Does the problem happen with Firebug 1.8.4 or 1.9.0?

Honza

Comment 14

[henryfhchan]

I just realized firebug had to be enabled for it to crash.
1.9.0 is still reproducing the bug.

Also for comment 0, it should've been
> var a = [];
> a.push(a);
> a;

Comment 15

[Boris Zbarsky [:bzbarsky]]

OK.  This is a duplicate, then.

Comment 16

[Sebastian Zartner [:sebo]]

I didn't encounter this crash for a long time. (Tried it with FF 32.0.2 + FB 2.0.4 on Win7 right now.)

Therefore I finally close this issue.

Sebastian