783888 - Stack overflow via window.open.

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Boev Vadim Aleksandrovich]

Attachment: The file causing the problem.

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14.0.1
Build ID: 20120713134347

Steps to reproduce:

moved to the site


Actual results:

program stopped


Expected results:

launch site

Comment 1

[Boev Vadim Aleksandrovich]

bp-00ec7066-2cbe-4e0b-9e1b-ee3302120819

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Stack overflows are not exploitable.

Comment 3

[Benjamin Smedberg]

Not a recent regression nor a critical security issue.

Comment 4

[Boev Vadim Aleksandrovich]

another example

<script type="text/javascript">

while(1) {

window.open('file:///C:/Documents%20and%20Settings/skif/%D0%A0%D0%B0%D0%B1%D0%BE%D1%87%D0%B8%D0%B9%20%D1%81%D1%82%D0%BE%D0%BB/bag%20mozillaNOW.htm');

}
</script>

bp-45a0cedc-84a2-429e-be4e-3046d2120914

Comment 5

[Boev Vadim Aleksandrovich]

Crash Address	0x183f198

Comment 6

[Boev Vadim Aleksandrovich]

another example

<script type="text/javascript">
while(1) {

self.setInterval(window.open(),1)

}
</script>

Signature: nsJSContext::TerminationFuncClosure::~TerminationFuncClosure()

Crash Address	0x179f198

Comment 7

[Boev Vadim Aleksandrovich]

Attachment: The file causing the problem 2

Comment 8

[Boev Vadim Aleksandrovich]

to the collection of

<script type="text/javascript">
while(1) {

setTimeout(window.open(),1)

}
</script>

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 12

[Andrew McCreight [:mccr8]]

I tried the test case, but it just kind of sits there not doing much. It uses 100% of a CPU, but thanks to Fission and e10s the UI and other pages are going to remain responsive until the user closes the tab.