871294 - Crash in mozjs!JS_HasPropertyById

Status: RESOLVED DUPLICATE of bug 871849

(Core :: DOM: Core & HTML, defect)

Description

[Nils]

Attachment: Testcase (crashes firefox).

The attached test case crashes Firefox dereferencing unmapped memory. The testcase requires Jesse's quitter extension for garbage collection (http://www.squarefree.com/extensions/quitter.xpi)

Comment 1

[Nils]

Attachment: Windbg output

Comment 2

[Nils]

Attachment: gdb output

Comment 3

[Boris Zbarsky [:bzbarsky]]

Looks a lot like bug 869027?  This sure looks like issues with the HTMLDocument expando object.

Comment 4

[Daniel Veditz [:dveditz]]

Matt: please try Fx22 (Beta) to see if it suffers this problem also. If it does please try the ESR branch as well.

Comment 5

[Matt Wobensmith [:mwobensmith][:matt:]]

Does not affect FF22 or FF17esr.

Comment 6

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Peter, could you look at this, because you are looking at a bunch of similar bugs?  Thanks.

Comment 7

[Peter Van der Beken [:peterv]]

(In reply to Boris Zbarsky (:bz) from comment #3)
> Looks a lot like bug 869027?

Probably. That doesn't have a testcase, so this one got fixed in bug 871849. But normally that fix should also fix bug 869027.

Comment 8

[Andrew McCreight (out of office until 8/21) [:mccr8]]

For bounty purposes, FWIW, this was filed a day before the bug it is duped to (which was internally reported).

Comment 9

[Peter Van der Beken [:peterv]]

(In reply to Andrew McCreight [:mccr8] from comment #8)
> For bounty purposes, FWIW, this was filed a day before the bug it is duped
> to (which was internally reported).

Right. Bug 869027 was filed even earlier and turned out to be the exact same problem, but it didn't have a testcase.