MASTER firefox crashed [@ nsAttrAndChildArray::Clear] [@ ~nsAttrAndChildArray]

[coder2000]

DistroRelease: Ubuntu 6.10
Package: firefox 2.0+0dfsg-0ubuntu3

Good stacktrace

I have no idea if this is a similar bug to others or not but when I visit some sites firefox just quits. The current stacktrace indicates something with the javascript.

Extract from retraced stacktrace:
...
 #3 <signal handler called>
 #4 nsAttrAndChildArray::Clear (this=0xb60c79c)
 #5 ~nsAttrAndChildArray (this=0xb60c79c)
 #6 ~nsGenericElement (this=0xb60c788)
 #7 ~nsHTMLImageElement (this=0xb60c788)
 #8 nsGenericElement::Release (this=0xb35a998)
 #9 nsHTMLImageElement::Release (this=0xb60c788)
 #10 ReleaseObjects (aElement=0xb35a998) at nsCOMArray.cpp:152
 #11 nsVoidArray::EnumerateForwards (this=0xb6dee08,
 #12 nsCOMArray_base::Clear (this=0xb6dee08)
 #13 nsBaseContentList::Reset (this=0xb6dee00)
...

[georgi (guninski)]

Created attachment 217404
crash

[georgi (guninski)]

stack

#0 0x0000000000865fb8 in ?? ()
#1 0x00002aaab0e8e6ad in nsAttrAndChildArray::Clear (this=0x1330ad0)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsAttrAndChildArray.cpp:647
#2 0x00002aaab0e8e713 in ~nsAttrAndChildArray (this=0x1330ad0)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsAttrAndChildArray.cpp:133
#3 0x00002aaab0ef3ba0 in ~nsGenericElement (this=0x1330aa0)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsGenericElement.cpp:870
#4 0x00002aaab0f72827 in nsGenericHTMLElement::~nsGenericHTMLElement$base ()
    at ../../../../dist/include/dom/nsIDOMElement.h:24
#5 0x00002aaab0f81c10 in ~nsHTMLBodyElement (this=0x1330aa0)
    at /opt/joro/suite-cvs/mozilla/content/html/content/src/nsHTMLBodyElement.cpp:294
#6 0x00002aaab0eed76d in nsGenericElement::Release (this=0x1330aa0)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsGenericElement.cpp:3141
#7 0x00002aaab0f81c6f in nsHTMLBodyElement::Release (this=0x1330aa0)
    at /opt/joro/suite-cvs/mozilla/content/html/content/src/nsHTMLBodyElement.cpp:298
#8 0x00002aaab0e8e6c1 in nsAttrAndChildArray::Clear (this=0x1316f90)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsAttrAndChildArray.cpp:648
#9 0x00002aaab0e8e713 in ~nsAttrAndChildArray (this=0x1316f90)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsAttrAndChildArray.cpp:133
#10 0x00002aaab0ef3ba0 in ~nsGenericElement (this=0x1316f60)
    at /opt/joro/suite-cvs/mozilla/content/base/src/nsGenericElement.cpp:870

[Jruderman (jruderman)]

Crashes with a scary stack trace on Mac too. Top of the stack:

Thread 0 Crashed:
0 <<00000000>> 0xc0000000 0 + -1073741824
1 org.mozilla.firefox 0x005693a8 nsAttrAndChildArray::~nsAttrAndChildArray [unified]() + 36

[georgi (guninski)]

sure, the seamonkey stack is scary on linux

[Bzbarsky (bzbarsky)]

sicking, any idea what could be up here? We're running the JS from under BindToTree, sadly, but we should be handling this particular setup right, I'd think....

roc, we should try to figure out how to plug this case into your new setup. :(

[L. David Baron (dbaron)]

mrbkap has a patch

[L. David Baron (dbaron)]

The problem was an extra release in the content sink caused by SinkContext::OpenContainer incrementing mStackPos much later than where it stuck things on the stack -- the parent.document.write in the iframe appends to the parent between those two points (inside the AppendChildTo call), which messes up the sink context's stack.

[Mrbkap (mrbkap)]

Created attachment 217628
Fix

This fixes the problem, as dbaron said.

[Jst (jst)]

Comment on attachment 217628
Fix

r=jst

[L. David Baron (dbaron)]

I have to say, it would be nice if...

  if (mStackPos <= 0) {
    NS_ERROR("container w/o parent");

    return NS_ERROR_FAILURE;
  }

... were at the beginning of the function, before we potentially create and leak a node.

It would also be nice if the ++mStackPos were really *right* next to the code where we fill in mStack[mStackPos]. (I don't care whether the latter moves up or the former moves down, but it might matter.)

[Mrbkap (mrbkap)]

Created attachment 217630
With that change

I'm convinced.

[Jst (jst)]

Comment on attachment 217630
With that change

Yeah, looks better.

[Jonas-sicking (jonas-sicking)]

Comment on attachment 217630
With that change

> nsresult rv;
> if (mStackPos + 1 > mStackSize) {
> rv = GrowStack();
> if (NS_FAILED(rv)) {
> return rv;
> }
> }
>
>+ if (mStackPos <= 0) {
>+ NS_ERROR("container w/o parent");
>+
>+ return NS_ERROR_FAILURE;
>+ }

But switch these two checks around.

[Mrbkap (mrbkap)]

Comment on attachment 217630
With that change

jst reviewed this.

[Mrbkap (mrbkap)]

Fix checked into trunk.

[Mrbkap (mrbkap)]

Comment on attachment 217630
With that change

This fixes a use of free'd memory.

[Bzbarsky (bzbarsky)]

Comment on attachment 217630
With that change

Taking some liberties here... ;)

[Mrbkap (mrbkap)]

Fix checked into the 1.8 branch.

[georgi (guninski)]

seems fixed in today trunk.

but a very similar abuse from xbl:
Bug 332807
xul iframe doing parent.document.open() - open this
https://bugzilla.mozilla.org/attachment.cgi?id=217441

still works.

[Mrbkap (mrbkap)]

(In reply to comment #19)
> but a very similar abuse from xbl:

This was a bug in the HTML content sink code, and the fix was also in the HTML content sink code. Therefore, abuses from XBL would be unaffected by such a fix :-(.

[Dveditz (dveditz)]

Comment on attachment 217630
With that change

approved for 1.8.0 branch, a=dveditz for drivers

[Mrbkap (mrbkap)]

Checked into the 1.8.0 branch.

[Twalker (twalker)]

verified with: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060504 Firefox/1.5.0.4

[coder2000 (coder2000)]

I have no idea if this is a similar bug to others or not but when I visit some sites firefox just quits. The current stacktrace indicates something with the javascript.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Sorry for this late response.

Attaching symbolized stacktrace from original report. Changing Summary to MASTER

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Probably upstream's https://bugzilla.mozilla.org/show_bug.cgi?id=332971

[Alexander Sack (asac)]

fixed for a while in ffox 2 and ffox 3.