Bug 81488 – Empty beforeload event listener makes web process crash when visting this web page

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Marc Hoyois]

Created attachment 132538 [details]
Minimal extension that causes the crash

Overview:

The presence of any beforeload event listener makes Safari's web process crash when visting http://www.zennioptical.com/.

Steps to reproduce:
!! WEB PROCESS WILL CRASH AND ALL TABS WILL RELOAD WHEN YOU DO THIS !!

1. Install the attached minimal extension, which has the following injected script:

function handleBeforeLoadEvent(event) {}
document.addEventListener("beforeload", handleBeforeLoadEvent, true);

(This will also work with any of the standard extensions that use beforeload, obviously.)

2. Visit http://www.zennioptical.com/.
3. Wait a few seconds and observe the crash!

Build date & platform: tested with Safari 5.2 and nightly build 7535.18.5, 536+. Happens in Safari 5.1.4 as well.

[Alexey Proskuryakov]

Could you please attach a crash log?

[Marc Hoyois]

Created attachment 132611 [details]
Crash log

[Alexey Proskuryakov]

0   com.apple.JavaScriptCore      	0x00007fff924620e8 JSC::Weak<JSC::JSCell>::Weak(JSC::JSGlobalData&, JSC::JSCell*, JSC::WeakHandleOwner*, void*) + 56
1   com.apple.JavaScriptCore      	0x00007fff92462001 JSC::Heap::addFinalizer(JSC::JSCell*, void (*)(JSC::JSCell*)) + 33
2   com.apple.JavaScriptCore      	0x00007fff923f07b4 JSC::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 148

[Marc Hoyois]

It doesn't crash anymore, so I assume the bug was fixed.