379294 - Hang trying to serialize a sparse JavaScript array

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> void (x = [].constructor(0xffffffff));
js> x

Result: hang

I'm not sure this is a bug.

Comment 1

[Igor Bukanov]

Running the js shell with enabled branch callback terminates the script:

~> js -b 10000
js> void (x = [].constructor(0xffffffff));
void (x = [].constructor(0xffffffff));
js> x
x
native branch callback (10000 callbacks)
js> 

Thus I suggest to mark this as invalid.

Comment 2

[Jesse Ruderman]

Brendan suggests:
* Immediately throw OOM if it's obvious there won't be enough memory to hold the serialized string.
* Improve the speed of array.join (bug 374740).

Even with those fixed, it might still be possible to hang with a similar testcase (using a slightly smaller number).  But I probably deserve that hang for having turned off the slow-script dialog.

Comment 3

[Jesse Ruderman]

void ("" + new Array(0x90000000)) hangs ./js

This makes it painful to use large numbers in jsfunfuzz, which may be necessary for finding certain bugs.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to comment #3)
> ...
> This makes it painful to use large numbers in jsfunfuzz, which may be
> necessary for finding certain bugs.

(In reply to comment #2)
> ...
> * Improve the speed of array.join (bug 374740).
> 
> Even with those fixed, it might still be possible to hang with a similar
> testcase (using a slightly smaller number).  But I probably deserve that
> hang for having turned off the slow-script dialog.

374740 is fixed

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Both testcases still hang.

Comment 6

[Luke Wagner [:luke]]

Get's slow-script dialog in the browser which successfully kills it, so resolving invalid.