Proxy: Prevent DecompileValueGenerator loops on error reports.

NEW
Unassigned

Status

()

Core
JavaScript Engine
3 years ago
3 years ago

People

(Reporter: nbp, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

3 years ago
jit-test/tests/baseline/bug945223.js reports "InternalError: too much recursion", because the DecompileValueGenerator is unable to prevent re-entry.
Ideally, this test case should report that we expects getPropertyDescriptor to return an objects with some specific property as described in the MDN page, but instead, it just do an infinite loop.

#7652 js::DecompileValueGenerator (…, v=$jsval((JSObject *) 0x7fffee85b0c0 [object Proxy]), …)
#7653 js::ReportValueErrorFlags (…, v=$jsval((JSObject *) 0x7fffee85b0c0 [object Proxy]), …, arg1=0x170e280 "getPropertyDescriptor", …)
#7654 ReturnedValueMustNotBePrimitive (…)
#7655 js::ScriptedIndirectProxyHandler::getPropertyDescriptor (…)
#7656 js::BaseProxyHandler::get (…)
#7657 js::ScriptedIndirectProxyHandler::get (…)
#7658 js::Proxy::get (…, id=$jsid("toSource"), …)
#7659 js::proxy_GetProperty (…)
#7660 js::GetProperty (…)
#7661 js::GetProperty (…)
#7662 js::ValueToSource (…, v=$jsval((JSObject *) 0x7fffee85b0c0 [object Proxy]))
#7663 js::DecompileValueGenerator (…, v=$jsval((JSObject *) 0x7fffee85b0c0 [object Proxy]), …)
#7664 js::ReportValueErrorFlags (…, v=$jsval((JSObject *) 0x7fffee85b0c0 [object Proxy]), …, arg1=0x170e260 "getPropertyDescriptor", …)
You need to log in before you can comment on or make changes to this bug.